blog.bluetriangle.com Open in urlscan Pro
2606:4700::6811:72b4 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVW...
Effective URL:
https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th...
Submission: On November 26 via api (November 26th 2019, 11:43:01 pm UTC) from US

Summary HTTP 101 Redirects Links 63 Behaviour Indicators

Summary

This website contacted 33 IPs in 6 countries across 31 domains to perform 101 HTTP transactions. The main IP is 2606:4700::6811:72b4, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is blog.bluetriangle.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 1st 2019. Valid for: a year.

This is the only time blog.bluetriangle.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	2606:4700::68... 2606:4700::6812:a205	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 32	2606:4700::68... 2606:4700::6811:72b4	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	2606:4700::68... 2606:4700::6811:f4cc	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4	2a00:1450:400... 2a00:1450:4001:825::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1 9	2606:4700::68... 2606:4700::6810:fa05	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a00:1450:400... 2a00:1450:4001:821::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
6	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2606:4700::68... 2606:4700::6811:f2cc	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:edcc	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:74b0	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:46b0	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:e9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	2606:4700::68... 2606:4700::6810:f905	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6811:c9cc	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2	2a00:1450:400... 2a00:1450:4001:81b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE - Google LLC)
1 4	2.18.233.40 2.18.233.40	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	51.140.49.131 51.140.49.131	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1	2606:4700:10:... 2606:4700:10::6814:4461	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	13.224.197.175 13.224.197.175	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a02:26f0:6c0... 2a02:26f0:6c00:296::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	13.225.78.44 13.225.78.44	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3	2606:4700:20:... 2606:4700:20::6819:5b6e	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 3	54.154.177.155 54.154.177.155	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 1	2a00:1450:400... 2a00:1450:400c:c08::9b	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	2a00:1450:400... 2a00:1450:4001:818::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
3	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation)
2	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2606:4700::68... 2606:4700::6811:4004	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK - Facebook)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK - Facebook)
101	33

2 2606:4700::6812:a205 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

he.t.hubspotemail.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2606:4700::6811:72b4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

blog.bluetriangle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

pro.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f4cc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:825::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700::6810:fa05 (United States) 1 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

no-cache.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:821::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:f2cc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:edcc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:74b0 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:46b0 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e9cc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

js.hsleadflows.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:f905 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

api.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:c9cc (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81b::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.23.98 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s45-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.18.233.40 (Ascension Island) 1 redirects

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-40.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.140.49.131 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

secure.leadforensics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:4461 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

bluetriangle213691z.btttag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.197.175 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-224-197-175.fra2.r.cloudfront.net

d10lpsik1i8c69.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:296::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.78.44 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-78-44.fra2.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:20::6819:5b6e (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.clickcease.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.154.177.155 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-177-155.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9b (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:818::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN - LinkedIn Corporation, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4004 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	bluetriangle.com 1 redirects blog.bluetriangle.com	968 KB
12	hubspot.com 1 redirects no-cache.hubspot.com cdn1.hubspot.com api.hubspot.com track.hubspot.com forms.hubspot.com	11 KB
6	adroll.com 1 redirects s.adroll.com d.adroll.com	46 KB
6	gstatic.com fonts.gstatic.com	81 KB
4	googleapis.com fonts.googleapis.com	3 KB
4	hubspot.net cdn2.hubspot.net cdn1.hubspot.net	274 KB
4	fontawesome.com pro.fontawesome.com	163 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	google.de www.google.de	329 B
3	google.com 1 redirects www.google.com	399 B
3	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net	3 KB
3	clickcease.com www.clickcease.com	8 KB
2	facebook.com www.facebook.com	492 B
2	facebook.net connect.facebook.net	111 KB
2	bing.com bat.bing.com	7 KB
2	driftt.com js.driftt.com	45 KB
2	leadforensics.com secure.leadforensics.com	2 KB
2	googleadservices.com www.googleadservices.com	19 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
2	googletagmanager.com www.googletagmanager.com	52 KB
2	hubspotemail.net 1 redirects he.t.hubspotemail.net	3 KB
1	cloudflare.com cdnjs.cloudflare.com	10 KB
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	136 B
1	licdn.com snap.licdn.com	2 KB
1	cloudfront.net d10lpsik1i8c69.cloudfront.net	3 KB
1	btttag.com bluetriangle213691z.btttag.com	18 KB
1	hubapi.com api.hubapi.com	307 B
1	hsleadflows.net js.hsleadflows.net	61 KB
1	hs-analytics.net js.hs-analytics.net	25 KB
1	hsadspixel.net js.hsadspixel.net	2 KB
1	usemessages.com js.usemessages.com	14 KB
101	31

	Domain	Requested by
32	blog.bluetriangle.com	1 redirects he.t.hubspotemail.net blog.bluetriangle.com
6	fonts.gstatic.com	blog.bluetriangle.com
5	track.hubspot.com
4	s.adroll.com	1 redirects www.googletagmanager.com s.adroll.com
4	fonts.googleapis.com	blog.bluetriangle.com
4	pro.fontawesome.com	blog.bluetriangle.com
3	www.google.de
3	www.google.com	1 redirects
3	www.clickcease.com	he.t.hubspotemail.net www.clickcease.com
3	no-cache.hubspot.com	blog.bluetriangle.com
3	cdn2.hubspot.net	blog.bluetriangle.com
2	www.facebook.com
2	connect.facebook.net	js.hsadspixel.net connect.facebook.net
2	googleads.g.doubleclick.net	www.googleadservices.com
2	px.ads.linkedin.com	1 redirects
2	d.adroll.com
2	bat.bing.com	he.t.hubspotemail.net
2	js.driftt.com	he.t.hubspotemail.net js.driftt.com
2	secure.leadforensics.com	www.googletagmanager.com secure.leadforensics.com
2	www.googleadservices.com	www.googletagmanager.com
2	www.google-analytics.com	1 redirects www.googletagmanager.com
2	api.hubspot.com	js.usemessages.com blog.bluetriangle.com
2	www.googletagmanager.com	blog.bluetriangle.com js.hsadspixel.net
2	he.t.hubspotemail.net	1 redirects
1	cdnjs.cloudflare.com	www.clickcease.com
1	forms.hubspot.com	js.hsleadflows.net
1	www.linkedin.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	d.adroll.mgr.consensu.org	1 redirects
1	snap.licdn.com	he.t.hubspotemail.net
1	d10lpsik1i8c69.cloudfront.net	he.t.hubspotemail.net
1	bluetriangle213691z.btttag.com	www.googletagmanager.com
1	api.hubapi.com	js.hsadspixel.net
1	js.hsleadflows.net	blog.bluetriangle.com
1	js.hs-analytics.net	blog.bluetriangle.com
1	js.hsadspixel.net	blog.bluetriangle.com
1	js.usemessages.com	blog.bluetriangle.com
1	cdn1.hubspot.net	blog.bluetriangle.com
1	cdn1.hubspot.com	1 redirects
101	39

This site contains links to these domains. Also see Links.

Domain
www.bluetriangle.com
go.bluetriangle.com
portal.bluetriangle.com
www.linkedin.com
www.wired.com
www.bleepingcomputer.com
www.volexity.com
www.grahamcluley.com
www.forbes.com
www.zdnet.com
otx.alienvault.com
www.riskiq.com
portal.bluetriangletech.com
twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
hubspotemail.net CloudFlare Inc ECC CA-2	`2019-10-20` - `2020-10-09`	a year	crt.sh
blog.bluetriangle.com CloudFlare Inc ECC CA-2	`2019-03-01` - `2020-03-01`	a year	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
hubspot.net CloudFlare Inc ECC CA-2	`2019-04-16` - `2020-04-16`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
hubspot.com CloudFlare Inc ECC CA-2	`2019-08-28` - `2020-08-27`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
ssl817703.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-13` - `2020-02-19`	6 months	crt.sh
ssl803643.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-06` - `2020-05-14`	6 months	crt.sh
ssl803670.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-06` - `2020-05-14`	6 months	crt.sh
ssl817706.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-13` - `2020-02-19`	6 months	crt.sh
ssl817724.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-13` - `2020-02-19`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2018-12-19` - `2020-03-19`	a year	crt.sh
*.leadforensics.com Go Daddy Secure Certificate Authority - G2	`2018-12-19` - `2020-01-14`	a year	crt.sh
ssl365824.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-31` - `2020-03-08`	6 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
drift.com Amazon	`2019-10-03` - `2020-11-03`	a year	crt.sh
ssl375664.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-18` - `2020-05-26`	6 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
adroll.mgr.consensu.org Amazon	`2019-11-06` - `2020-12-06`	a year	crt.sh
www.google.de GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-11-20` - `2020-05-28`	6 months	crt.sh
www.google.com GTS CA 1O1	`2019-11-05` - `2020-01-28`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2019-11-06` - `2020-02-04`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Frame ID: E599BFD77DB1AB1265812302B22E845A
Requests: 100 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: CABA70B3EB143F9CAB11B0B02D978BF4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5... Page URL
https://he.t.hubspotemail.net/events/public/v1/track/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr87... HTTP 307
https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2Yn... Page URL

Detected technologies

AdRoll (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

script /(?:a|s)\.adroll\.com/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

html //i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

101
Requests

100 %
HTTPS

80 %
IPv6

31
Domains

39
Subdomains

33
IPs

6
Countries

1945 kB
Transfer

4176 kB
Size

4
Cookies

63 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bluetriangle.com/
Title:

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products
Title: Products

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/real-user-monitoring
Title: Monitor your web performance, quantify the revenue impact of optimizations, and find out what's slowing you down.

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/synthetic-monitoring
Title: Measure web performance externally from all devices around the globe to catch issues before your customers do.

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/tag-governance/
Title: Analyze the performance, placement, and loading order of your third-party tags and calculate their site speed impact.

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/marketing-analytics
Title: Follow the journey your customers take on your website and track your marketing KPIs, campaigns, and A/B tests in real-time.

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/content-security-policy-manager
Title: Build and manage your Content Security Policy to be protected from data breaches and browser hijacking.

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks
Title: Industry Benchmarks

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail
Title: Retail

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/airlines
Title: Airlines

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/banking
Title: Banking

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/hotels
Title: Hotels

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/media
Title: Media

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/
Title: More Benchmarks

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/about
Title: About

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/contact-us
Title: Contact

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/resources/webinars
Title: Webinars

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/resources/white-papers
Title: White Papers & Documents

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/news-events
Title: News & Events

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/product-training
Title: Product Training

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/careers
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/blog
Title: Blog

Search URL Search Domain Scan URL

URL: https://go.bluetriangle.com/cs/c/?cta_guid=011b105c-c4d8-4605-869c-6451c9cfe595&placement_guid=1a0e3486-ed3f-4fe8-96c9-c197ea352d9d&portal_id=5417298&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&redirect_url=APefjpEHWBWSvRmb69rDfNarC_ou2WB5F54N3Ufc6tfNrPQGAIbfUgaL_zYo9U1qgNrhJ8QJ2mHZtKQxldIIb8W0DhuhTcPhaCJ93r-MyRG7h4GOu_QO9KDWASia2P2z0Wfa5L1ZByGEfPnj8uwR25PhEGZvEy-dLV5zFGupsg-CfvUzJWcTGpPjF8o4dTIEr57jj1C1-nHG3DUz4ieg6uKEbxjs4jo1SpEBRThEfwD2cEXMkpvZwaWMzg008RpYXQNgkhYq0isBuS9956VyVjOZlhKaiidz4g&click=1c2ba755-9853-4d6f-9401-0ef18f34b642&hsutk=22add7a8df0e07765801c6eb7d193ebb&signature=AAH58kH_GsThn8TcuPS_6m_4mEcGpW1iOQ&pageId=8880541776&contentType=blog-post&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&__hssc=83254537.1.1574811764299&__hsfp=2430194794
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://go.bluetriangle.com/cs/c/?cta_guid=3c081ae7-837c-44ec-be18-436aab4201a1&placement_guid=49b2effe-e2da-47d6-a7b3-a1ce3e300ae2&portal_id=5417298&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&redirect_url=APefjpEs2ZQIVp63qhMy_Y0WXkyYkAYS4tiJNcVoGmb_ohoRpejyu1U-B2TcuEH_jrJgB_pSisqV_QDaxBSJF920dH-SovcI30C1nnDYQ1l5lfFhMxGL4c3IlFWt0K2wdBGZk68CcCR9ionjtsta2MlZ-Z_8vC_hNZ_ZggqM1SAC55Isfk_KkBJcI3-JcVi_ZrfWXtFvtte67SQU9JMOfg66q74p-PF-Q5PYOayjayj83hnuqz4NCStKtRBUNtbTBbbouMhrvHDwyrcLnEt1hotFzssWCLKiUmvgiy9k2oX2wVShyQEAQjUG4ZsUCfBDFZVG3DA_1ZlM&click=f7d8ddfd-28d1-4978-8bf6-11170692ff49&hsutk=22add7a8df0e07765801c6eb7d193ebb&signature=AAH58kHomN6JTGbaF2ghDzO3H43y-3pmiA&pageId=8880541776&contentType=blog-post&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&__hssc=83254537.1.1574811764299&__hsfp=2430194794
Title: Sign In

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/products/tag-content-security
Title: Tag Governance

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail-us
Title: Retail - US

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail-europe
Title: Retail - Europe

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail-apac
Title: Retail - APAC

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail-anz
Title: Retail - ANZ

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/travel
Title: Travel

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/third-party-tags
Title: Third Party Tags

Search URL Search Domain Scan URL

URL: http://www.bluetriangle.com/instant-demo
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://portal.bluetriangle.com/btportal/web/index.php?r=site%2Flogin
Title: Sign In

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/in/joshcarter1116/

Search URL Search Domain Scan URL

URL: https://www.wired.com/story/most-dangerous-people-on-internet-2018/
Title: WIRED's Most Dangerous People on the Internet

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/macys-customer-payment-info-stolen-in-magecart-data-breach/
Title: Macy's announced they were compromised

Search URL Search Domain Scan URL

URL: https://www.volexity.com/blog/2018/09/19/magecart-strikes-again-newegg/
Title: stealthily created a domain called

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/retail-us/?search=Macys
Title: Retail Benchmarks

Search URL Search Domain Scan URL

URL: https://www.grahamcluley.com/ticketmaster-is-hit-by-a-5-million-legal-action-after-online-payment-card-theft/
Title:

Search URL Search Domain Scan URL

URL: https://www.forbes.com/sites/kateoflahertyuk/2019/07/08/british-airways-hit-with-record-fine-following-2018-cyberattack/#544c44eb1f8e
Title: a record-breaking GDPR fine of $229 million

Search URL Search Domain Scan URL

URL: https://www.zdnet.com/article/one-in-five-magecart-infected-stores-get-reinfected-within-days/
Title: "infected (and cleaned) multiple times"

Search URL Search Domain Scan URL

URL: https://otx.alienvault.com/pulse/5ba9143be7c44e61aebe297f/
Title: known Magecart domains

Search URL Search Domain Scan URL

URL: https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/
Title: Ticketmaster UK was hacked in June 2018

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/magecart-skimmer-hits-hundreds-of-sites-in-ad-supply-chain-attack/
Title: Magecart compromised a retargeting script

Search URL Search Domain Scan URL

URL: https://www.zdnet.com/article/magecart-group-leverages-zero-days-in-20-magento-extensions/
Title: vulnerable Magento extensions

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/content-security-policy-manager/
Title: Content Security Policy Manager

Search URL Search Domain Scan URL

URL: https://go.bluetriangle.com/cs/c/?cta_guid=c5aae3c1-e4e4-445e-bd6f-4709e1b6eb14&placement_guid=66b04195-5274-4fb4-b37e-b7858df94db1&portal_id=5417298&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&redirect_url=APefjpH9fWCQ6DiZj5qBZec154auBLt_EODe8QjMkdYkDIFBccqU60ymFW6Bo09o5fbjQ6PAEkwC4vdJm5EJbqy-LRLhOKSRUwEB6CWFdWYu-ZrPuOnocDITdBf6pHCIi5TWess-pdyACqlBrlozjti6MJd7ZRbhWC56V8EDdQEQFe9FOqdW4svgK-LBMrOXsGFU0abXA0lPSaZfIlsYo7Z1lQC2kCK9IkDKlq5r8B68KtRmeu0T21K98HxWYTOLg5oJqE5c7QJNgsqnZSilyhK1Z-2pI-aN3x2RaSDJARt7sVl4RFZpqNZrfybe1sap2sLGprvnEYR8&click=b2d50c3d-6820-4c70-b59c-780c90df7482&hsutk=22add7a8df0e07765801c6eb7d193ebb&signature=AAH58kGntzq7y5tZelXEYOkJdiNrVvISAg&pageId=8880541776&contentType=blog-post&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&__hssc=83254537.1.1574811764299&__hsfp=2430194794
Title: Content Security Policy Manager

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/about/#features-collapse
Title: Features

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/real-user-monitoring
Title: Real User Monitoring

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/synthetic-monitoring
Title: Synthetic Monitoring

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/tag-governance
Title: Tag Governance

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/marketing-analytics
Title: Marketing Analytics

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/features/content-security-policy-manager
Title: Content Security Policy (CSP) Manager

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/about/#resources-collapse
Title: Benchmarks

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/industry-benchmarks/otas
Title: OTAs

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/resources/news-events
Title: News & Events

Search URL Search Domain Scan URL

URL: https://portal.bluetriangletech.com/BTTPortal/index.php?r=user/login
Title: Sign In

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/blue-triangle-technologies

Search URL Search Domain Scan URL

URL: https://twitter.com/_bluetriangle

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCGji00QzpbGaZX_SNwh3CCA

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.bluetriangle.com/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102 Page URL
https://he.t.hubspotemail.net/events/public/v1/track/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102?_ud=1f848418-693d-4e35-85f8-150cb4136be2&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/total-tag-control-image-2.png?width=1876&name=total-tag-control-image-2.png HTTP 301
https://cdn1.hubspot.com/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png HTTP 301
https://cdn1.hubspot.net/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png

Request Chain 68

https://s.adroll.com/j/exp/7S4DVTUJ2JESLNZBKXA4WS/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 69

https://d.adroll.mgr.consensu.org/consent/iabcheck/7S4DVTUJ2JESLNZBKXA4WS?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2 HTTP 302
https://d.adroll.com/consent/check/7S4DVTUJ2JESLNZBKXA4WS/?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2

Request Chain 70

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1199421168&t=pageview&_s=1&dl=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&ul=en-us&de=UTF-8&dt=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=YEBAAAAB~&jid=1506164272&gjid=2046580942&cid=926559145.1574811764&tid=UA-63189851-1&_gid=136954272.1574811764&_r=1&gtm=2wgav9T6RRHK&z=26339601 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_gid=136954272.1574811764&gjid=2046580942&_v=j79&z=26339601 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601&slf_rd=1&random=2373079466

Request Chain 71

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&time=1574811764359 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D419778%26url%3Dhttps%253A%252F%252Fblog.bluetriangle.com%252Fmagecart-attack-how-to-protect-your-site%253F_hsenc%253Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%2526_hsmi%253D79947511%26time%3D1574811764359%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&time=1574811764359&liSync=true

101 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2... Show response
he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/ 9 KB
2 KB 90ms
89ms Document
text/html 2606:4700::6812:a205
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:a205 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c8b23413b6bf6c17478b7c2f786737f34a78abcb17c8d3f5a2fada53c0ede751

Request headers

:method: GET
:authority: he.t.hubspotemail.net
:scheme: https
:path: /e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
date: Tue, 26 Nov 2019 23:42:41 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=dbcd4371339aa996ded4b63dc609911881574811761; expires=Thu, 26-Dec-19 23:42:41 GMT; path=/; domain=.hubspotemail.net; HttpOnly
referrer-policy: no-referrer
vary: Accept-Encoding
access-control-allow-credentials: false
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 53bfb867d8b4cbac-VIE
content-encoding: br

GET
H2

200

Primary Request magecart-attack-how-to-protect-your-site Show response
blog.bluetriangle.com/
Redirect Chain

https://he.t.hubspotemail.net/events/public/v1/track/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF...
https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511

67 KB
14 KB

386ms
318ms

Document
text/html

2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511

Requested by

Host: he.t.hubspotemail.net
URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / HubSpot

Resource Hash

76680627c94cb5c715ff09eaa8db4acdeae2b2de5b499748a37dc4e556b339b8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=0

Request headers

:method: GET
:authority: blog.bluetriangle.com
:scheme: https
:path: /magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 26 Nov 2019 23:42:42 GMT
content-type: text/html;charset=utf-8
set-cookie: __cfduid=db029effef97f16735447587595ff448c1574811762; expires=Thu, 26-Dec-19 23:42:42 GMT; path=/; domain=.blog.bluetriangle.com; HttpOnly __cfruid=924ae89b2358b8e4566838e1f823a5da49948bfe-1574811762; path=/; domain=.blog.bluetriangle.com; HttpOnly
cf-ray: 53bfb869c928cbc8-VIE
cf-cache-status: MISS
cache-control: s-maxage=120,max-age=5
link: </hs/hsstatic/HubspotToolsMenu/static-1.47/js/index.js>; rel=preload; as=script, </hs/hsstatic/cos-i18n/static-1.10/bundles/project.js>; rel=preload; as=script, </hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.3/bundles/project.js>; rel=preload; as=script, </_hcms/forms/v2.js>; rel=preload; as=script
strict-transport-security: max-age=0
vary: Accept-Encoding
access-control-allow-credentials: false
content-security-policy: upgrade-insecure-requests
edge-cache-tag: CT-8880541776,P-5417298,L-7538108930,L-7538166112,L-7739107680,CW-7355488504,CW-7355883530,CW-7355883532,CW-7355884809,CW-7538710482,E-7538098003,E-7739793639,E-8360294381,MENU-7545199273,MENU-7564289446,PGS-ALL,SW-4,SD-48
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-hs-cache-config: BrowserCache-5s-EdgeCache-120s
x-hs-combine-css: Retry
x-hs-content-id: 8880541776
x-hs-hub-id: 5417298
x-powered-by: HubSpot
x-trace: 2B4A3D3BAA7C0C4F4B8D785B00AAF1CB96CE6DC712000000000000000000
server: cloudflare
content-encoding: br
cf-h2-pushed: </hs/hsstatic/HubspotToolsMenu/static-1.47/js/index.js>,</hs/hsstatic/cos-i18n/static-1.10/bundles/project.js>,</hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.3/bundles/project.js>,</_hcms/forms/v2.js>

Redirect headers

status: 307
date: Tue, 26 Nov 2019 23:42:42 GMT
x-robots-tag: none
link: <https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511>; rel="canonical"
location: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
referrer-policy: no-referrer
access-control-allow-credentials: false
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 53bfb868699ccbac-VIE

GET
H2 200 index.js Show response
blog.bluetriangle.com/hs/hsstatic/HubspotToolsMenu/static-1.47/js/ 8 KB
3 KB 50ms
0ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/hsstatic/HubspotToolsMenu/static-1.47/js/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 75b857fc1e6ed070dffbbbf67e18a4e99ff49d805f5a924a0417ff0138ddf6d8

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 824fe21e467658628899bdd8725649ee.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD89-C1
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 Nov 2019 16:40:20 GMT
server: cloudflare
etag: W/"54b13e36e568fb12dcb53751d3045f0e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: Oye6KN0Ikl1ArcIW0aXcJXP_s4jLsAe8
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bacd3cbc8-VIE
x-amz-cf-id: XLY-DipH_QHJX0whnlUBr7m6Vp7gx_Me7SMBSuZsUprfpJHAU-SOtw==

GET
H2 200 project.js Show response
blog.bluetriangle.com/hs/hsstatic/cos-i18n/static-1.10/bundles/ 1 KB
1 KB 476ms
0ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/hsstatic/cos-i18n/static-1.10/bundles/project.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ab449241b50123673e76dbcd70f869ae11d26920f0ce1670fdfd266308058179

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 443f1433224715dbc774145b9ac2efe4.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: IAD89-C2
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Wed, 13 Sep 2017 02:51:30 GMT
server: cloudflare
etag: W/"0011aaf4067b097bcbfd9dc99a4b94c0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: p6iak7Gl9Xyg7crK_8XyTwctOBvKD1DL
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bacd4cbc8-VIE
x-amz-cf-id: jGzXcKkMUn6qeNw8fWHQgY8Ptq_xuJz1b8yNEfLOwcwqG4r1y8H96Q==

GET
H2 200 project.js Show response
blog.bluetriangle.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.3/bundles/ 2 KB
761 B 43ms
0ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/hsstatic/keyboard-accessible-menu-flyouts/static-1.3/bundles/project.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09f439b49fd8ccd1abd10c152ca30c78bb690ecd5f0e556eb01a08f352a14158

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 a0042b5b0abdf83ac753e9d8be59e4e5.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 1090420
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Mon, 02 Jul 2018 13:11:21 GMT
server: cloudflare
etag: W/"c7e3582e33ff653f3eb6b0b5068c6425"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: 3zHbwEdez_RyA8.10bTabAs8HfuAS5gs
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
x-amz-cf-pop: IAD79-C3
cf-ray: 53bfb86bacd5cbc8-VIE
x-amz-cf-id: y3G4fUd3Zjn28LYwAj2TZLDVoHpvAiT3xjXXy1K9FnkZ_npWrM4Qdg==

GET
H2 200 v2.js Show response
blog.bluetriangle.com/_hcms/forms/ 418 KB
106 KB 173ms
0ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/_hcms/forms/v2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c868f8d8e86e0011551d14489eec739976cd48bffd079e267d076461bbf6482

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 86cbb00f1764c01bb52636b360589754.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: IAD79-C1
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Thu, 21 Nov 2019 02:43:55 GMT
server: cloudflare
etag: W/"d8f4eb4ad7f776ddc7597391296267ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: uMvDCuv75j2ZC1E.OE4oVJMXxbPylmEZ
cache-control: max-age=600
access-control-allow-credentials: false
cf-ray: 53bfb86bacd6cbc8-VIE
x-amz-cf-id: jcnP6HEWiMkPvSAjChNTknrcW7NhbZmAh9GLw37zltLXkFZKtBrM8g==

GET
H2 200 jquery-1.7.1.js Show response
blog.bluetriangle.com/hs/hsstatic/jquery-libs/static-1.1/jquery/ 92 KB
32 KB 78ms
77ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/hsstatic/jquery-libs/static-1.1/jquery/jquery-1.7.1.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 2e8c2e7cad8a51072f754f4edb4b5715.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD79-C2
x-cache: Hit from cloudfront
status: 200
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Tue, 25 Nov 2014 17:03:30 GMT
server: cloudflare
etag: W/"ddb84c1587287b2df08966081ef063bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bdd0dcbc8-VIE
x-amz-cf-id: UsW0uFuV9_7wX7iQQ2vfYeE1zzNCbuLolAm-Pt_hwAp9xBmkdeC7NA==

GET
H2 200 project.css
blog.bluetriangle.com/hs/hsstatic/BlogSocialSharingSupport/static-1.2/bundles/ 727 B
561 B 69ms
68ms Stylesheet
text/css 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/hsstatic/BlogSocialSharingSupport/static-1.2/bundles/project.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 298b31e4d53f54b3acd2bc16ba3fe309966a61bf27c3a77792af1c49dc334ccf

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 6b7e1e42d74fd61097787cc6c1a37c35.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD89-C1
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: text/css
last-modified: Wed, 09 Oct 2019 20:09:36 GMT
server: cloudflare
etag: W/"18eeef3c6fff6a7816b877900ede82e6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: xbraC65I7IPtNDflhQqiuRaWpETzAUVq
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bdd0ecbc8-VIE
x-amz-cf-id: AylVFBG1lA7bUOJ6hdgWoyxU3uZOLBUiWY_xZn1SbIXLE3nxZ2j9pQ==

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.7.1/css/ 77 KB
16 KB 9ms
7ms Stylesheet
text/css 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.7.1/css/all.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: f9db1b06a7cfcabc0a842a496f6af2ab20c2e9aa6482210313b3c1588f4a066a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: gzip
last-modified: Fri, 01 Feb 2019 18:51:27 GMT
access-control-allow-origin: *
etag: "8f17a5dd66766d27715ec7925ed120fe"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-hw: 1574811762.cds120.fr8.hn,1574811762.cds069.fr8.c
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
access-control-allow-methods: GET
accept-ranges: bytes
content-length: 16247

GET
H2 200 layout.min.css
cdn2.hubspot.net/hub/-1/hub_generated/template_assets/1495141902003/hubspot_default/shared/responsive/ 5 KB
2 KB 18ms
17ms Stylesheet
text/css 2606:4700::6811:f4cc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hub/-1/hub_generated/template_assets/1495141902003/hubspot_default/shared/responsive/layout.min.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f4cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 108650
status: 200
x-amz-meta-md5-hash: 0b0c633d59ab0af9553a98c0e7d97349
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
last-modified: Thu, 18 May 2017 21:11:43 GMT
server: cloudflare
etag: W/"0b0c633d59ab0af9553a98c0e7d97349"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: s-maxage=1209600, max-age=1209600
x-amz-cf-pop: IAD79-C3
cf-ray: 53bfb86bd94d5a1e-VIE

GET
H2 200 Awwal_Blog_Post.css
blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/7739793639/1569659893720/Marketplace/awwaldesigncom/Awwal_Blog_Post/Coded_Files/ 179 KB
24 KB 172ms
170ms Stylesheet
text/css 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/7739793639/1569659893720/Marketplace/awwaldesigncom/Awwal_Blog_Post/Coded_Files/Awwal_Blog_Post.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 69b15f6f0590e69f824e7cf7011f564cd00ff6c2365237c57c917a40298069b9

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 32478DCAF95683E3
status: 200
content-type: text/css
x-amz-id-2: dU8CwM+oTQ2h4i18bUBsWGymUHdWvVbgDEEEX/Qe7IjEevHssv7vLxRuLkxHCfv6C769JOJqTlg=
last-modified: Sat, 28 Sep 2019 08:38:14 GMT
server: cloudflare
etag: W/"d7150cafcd29102c43615906dff621e9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: QIovo6SfkAdxrnFfDCWaw5jKgv_VMRFO
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bdd0fcbc8-VIE

GET
H2 200 Header-Footer.min.css
blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/8360294381/1573668607729/Marketplace/awwaldesigncom/Awwal_Blog_Listing/Coded_Files/ 22 KB
4 KB 174ms
172ms Stylesheet
text/css 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/8360294381/1573668607729/Marketplace/awwaldesigncom/Awwal_Blog_Listing/Coded_Files/Header-Footer.min.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9860bb71bf5869abc3558ff5c148a642e0e3e6b498f34bb56960931aed712e51

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: 248437A19A9F31AE
status: 200
content-type: text/css
x-amz-id-2: wgy44Ya2QGrInEvKxVCuGFxvP9N7fNxRTekYWPdYkOQNkxAHqKTyyPKUd+Hgm8jL1lcFiwjzh+w=
last-modified: Wed, 13 Nov 2019 18:10:08 GMT
server: cloudflare
etag: W/"18ba456266a3f7543b020b1861784306"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: zHp4n3wNjlMVwEZol8Tyq.knD_B619T7
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86bdd11cbc8-VIE

GET
H2 200 css
fonts.googleapis.com/ 2 KB
495 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Domine:400,700

Requested by

Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

ced3e9b2977cf51cdfad8c8b60f6f2d697ca654fac7b63bdedcd4be0a6004304

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Nov 2019 23:42:42 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 26 Nov 2019 23:42:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 28 KB
1 KB 28ms
27ms Stylesheet
text/css 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Nov 2019 23:42:42 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 26 Nov 2019 23:42:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:42 GMT

GET
H2 200 Blue-Triangle-Horizontal-Logo.png
blog.bluetriangle.com/hubfs/BlueTriangle%20February%202019/Images/ 3 KB
4 KB 37ms
36ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/BlueTriangle%20February%202019/Images/Blue-Triangle-Horizontal-Logo.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 770109b53b1128e2ab2c51cf7f8fbf6ef8e8a184dc6cb4bed373d1f4611037cf

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 2b5d1dff3c8eb4e504487382e1188d98.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-7544996767,FD-7545009084,P-5417298,FLS-ALL
age: 239
cf-polished: origFmt=png, origSize=3946
edge-cache-tag: F-7544996767,FD-7545009084,P-5417298,FLS-ALL
status: 200
content-length: 3328
content-disposition: inline; filename="Blue-Triangle-Horizontal-Logo.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: B9FE2F9A392B426F
x-amz-id-2: qA6ZX2xLOBH4ctqpNfGJvYH9dA8bpGP6lSOrlnOK/0Me2xsdTTFDgtfOzD3onY4j/T3I5mM3jZk=
x-cache: Miss from cloudfront
last-modified: Tue, 12 Feb 2019 10:23:12 GMT
server: cloudflare
etag: "5b610d726705a7ee3e25cb3ae7542908"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: PykqF8lk5_e21uFW0HKxI_u38CF.hBBT
x-amz-cf-pop: VIE50-C1
accept-ranges: bytes
cf-ray: 53bfb86bdd12cbc8-VIE
x-amz-cf-id: Vvoz3c6SzXg3DVaeHpqSB3X0NUVZ-0uU92gLbsomPQJKUEJ6r4mDeg==
cf-bgj: imgq:85

GET
H2 200 Blue-Triangle-Avatar-Logo-blue.png
blog.bluetriangle.com/hubfs/BlueTriangle%20February%202019/Images/ 4 KB
4 KB 38ms
37ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/BlueTriangle%20February%202019/Images/Blue-Triangle-Avatar-Logo-blue.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 963323f5069a74e9824fd4e610d8c9f5e57192b93c6d3ce9ed54b93d20872f03

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 a762a18013f9001899b8661c107aa762.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-7563620007,FD-7545009084,P-5417298,FLS-ALL
age: 240
cf-polished: origFmt=png, origSize=4261
edge-cache-tag: F-7563620007,FD-7545009084,P-5417298,FLS-ALL
status: 200
content-length: 3652
content-disposition: inline; filename="Blue-Triangle-Avatar-Logo-blue.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: 51195DDFC2437EF8
x-amz-id-2: QnipViHjfSm5/IXuydyr6QlLTgMU2vNQPp0AZbp1Cz6fZ/mxBnZzu1xV9irSas0H/ra3d1jA/1Q=
x-cache: Miss from cloudfront
last-modified: Wed, 13 Feb 2019 07:03:43 GMT
server: cloudflare
etag: "f2d154b92a75bab75dd4b0b7e1f3c4d3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: OQmCR4eA8eZXbqPHQ5U6GWufHb9nsm21
x-amz-cf-pop: PRG50
accept-ranges: bytes
cf-ray: 53bfb86bdd13cbc8-VIE
x-amz-cf-id: vm_kjCegi5WaV1xBBKY7ypC_kX9rwvifl3H9osiRGo1qU6IKdwIDpg==
cf-bgj: imgq:85

GET
H2 200 1a0e3486-ed3f-4fe8-96c9-c197ea352d9d.png
no-cache.hubspot.com/cta/default/5417298/ 2 KB
2 KB 139ms
137ms Image
image/png 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://no-cache.hubspot.com/cta/default/5417298/1a0e3486-ed3f-4fe8-96c9-c197ea352d9d.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd75e2024e90ad31a4b3aa1d98ff19332ba8a52034cc3f35b9c7ff81cb006023

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 03 Oct 2019 14:38:52 GMT
server: cloudflare
x-amz-request-id: 80A9F6C510750E37
etag: "aae52d099754db45bd2be8363753bced"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
cf-ray: 53bfb86c6eb88c6e-VIE
content-length: 2225
x-amz-id-2: dVPGPs4WRTss1h+2YjK3xYumsOmOaZBGSbhFUUcDFCijDAWdt4M/fZU9XYi7mbSTDSq28YDmx3A=

GET
H2 200 current.js Show response
blog.bluetriangle.com/hs/cta/cta/ 9 KB
3 KB 186ms
185ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2fb49dc337de2fd56391fdf6a21285a45d13eda67ecf3bcb4cb91b9d950481d0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 0fbab52df0695e2a561cd26eb7f9484d.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: IAD89-C1
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Tue, 22 Oct 2019 08:56:54 GMT
server: cloudflare
etag: W/"f55f9098851a8a339ff2c4549d2ed42f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: KwGhDvXDFDYF5By621_nP26stUToA4DL
cache-control: max-age=600
access-control-allow-credentials: false
cf-ray: 53bfb86c1d57cbc8-VIE
x-amz-cf-id: JsinL03y17XXfnv5551U_0xoRW9Wt2vINJQ0ZXqVgYrItC1Av0YMSg==

GET
H2 200 49b2effe-e2da-47d6-a7b3-a1ce3e300ae2.png
no-cache.hubspot.com/cta/default/5417298/ 1 KB
2 KB 149ms
147ms Image
image/png 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://no-cache.hubspot.com/cta/default/5417298/49b2effe-e2da-47d6-a7b3-a1ce3e300ae2.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

725203aac115a2a5623ad3e69272a79791474f21c5cf5f313482e81651f56d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 03 Oct 2019 14:38:23 GMT
server: cloudflare
x-amz-request-id: DF9CF9C6C0506BFB
etag: "699b991f476721b09e24a71634b9507a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
cf-ray: 53bfb86c6eb98c6e-VIE
content-length: 1410
x-amz-id-2: o4B7e+Q34A4MCfGdRpv3JvZC8QsgDJ3QB0TMsnvRecAgfyfpleW0SnkbKETf+DS/DRgLuekIAEo=

GET
H2 200 josh.jpg
blog.bluetriangle.com/hs-fs/hubfs/ 4 KB
5 KB 249ms
247ms Image
image/jpeg 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hs-fs/hubfs/josh.jpg?height=100&name=josh.jpg
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4ac59c255f27f0ad9fd791b9863315e8d60ce01f40ffd9ad3cb9c427308ba1e6

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 3ba4f1633675322ba2a091472486bb3a.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: IAD89-C2
edge-cache-tag: F-7744446803,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-length: 4442
last-modified: Mon, 25 Nov 2019 02:38:07 GMT
server: cloudflare
etag: "a88b858e85ad7e4f78a21689a5f6421a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb86c6dd2cbc8-VIE
x-amz-cf-id: CyG9Trs-G5x4AKcp_Wabg34RZFe1U7NaQ-PSsv7kkrc9GzWP2UNDWA==

GET
H2 200 total-tag-control-hacker-02.png
blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/ 43 KB
43 KB 285ms
284ms Image
image/png 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/total-tag-control-hacker-02.png?width=500&name=total-tag-control-hacker-02.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 837158f34cd5382cd99e6a3010f11bf2060ee9a4caaa887cac23bf14087f3d6f

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 237bd7e86f7f99cead16dc4ecb5fed20.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD89-C2
edge-cache-tag: F-7578608848,FD-7578550625,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-length: 43786
last-modified: Mon, 25 Nov 2019 13:26:53 GMT
server: cloudflare
etag: "13b6d16f10f7bd1261211e50a08d8e4f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb86c6dd3cbc8-VIE
x-amz-cf-id: i4dHWdcGpsIpR8kbLHsEELqX0R8Q_W_0fXIAHJggcqKzUH5xmerdZA==

GET
H2 200 newegg%20magecart%20script%20callout.png
blog.bluetriangle.com/hubfs/ 21 KB
22 KB 56ms
54ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/newegg%20magecart%20script%20callout.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5658878d487ead1eab8f2f7117554a344a0c14ed34dedf0f29785579e3df412b

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 8041ecf6e768a41bc9c64e0c75dc923d.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-8926923508,P-5417298,FLS-ALL
x-amz-cf-pop: VIE50-C1
cf-polished: origFmt=png, origSize=76839
edge-cache-tag: F-8926923508,P-5417298,FLS-ALL
status: 200
content-length: 21976
content-disposition: inline; filename="newegg%20magecart%20script%20callout.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: C57B5EB71ABAA848
x-amz-id-2: 8JGcFAT3vuQKnEyRyhQSvrcOnRAylIRyEt0Jk+7NAyuoI7Gukc7fwFftRrtbViNdUfopWVI97xQ=
x-cache: Miss from cloudfront
last-modified: Tue, 16 Apr 2019 20:45:30 GMT
server: cloudflare
etag: "ddbce427749b5d9e728a402209fffaec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: GUZiWsaSwkCTKZ21OxqkI13vLnu1HodJ
accept-ranges: bytes
cf-ray: 53bfb86c6dd4cbc8-VIE
x-amz-cf-id: _yGVdjnP777vj1MvTrUJy4wmQgqOMxUI0ZGTCTwL1NEpURKIrbq-4A==
cf-bgj: imgq:85

GET
H2 200 image-102.png
blog.bluetriangle.com/hubfs/ 52 KB
53 KB 47ms
46ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/image-102.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38df5ac8112ce99f0ad0f20d7d90d565d1e44b299d5855fb75e91e691ef2c00c

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 94888ee0a094c3d40c238475d24852ce.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-21602540414,P-5417298,FLS-ALL
x-amz-cf-pop: PMO50
cf-polished: origFmt=png, origSize=74539
edge-cache-tag: F-21602540414,P-5417298,FLS-ALL
status: 200
content-length: 53342
content-disposition: inline; filename="image-102.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: D18BF8CB1FED5BCF
x-amz-id-2: 45yLIxRqCN0xbyeQJH4k4TqVRitCMv2WFrAFf8ad9zFDMv4w0ioUqZAHtWe2in676PiNM7ErdL4=
x-cache: Miss from cloudfront
last-modified: Wed, 20 Nov 2019 16:17:18 GMT
server: cloudflare
etag: "2d360b8be90f1b7ff9e906a4589138d0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: JlUkFl20ByyuWSbQcZ54r1dRnCPw8Cum
accept-ranges: bytes
cf-ray: 53bfb86c6dd6cbc8-VIE
x-amz-cf-id: PobHJ6aXw7wBhEGe1EQljNy-lna5ob0uHEyGhKbl72Y4jN-6TxlEsw==
cf-bgj: imgq:85

GET
H2 200 image-38.png
blog.bluetriangle.com/hs-fs/hubfs/ 73 KB
74 KB 355ms
353ms Image
image/png 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hs-fs/hubfs/image-38.png?width=500&name=image-38.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32c834e0490368f8cb3a5a2b0ffabb2bf659d04ee98ed50e95b59ce4d1389529

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 547c5e28f010be7961f641c3903c0954.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: IAD89-C1
edge-cache-tag: F-8926924432,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-length: 75176
last-modified: Thu, 07 Nov 2019 14:23:11 GMT
server: cloudflare
etag: "7bc4b55fec303926d7f456e17697794a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb86c6dd7cbc8-VIE
x-amz-cf-id: VvbniVDGdBxeMX92nd2onK1dskruCbDTRBUOcyRR6fdv_usvGav4zw==

GET
H2 200 composition%20first%20party%20vs%20third%20party.png
blog.bluetriangle.com/hs-fs/hubfs/ 37 KB
38 KB 297ms
296ms Image
image/png 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hs-fs/hubfs/composition%20first%20party%20vs%20third%20party.png?width=1098&name=composition%20first%20party%20vs%20third%20party.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22e8511d926b4417a1d5e65a1b1b9d21f0e6ad3cb637cf6d91ac8492758d22f2

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 649b4de6ebe50fb3c542f3d95c8ed8bb.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: IAD89-C2
edge-cache-tag: F-8951262685,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-length: 38368
last-modified: Wed, 17 Apr 2019 18:59:45 GMT
server: cloudflare
etag: "ab2f84ee20d49d54079e277aab32dbce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb86c6dd8cbc8-VIE
x-amz-cf-id: 9cq7qQNedZBe0SkapFJYi4l_gt2auE1q217PUQUUkjfPjNI4Kad4SQ==

GET
H2 200 image-40.png
blog.bluetriangle.com/hubfs/ 146 KB
147 KB 53ms
51ms Image
image/png 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/image-40.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e5a4bac612876ebeb85ebbf30159d39e512fbd603b9c8cc8d2e415fd69ffcd91

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 7054fafdbe847ce02ea81f57ef7470c4.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-8953623848,P-5417298,FLS-ALL
x-amz-cf-pop: PMO50
cf-polished: origSize=305092, status=webp_bigger
edge-cache-tag: F-8953623848,P-5417298,FLS-ALL
status: 200
content-length: 149384
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: A4A6960663658DA6
x-amz-id-2: IO1N2blFgS1IMJ64vsOzPEek1HfNP53hCFBlSZxRtPSFpy+3N3LmAw9+dMBv20M2hU3aLIgx71g=
last-modified: Wed, 17 Apr 2019 19:27:09 GMT
server: cloudflare
etag: "782732ac9fe878ad7437f61f3369083d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: f2ZlhZHXj3SjaZrE10bNqNUSIpAzuwrS
accept-ranges: bytes
cf-ray: 53bfb86c6dd9cbc8-VIE
x-amz-cf-id: lzCcRiepQzm-4L4DPN5IvLa19tKTB1Nh4Cq9GKCh1m4H27Ybq3LdKQ==
cf-bgj: imgq:85

GET
H2 200 csp-manager-hacker.png
blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/ 27 KB
28 KB 65ms
63ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/csp-manager-hacker.png?width=600&name=csp-manager-hacker.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2e30530e228fe037f4aafc1da93b314375e57801ed90a7ea56f405940b1b418

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 c93cdf0926e57254c4cc150bcbedb97c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD79-C3
cf-polished: origFmt=png, origSize=54917
edge-cache-tag: F-7578319198,FD-7578550625,P-5417298,FLS-ALL
status: 200
content-disposition: inline; filename="csp-manager-hacker.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-length: 27782
x-cache: Miss from cloudfront
last-modified: Thu, 07 Nov 2019 14:23:25 GMT
server: cloudflare
etag: "cf570574ff5463091550594104dee4d1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb86c6ddacbc8-VIE
x-amz-cf-id: QhPBpuMQY5Ea3L-lAUfKQ47eJDuzvMmEifLTtfecAxdNj7mPrVqFBg==
cf-bgj: imgq:85

GET
H2

200

total-tag-control-image-2.png
cdn1.hubspot.net/hubfs/5417298/Imported_Blog_Media/
Redirect Chain

https://blog.bluetriangle.com/hs-fs/hubfs/Imported_Blog_Media/total-tag-control-image-2.png?width=1876&name=total-tag-control-image-2.png
https://cdn1.hubspot.com/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png
https://cdn1.hubspot.net/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png

255 KB
256 KB

313ms
311ms

Image
image/png

2606:4700::6811:f4cc
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn1.hubspot.net/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f4cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0799fd090f6b1a51535966a1df57e213e7717ff4caccdb659de314ac845e43ae

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
cf-cache-status: MISS
x-amz-meta-cache-tag: F-7578318638,FD-7578550625,P-5417298,FLS-ALL
x-amz-request-id: 895DA2939286C5BC
status: 200
content-type: image/png
content-length: 261510
x-amz-id-2: zH1+qPub7FvW6AQEll73N0oCbwA+uhpj5/yOurE1CHJq8hn26cSUGZ8BIH1//SS0ZlviQIYjaKg=
last-modified: Wed, 13 Feb 2019 19:46:15 GMT
server: cloudflare
etag: "a96844cd10e1cdfac4cd3fe2a103a3fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: s5oWgjfOCmE7xBHgcwiFX3Gy6wUBXPqo
cache-control: max-age=3600
accept-ranges: bytes
cf-ray: 53bfb86e2a045a1e-VIE

Redirect headers

date: Tue, 26 Nov 2019 23:42:42 GMT
server: cloudflare
location: https://cdn1.hubspot.net/hubfs/5417298/Imported_Blog_Media/total-tag-control-image-2.png
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
status: 301
cache-control: max-age=3600
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb86e0f3c8c6e-VIE
expires: Wed, 27 Nov 2019 00:42:42 GMT

GET
H2 200 66b04195-5274-4fb4-b37e-b7858df94db1.png
no-cache.hubspot.com/cta/default/5417298/ 5 KB
5 KB 153ms
152ms Image
image/png 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://no-cache.hubspot.com/cta/default/5417298/66b04195-5274-4fb4-b37e-b7858df94db1.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

776746fcb8c8067d9a60fdd74f723cfe17c0cea2c44b5366394422017da20a05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
cf-cache-status: DYNAMIC
last-modified: Mon, 08 Apr 2019 14:33:09 GMT
server: cloudflare
x-amz-request-id: A7F63853BB6CE498
etag: "6f81b52757e52d9758328bf923673592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: image/png
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
cf-ray: 53bfb86c6eba8c6e-VIE
content-length: 4701
x-amz-id-2: 6BayOt86Ed422mpYE3GGygzxndVIaHDuiy7wzy+1BSnIo3H+4ssWi7jiPb/g5TZB64s5j45tYc8=

GET
H2 200 BlueTriangle_February2019-main.js Show response
blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/7538098003/1569659899696/BlueTriangle_February2019_Theme/Coded_Files/ 3 KB
998 B 477ms
477ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/7538098003/1569659899696/BlueTriangle_February2019_Theme/Coded_Files/BlueTriangle_February2019-main.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76186412b0f34c4bd53596ca92ca72f4a5a34bceffd58a16ac0375c53db23305

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: B1C60C28D05FE530
status: 200
content-type: application/javascript; charset=utf-8
x-amz-id-2: vbAqWJtknupe0COw7vLabHqLuW13W89W8LluTpoVj689bijsbigyFDKlo24rOp3jkSRbO9GYUW4=
last-modified: Sat, 28 Sep 2019 08:38:20 GMT
server: cloudflare
etag: W/"f9e0d7e2cec3b39feb04b7caf95431fe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: qU38RW3iDNVS7ylMHpAeWt8LIvOUSUZx
cache-control: s-maxage=31536000, max-age=31536000
access-control-allow-credentials: false
cf-ray: 53bfb86c1d59cbc8-VIE

GET
H2 200 5417298.js Show response
blog.bluetriangle.com/hs/scriptloader/ 2 KB
719 B 516ms
515ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/scriptloader/5417298.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 32d7a2718589bfa36eb20290f96157a89e02e3892281ed6bba2781e151bdc949

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
content-encoding: br
cf-cache-status: EXPIRED
server: cloudflare
x-trace: 2BF0C53C8BCE353AE7C3B253E472493DACE3792410000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=60
access-control-allow-credentials: false
cf-ray: 53bfb86c6ddccbc8-VIE

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 72 KB
25 KB 25ms
24ms Script
application/javascript 2a00:1450:4001:821::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

389ffd7acc39e9f0ab132ce3003653a03e41216767d29aeb597d0c7b544c95a7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: br
last-modified: Tue, 26 Nov 2019 21:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 24991
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:42 GMT

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.7.1/css/ 77 KB
16 KB 11ms
8ms Stylesheet
text/css 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.7.1/css/all.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: f9db1b06a7cfcabc0a842a496f6af2ab20c2e9aa6482210313b3c1588f4a066a

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
content-encoding: gzip
last-modified: Fri, 01 Feb 2019 18:51:27 GMT
access-control-allow-origin: *
etag: "8f17a5dd66766d27715ec7925ed120fe"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-hw: 1574811762.cds081.fr8.hn,1574811762.cds069.fr8.c
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
access-control-allow-methods: GET
accept-ranges: bytes
content-length: 16247

GET
H2 200 css
fonts.googleapis.com/ 5 KB
671 B 19ms
16ms Stylesheet
text/css 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto|Open+Sans

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

f1f4e97dbc0364cd73b3b590130506d4cb722e0aba1bac74300fa962be259e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Nov 2019 23:42:42 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 26 Nov 2019 23:42:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
820 B 21ms
19ms Stylesheet
text/css 2a00:1450:4001:825::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0762605abe4faf4af6a4d446dca4c476e44b8ac409bd772fa6ebcf5fec0cb452

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Tue, 26 Nov 2019 23:42:42 GMT
server: ESF
access-control-allow-origin: *
date: Tue, 26 Nov 2019 23:42:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:42 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptug8zYS_SKggPNyC0IT4ttDfA.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Fri, 22 Nov 2019 01:57:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:48:04 GMT
server: sffe
age: 423905
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13428
x-xss-protection: 0
expires: Sat, 21 Nov 2020 01:57:37 GMT

GET
H2 200 the-anatomy-of-a-magecart-attack-featured-iamge.png
blog.bluetriangle.com/hubfs/ 349 KB
350 KB 81ms
81ms Image
image/webp 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blog.bluetriangle.com/hubfs/the-anatomy-of-a-magecart-attack-featured-iamge.png
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d46184e3ad2183e1a889fde5e307a049ac9fb792675b967da8ae97e5e3667ad8

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 57944b2bc96392bde7c75f5478bde08a.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-8973445120,P-5417298,FLS-ALL
x-amz-cf-pop: PMO50
cf-polished: origFmt=png, origSize=530461
edge-cache-tag: F-8973445120,P-5417298,FLS-ALL
status: 200
content-length: 357306
content-disposition: inline; filename="the-anatomy-of-a-magecart-attack-featured-iamge.webp"
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
x-amz-request-id: 68DB9A18318BF127
x-amz-id-2: UM5Hv1/c9eKqBHVwyK+d49exM7OCAIXvavuRFaaSOq8QceQNnOUPJFs+P87lwCLycViyKLtHRUQ=
x-cache: Miss from cloudfront
last-modified: Thu, 18 Apr 2019 14:56:16 GMT
server: cloudflare
etag: "73ad7f0ef8d97e5ba717bdcc33c8a08a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
cache-control: s-maxage=1209600, max-age=1209600
x-amz-version-id: mGN2E5yUBUryvrf5K2TeoyVO3bxMgHJH
accept-ranges: bytes
cf-ray: 53bfb86dbfeacbc8-VIE
x-amz-cf-id: YxGen5aVvZUhXvjJ0lJhrhGq514F9xR6_sbL9Qo5lxAJcW4gX6Ez5Q==
cf-bgj: imgq:85

GET
H2 200 1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwJYtWqZPANqczVs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Wed, 20 Nov 2019 15:05:01 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:42 GMT
server: sffe
age: 549461
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13228
x-xss-protection: 0
expires: Thu, 19 Nov 2020 15:05:01 GMT

GET
H2 200 fa-solid-900.woff2
pro.fontawesome.com/releases/v5.7.1/webfonts/ 115 KB
115 KB 8ms
8ms Font
font/woff2 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.7.1/webfonts/fa-solid-900.woff2
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: d64849d9ec4afd8eb21b289c99a9d785eb7079d893b899490132fb4707447457

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://pro.fontawesome.com/releases/v5.7.1/css/all.css
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
last-modified: Fri, 01 Feb 2019 18:53:08 GMT
access-control-allow-origin: *
etag: "a51a1bf638ff277b944293253fe21980"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
accept-ranges: bytes
content-length: 117516
x-hw: 1574811762.cds120.fr8.hn,1574811762.cds096.fr8.c

GET
H2 200 1Ptrg8zYS_SKggPNwPIsWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
13 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwPIsWqZPANqczVs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f5b9c05ae7b05e6ef6129a065795922649a71851bd9f57d080dc86e3efa34a51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Thu, 21 Nov 2019 16:53:39 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:51 GMT
server: sffe
age: 456543
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13404
x-xss-protection: 0
expires: Fri, 20 Nov 2020 16:53:39 GMT

GET
H2 200 1Ptsg8zYS_SKggPNyCg4TYFqL_KWxQ.woff2
fonts.gstatic.com/s/raleway/v14/ 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptsg8zYS_SKggPNyCg4TYFqL_KWxQ.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

2e0fd9812ea2aad0ed2fa667b8f591d2008e1a4a238b365c7b07c9365f487c16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Wed, 20 Nov 2019 14:56:22 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:47 GMT
server: sffe
age: 549980
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14224
x-xss-protection: 0
expires: Thu, 19 Nov 2020 14:56:22 GMT

GET
H2 200 1Ptrg8zYS_SKggPNwN4rWqZPANqczVs.woff2
fonts.gstatic.com/s/raleway/v14/ 13 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptrg8zYS_SKggPNwN4rWqZPANqczVs.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

046fa5c62e3b17b46ea2f8c601465dacfd5c153aee7a71754a9be582de74a385

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Thu, 21 Nov 2019 17:51:14 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:47 GMT
server: sffe
age: 453088
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 13752
x-xss-protection: 0
expires: Fri, 20 Nov 2020 17:51:14 GMT

GET
H2 200 fontello.woff2
cdn2.hubspot.net/hubfs/5417298/awwal/Icon%20Fonts/ 2 KB
3 KB 35ms
35ms Font
application/font-woff2 2606:4700::6811:f2cc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hubfs/5417298/awwal/Icon%20Fonts/fontello.woff2?4802173
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f2cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3f526d1f9606629c8b92ee6e5912010c2c10563ae39241c7c5f08a5c88ca570

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/8360294381/1573668607729/Marketplace/awwaldesigncom/Awwal_Blog_Listing/Coded_Files/Header-Footer.min.css
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:42 GMT
via: 1.1 62be036fdc9304bd5fed415621b49023.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-11655797353,FD-11655733484,P-5417298,FLS-ALL
x-amz-request-id: CE84C0C0E0D6F683
edge-cache-tag: F-11655797353,FD-11655733484,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-type: application/font-woff2
content-length: 2328
x-amz-id-2: hU4y2Hqk9WkBKqaUJshYtQNZ56HVZWhnSds0nA3wgsSOdCYF+RwnW41CB0q5qEx+keRRWCgWrJQ=
last-modified: Mon, 29 Jul 2019 05:34:08 GMT
server: cloudflare
etag: "d18fa2a470950489eacaa47efcd36656"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: OJwEpxprcf9lZqK0xIi_ZUo6jDRh1DqM
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-cf-pop: PMO50
accept-ranges: bytes
cf-ray: 53bfb86dea02598e-VIE
x-amz-cf-id: LbwCjvO7dOiIv0P8plR5nNkexGEiZQZoSeoZGlPWjz7FjjOqkHr8Pw==

GET
H2 200 1Ptpg8zYS_SKggPNyCgw9qR_AtCb71ka4Q.woff2
fonts.gstatic.com/s/raleway/v14/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:809::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v14/1Ptpg8zYS_SKggPNyCgw9qR_AtCb71ka4Q.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

788300b4cf29c0cbbf8a130a30885dc9c2d6bd36f47864f0774f6231c8cf1586

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Raleway:100,100i,200,200i,300,300i,400,400i,500,500i,600,600i,700,700i,800,800i&display=swap
Origin: https://blog.bluetriangle.com

Response headers

date: Thu, 21 Nov 2019 07:05:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:47:52 GMT
server: sffe
age: 491825
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 14180
x-xss-protection: 0
expires: Fri, 20 Nov 2020 07:05:37 GMT

GET
H2 200 84471c34-147f-46a4-a010-1f802480972e Show response
blog.bluetriangle.com/_hcms/forms/embed/v3/form/5417298/ 8 KB
2 KB 179ms
178ms Script
application/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.bluetriangle.com/_hcms/forms/embed/v3/form/5417298/84471c34-147f-46a4-a010-1f802480972e?callback=hs_reqwest_0&hutk=

Requested by

Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/_hcms/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

14b0e8205075770c1ef7258e123e7e225cb3170da3655a963f2e8d8b8e8a1186

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2B9D8BC056CC6EDD471264589202E9A0021B527F4E000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
content-disposition: attachment; filename=no-rfd.txt
cf-ray: 53bfb86f3a50cbc8-VIE

GET
H2 200 all.css
pro.fontawesome.com/releases/v5.7.1/css/ 77 KB
16 KB 8ms
8ms Stylesheet
text/css 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://pro.fontawesome.com/releases/v5.7.1/css/all.css
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: /
Resource Hash: f9db1b06a7cfcabc0a842a496f6af2ab20c2e9aa6482210313b3c1588f4a066a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
content-encoding: gzip
last-modified: Fri, 01 Feb 2019 18:51:27 GMT
access-control-allow-origin: *
etag: "8f17a5dd66766d27715ec7925ed120fe"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-hw: 1574811763.cds120.fr8.hn,1574811763.cds069.fr8.c
content-type: text/css
status: 200
access-control-max-age: 3000
cache-control: max-age=31556926
access-control-allow-methods: GET
accept-ranges: bytes
content-length: 16247

GET
H2 200 hero_default_thin.woff
cdn2.hubspot.net/hubfs/5417298/BlueTriangle%20February%202019/Fonts/ 26 KB
14 KB 52ms
52ms Font
application/font-woff 2606:4700::6811:f2cc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn2.hubspot.net/hubfs/5417298/BlueTriangle%20February%202019/Fonts/hero_default_thin.woff
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f2cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: cede182386b932d42fb668cdf59a6b6e879134fcb446fe85817119ab9db94d0f

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/hs-fs/hub/5417298/hub_generated/template_assets/8360294381/1573668607729/Marketplace/awwaldesigncom/Awwal_Blog_Listing/Coded_Files/Header-Footer.min.css
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
via: 1.1 10e960f45c7f9728b0f5fe063daacc69.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-7562752227,FD-7563102632,P-5417298,FLS-ALL
x-amz-request-id: E97EDF090E287D2F
edge-cache-tag: F-7562752227,FD-7563102632,P-5417298,FLS-ALL
status: 200
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.setCacheTagHeaders 43
content-encoding: gzip
content-type: application/font-woff
x-amz-id-2: fKCj91G9m85Su5KRo9h5HICcQaQXC3aEWf5olfTTRt67+bTC752OPz7usUDagdBsVYLfx6aE2Vo=
last-modified: Wed, 13 Feb 2019 04:16:55 GMT
server: cloudflare
etag: W/"eff6d27a26080dc343d5471b467b6155"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
x-amz-version-id: YdCKRfGRJTJBAYmIS_3Txu1dU2vfqqH0
access-control-allow-origin: *
cache-control: s-maxage=1209600, max-age=1209600
x-amz-cf-pop: PMO50
cf-ray: 53bfb86f6aed598e-VIE
x-amz-cf-id: 8C5b13S620GNOQsmSfNo91s7uvcfzQGwNhSyEKZPEVY6jwBCMFoWoA==

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ 57 KB
14 KB 19ms
18ms Script
application/javascript 2606:4700::6811:edcc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.usemessages.com/conversations-embed.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/scriptloader/5417298.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:edcc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4e05a9ad259d6ffedac19829e0c769e8dc334dc948faba4562cf76c2ea7f9aa9

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
via: 1.1 23d2c4964d6868e014bfe491b62d3f2f.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 45
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: br
x-amz-version-id: AIBRg1PobnQbrvvvgPhP2cn5LR7LoEtY
last-modified: Mon, 25 Nov 2019 07:08:17 GMT
server: cloudflare
etag: W/"91c4d81ca78f09412d987bcb0e9aa946"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=600
x-amz-cf-pop: IAD79-C2
cf-ray: 53bfb86fa92acbb4-VIE
x-amz-cf-id: zRxupXLfK_neVKLZj6Kg8q4YLPLCBp4boJGIZm2DcCZ6lPoTGi2nrw==

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 4 KB
2 KB 18ms
17ms Script
application/javascript 2606:4700::6811:74b0
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsadspixel.net/fb.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/scriptloader/5417298.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:74b0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6d9d9e6046d227df0c818d934dadd9fadf08687308138b91376258494826f9b

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
via: 1.1 09e7a54b3c0e42cf23f1deb97f4f6b95.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 413
x-cache: Hit from cloudfront
status: 200
x-amz-replication-status: COMPLETED
content-encoding: gzip
x-amz-version-id: j6PreIy4qN8jPYd1cm1sPhZdAFQ60qMd
last-modified: Thu, 24 Oct 2019 01:14:11 GMT
server: cloudflare
etag: W/"c3fbcea4ff6fedca3f7d2d25bcf17318"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=600
x-amz-cf-pop: IAD89-C2
cf-ray: 53bfb86fadac5940-VIE
x-amz-cf-id: 6OQrZIX1yK2tncyT6R90k9DJyDBAN_kHg3Qf3ca0lYZxKvx3b-62mg==

GET
H2 200 5417298.js Show response
js.hs-analytics.net/analytics/1574811600000/ 73 KB
25 KB 1146ms
1145ms Script
text/javascript 2606:4700::6811:46b0
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1574811600000/5417298.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/scriptloader/5417298.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:46b0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fd1c1ee483d732f38b984e2ba61b2fa118fe93d557e68d86f88d05a88cd0a5c

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
cf-cache-status: MISS
x-amz-request-id: 76A4DF884A3B7A11
status: 200
content-type: text/javascript
x-amz-id-2: Ckd7yH9l6Xqu0gYofwuoT1VPDtD+4B/QnxL7sPueW8bB/w11FqHxYNYuWvUhf5SDaZrsHOljKR0=
last-modified: Tue, 29 Oct 2019 21:20:25 GMT
server: cloudflare
etag: W/"9c291958e5633faab6977d7a44387514"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: null
cache-control: max-age=300, public
access-control-allow-credentials: false
cf-ray: 53bfb86fadab5940-VIE
expires: Tue, 26 Nov 2019 23:47:44 GMT

GET
H2 200 leadflows.js Show response
js.hsleadflows.net/ 377 KB
61 KB 453ms
453ms Script
application/javascript 2606:4700::6811:e9cc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hsleadflows.net/leadflows.js
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/scriptloader/5417298.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6811:e9cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a55c02888038e59252778d81b592f942ea904c3dca19f539e3376b4a0a0c6b2

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
via: 1.1 68f4ce62965bee950d499088765039e4.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-cf-pop: IAD79-C1
x-cache: Miss from cloudfront
status: 200
access-control-max-age: 3000
x-amz-replication-status: COMPLETED
content-encoding: br
content-type: application/javascript; charset=utf-8
last-modified: Fri, 01 Nov 2019 01:52:48 GMT
server: cloudflare
etag: W/"54006d8d669ba60aff038448ad347c84"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: Mo8RDmG1YId30ggWGmkBlVvLfaalQv4Q
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 53bfb86fad3e8c7a-VIE
x-amz-cf-id: 7b6mMeVVHXJVfbg7y3fr-ZxyvJN71vZnVlXxYwEJ_mtq2xYWkf7log==

OPTIONS
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ 23 B
272 B 425ms
425ms XHR
text/plain 2606:4700::6810:f905
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubspot.com/livechat-public/v1/message/public?portalId=5417298&conversations-embed=static-1.5210&mobile=false&messagesUtk=4b8d5a922321446bbe6ae7029f788d0d&traceId=4b8d5a922321446bbe6ae7029f788d0d

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3e5f27d5e5d92a7499b2c01025e9d8f6c78effa35afbe71156159a221be6cece

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Access-Control-Request-Method: GET
Origin: https://blog.bluetriangle.com
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: x-hubspot-messages-uri

Response headers

date: Tue, 26 Nov 2019 23:42:43 GMT
vary: Accept-Encoding
cf-cache-status: DYNAMIC
status: 200
content-length: 23
allow: HEAD,GET,OPTIONS,PUT
server: cloudflare
x-trace: 2BFF0DB13A4B8C4DD28DEC5575B5BF0FC2A1EF4918000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://blog.bluetriangle.com
access-control-allow-credentials: false
cf-ray: 53bfb86feba35964-VIE
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ 427 B
476 B 425ms
423ms XHR
application/json 2606:4700::6810:f905
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

3df2fd21e6d876fa4046f81457edfaa69c8c19cb6035b6c704c0ec503a967ff2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com
X-HubSpot-Messages-Uri: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: DYNAMIC
status: 200
content-length: 341
server: cloudflare
x-trace: 2B848FC1D0A4F772F75282970849EA491E7DE4224A000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.bluetriangle.com
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
cf-ray: 53bfb872bc8d5964-VIE
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 loader-v2.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 7 KB
3 KB 187ms
187ms Script
text/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/loader-v2.js?cos=1&__hsfp=2430194794&__hssc=83254537.1.1574811764299&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&hsutk=22add7a8df0e07765801c6eb7d193ebb&pageId=8880541776&contentType=blog-post&pg=1a0e3486-ed3f-4fe8-96c9-c197ea352d9d&pid=5417298&sv=static-1.207&lag=1498&rdy=1&cos=1&df=a
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f97ba673682b5ad3cc72c412f2db3fd0f37940aba44d19347322a19de4ac4fd

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2BF5369F1ECA5A8072FCB9DB02BF3E705689E4FACA000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb876ece7cbc8-VIE
content-length: 2502
x-robots-tag: noindex, follow

GET
H2 200 loader-v2.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 7 KB
3 KB 193ms
192ms Script
text/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/loader-v2.js?cos=1&__hsfp=2430194794&__hssc=83254537.1.1574811764299&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&hsutk=22add7a8df0e07765801c6eb7d193ebb&pageId=8880541776&contentType=blog-post&pg=49b2effe-e2da-47d6-a7b3-a1ce3e300ae2&pid=5417298&sv=static-1.207&lag=1497&rdy=1&cos=1&df=a
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: da267e7fd628d92d78d976eb4a1c71a63a077c6a3b893ed19d628fe3e8ec0c09

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2BF31B4C13A509A2FDDF57077FFF294CFAED0C1E06000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb876fcebcbc8-VIE
content-length: 2525
x-robots-tag: noindex, follow

GET
H2 200 loader-v2.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 8 KB
3 KB 189ms
189ms Script
text/javascript 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/loader-v2.js?cos=1&__hsfp=2430194794&__hssc=83254537.1.1574811764299&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&canon=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&hsutk=22add7a8df0e07765801c6eb7d193ebb&pageId=8880541776&contentType=blog-post&pg=66b04195-5274-4fb4-b37e-b7858df94db1&pid=5417298&sv=static-1.207&lag=1456&rdy=1&cos=1&df=a
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2629973d84bc996f5c05a9ff6d4f4128da3ba443c218c7596cc07ecd587bc6dd

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2BFBAE50406133C08AC2C23B844F590DD7C9F3984D000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 53bfb876fceccbc8-VIE
content-length: 2498
x-robots-tag: noindex, follow

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/ 57 B
307 B 125ms
125ms XHR
application/json 2606:4700::6811:c9cc
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/json?portalId=5417298

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:c9cc , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

186343eda356f800dea4ef94793cdd28dcd7ac555765ba7b578527508ab64286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
x-trace: 2B71EE9E212011A0E7A0B1A5AFE7A1B1E3EE8D9C6A000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.bluetriangle.com
access-control-allow-credentials: false
cf-ray: 53bfb876fb445982-VIE
access-control-allow-headers: *

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
344 B 41ms
40ms Image
image/gif 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=84471c34-147f-46a4-a010-1f802480972e&fci=9f923368-0c7b-468b-b0c3-5599002c31b7&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=5417298&pi=8880541776&ct=blog-post&ccu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&cpi=8880541776&cgi=7354672154&lpi=8880541776&lvi=8880541776&lvc=en&pu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&t=The+Anatomy+of+a+Magecart+Attack+and+How+to+Protect+Your+Site+in+2019&cts=1574811764308&vi=22add7a8df0e07765801c6eb7d193ebb&nc=true&u=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&b=83254537.1.1574811764299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb87709f78c6e-VIE
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
104 B 43ms
43ms Image
image/gif 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=5417298&pi=8880541776&ct=blog-post&ccu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&cpi=8880541776&cgi=7354672154&lpi=8880541776&lvi=8880541776&lvc=en&pu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&t=The+Anatomy+of+a+Magecart+Attack+and+How+to+Protect+Your+Site+in+2019&cts=1574811764310&vi=22add7a8df0e07765801c6eb7d193ebb&nc=true&u=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&b=83254537.1.1574811764299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb87709f98c6e-VIE
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:81b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 4147
date: Tue, 26 Nov 2019 22:33:37 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Wed, 27 Nov 2019 00:33:37 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 25 KB
9 KB 17ms
17ms Script
text/javascript 172.217.23.98
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

69e3a796f4b120879065a812b95b56fd4d28f88faf8c1976ad9b0fa2f31dc0eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9614
x-xss-protection: 0
server: cafe
etag: 5296095546589048175
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 26 Nov 2019 23:42:44 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 35 KB
12 KB 7ms
7ms Script
text/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 1894bf26f25a0760600ab765f9b228ada17262e32d1ac3a18ce48e144dfe80f4

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: J7Jf6IQGpyCDjOAhyhZOhCzfX_7vZ6SY
Content-Encoding: gzip
x-amz-request-id: C48AC68AF6BED573
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Tue, 26 Nov 2019 23:42:44 GMT
Connection: keep-alive
Content-Length: 11216
x-amz-id-2: F2/8qzqJOUTOZ0TPKOk8NXhdvioEsZ8dzuBEZBMGgLPqwKrFKAkP4ElohVHzkjVMMTEt5hMSIq0=
Last-Modified: Tue, 26 Nov 2019 20:44:45 GMT
Server: AmazonS3
ETag: "4946ab35e9ef900136f721ffc5d975cf"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H/1.1 200
OK 69871.js Show response
secure.leadforensics.com/js/ 3 KB
2 KB 23ms
22ms Script
text/javascript 51.140.49.131
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.leadforensics.com/js/69871.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.49.131 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: Kestrel /
Resource Hash: 124cb811ab8e9a60b1e46a89741faebf40126102251abf8df17bcfab09b3498a

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 26 Nov 2019 23:42:43 GMT
Content-Encoding: gzip
Server: Kestrel
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: no-store, must-revalidate
Transfer-Encoding: chunked
Expires: 0

GET
H2 200 btt.js Show response
bluetriangle213691z.btttag.com/ 72 KB
18 KB 31ms
31ms Script
application/javascript 2606:4700:10::6814:4461
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://bluetriangle213691z.btttag.com/btt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T6RRHK
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:4461 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d0f73e51310837b633c23876d6659493cd0f3454f740f2106ae9ac381ba97287

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

cf-ray: 53bfb8771e9b8cc2-VIE
date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 26 Nov 2019 21:07:13 GMT
server: cloudflare
age: 9331
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=43200
accept-ranges: bytes
timing-allow-origin: *
content-length: 17783

GET
H2 200 w.js Show response
d10lpsik1i8c69.cloudfront.net/ 5 KB
3 KB 7ms
6ms Script
application/javascript 13.224.197.175
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d10lpsik1i8c69.cloudfront.net/w.js
Requested by: Host: he.t.hubspotemail.net
URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.197.175 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-224-197-175.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08dc0d88069665fb124f7354f3aa62710dac90c69c0f7915896b64d61ad4014b

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 22:43:49 GMT
content-encoding: gzip
last-modified: Mon, 07 Oct 2019 14:01:57 GMT
server: AmazonS3
age: 3538
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: B9ReooP3OvuCKYwwajzslK_bEGqEOl3UoH-IneIulz14Hm9gj8bRHA==
via: 1.1 c379418fd6100691807f32f274ebe9ce.cloudfront.net (CloudFront)

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 6ms
6ms Script
application/x-javascript 2a02:26f0:6c00:296::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: he.t.hubspotemail.net
URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:296::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 26 Nov 2019 23:42:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=50738
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 d93sirwhny9r.js Show response
js.driftt.com/include/1574811900000/ 135 KB
45 KB 132ms
132ms Script
application/javascript 13.225.78.44
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1574811900000/d93sirwhny9r.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.225.78.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-13-225-78-44.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

cea35bd5b16edacf49a4735cdcab5146cd97b87f94faebb353ff6c5ad7e33cac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-amz-cf-pop: FRA2-C2
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
status: 200
via: 1.1 2fcedcc055e24d7ac99fbc19ed8fc8ec.cloudfront.net (CloudFront)
last-modified: Tue, 26 Nov 2019 21:47:51 GMT
server: nginx
date: Tue, 26 Nov 2019 23:42:44 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: id7nL-z5IeXrB5B3JhgbBg0Hq_TQXD8fp23EZGWSj6pePQ9G0CgX-A==

GET
H2 200 stat.js Show response
www.clickcease.com/monitor/ 989 B
525 B 26ms
26ms Script
application/javascript 2606:4700:20::6819:5b6e
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clickcease.com/monitor/stat.js
Requested by: Host: he.t.hubspotemail.net
URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:5b6e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf43cb8fbceabffcfa45c1118c210159362b2b8ed865038b0eeeac749e90c312

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
cf-cache-status: HIT
age: 123872
status: 200
access-control-max-age: 1728000
last-modified: Mon, 11 Nov 2019 13:17:55 GMT
server: cloudflare
etag: W/"3dd-59711f5a82878"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,DELETE,PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: true
cf-ray: 53bfb8772ae35a00-VIE
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,C$
expires: Mon, 02 Dec 2019 13:18:07 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 47ms
46ms Script
application/javascript 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: he.t.hubspotemail.net
URL: https://he.t.hubspotemail.net/e2t/c/*W1Y5hKJ52H3dTW7Rq10x99Rs7p0/*W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
last-modified: Tue, 10 Sep 2019 18:57:28 GMT
x-msedge-ref: Ref A: 4FAAAFEE9C1642459BBF391193CA8E5A Ref B: VIEEDGE0418 Ref C: 2019-11-26T23:42:44Z
access-control-allow-origin: *
etag: "09c5197968d51:0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7148

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/7S4DVTUJ2JESLNZBKXA4WS/index.js
https://s.adroll.com/j/exp/index.js

28 B
680 B

5ms
5ms

Script
application/javascript

2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: YZz6r09yJkoAzJNgNDAYF5y8lZtPwWkk
x-amz-request-id: 7AEC01CABEDB8FF1
x-amz-server-side-encryption: AES256
Date: Tue, 26 Nov 2019 23:42:44 GMT
Connection: keep-alive
Content-Length: 28
x-amz-id-2: v9KOq/2M2/E6gL/doDKMlXYD9prvn9HVer5AWou/xuIjq3+/MfKDO2Ywd8+EgUM+9mGGEMqAi5M=
Last-Modified: Tue, 19 Nov 2019 18:47:22 GMT
Server: AmazonS3
ETag: "5816cced8568d223aa09d889f300692b"
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Tue, 26 Nov 2019 23:42:44 GMT
Server: AkamaiGHost
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H2

200

/ Show response
d.adroll.com/consent/check/7S4DVTUJ2JESLNZBKXA4WS/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/7S4DVTUJ2JESLNZBKXA4WS?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2
https://d.adroll.com/consent/check/7S4DVTUJ2JESLNZBKXA4WS/?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2

88 B
179 B

31ms
30ms

Script
application/javascript

54.154.177.155
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/7S4DVTUJ2JESLNZBKXA4WS/?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.177.155 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-177-155.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 219ab0ad68af94a75770c2d8404433b3ca47fd6bf900464b058f50c21ed87854

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 26 Nov 2019 23:42:44 GMT
server: nginx/1.16.1
content-length: 88
content-type: application/javascript

Redirect headers

status: 302
date: Tue, 26 Nov 2019 23:42:44 GMT
server: nginx/1.16.1
content-length: 105
location: https://d.adroll.com/consent/check/7S4DVTUJ2JESLNZBKXA4WS/?_s=13401dd05d3e4dcb83b2ef989269e829&_b=2

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=1199421168&t=pageview&_s=1&dl=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuO...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_gid=136954272.1574811764&gjid=2046580942&_v=j79&z=26339601
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601&slf_rd=1&random=2373079466

42 B
109 B

19ms
19ms

Image
image/gif

2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601&slf_rd=1&random=2373079466

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-63189851-1&cid=926559145.1574811764&jid=1506164272&_v=j79&z=26339601&slf_rd=1&random=2373079466
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D419778%26url%3Dhttps%253A%252F%252Fblog.bluetriangle.com%252Fmagecart-attack-how-...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX...

0
88 B

100ms
100ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LinkedIn Corporation

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&time=1574811764359&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
server: Play
vary: Accept-Encoding
x-li-fabric: prod-lva1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 20
x-li-uuid: zD+Qx/Ta2hUADJDR5CoAAA==

Redirect headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 302
x-li-pop: prod-tln1
content-length: 20
x-li-uuid: qN6IwfTa2hXg717BJisAAA==
pragma: no-cache
server: Play
x-frame-options: sameorigin
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
vary: Accept-Encoding
strict-transport-security: max-age=2592000
x-li-fabric: prod-lva1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=419778&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&time=1574811764359&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob:; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/799952972/ 2 KB
1 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:800::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/799952972/?random=1574811764363&cv=9&fst=1574811764363&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

a057803c4d59d0857335d68bacbc3042a6454820e7e0897db48c11a1bf40e826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Capture.aspx Show response
secure.leadforensics.com/Track/ 0
92 B 27ms
27ms Script
text/plain 51.140.49.131
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.leadforensics.com/Track/Capture.aspx?retType=js&trk_uid=&trk_user=69871&trk_sw=1600&trk_sh=1200&trk_ref=&trk_tit=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&trk_loc=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&trk_agn=Netscape&trk_agv=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36.lfcd24.lflngen-US&trk_dom=blog.bluetriangle.com&trk_cookie=f17eea99-7872-4bc9-8e44-9256d90279b0-c69871-sw1600-sh1200-ms1574811764366-r3093830
Requested by: Host: secure.leadforensics.com
URL: https://secure.leadforensics.com/js/69871.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 51.140.49.131 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 26 Nov 2019 23:42:43 GMT
Content-Length: 0
Server: Kestrel

GET
H2 200 json Show response
forms.hubspot.com/lead-flows-config/v1/config/ 167 B
290 B 455ms
454ms XHR
application/json 2606:4700::6810:f905
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=5417298&utk=22add7a8df0e07765801c6eb7d193ebb&__hstc=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&__hssc=83254537.1.1574811764299&contentId=8880541776&currentUrl=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511

Requested by

Host: js.hsleadflows.net
URL: https://js.hsleadflows.net/leadflows.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:f905 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

db0f2f9be48c4c934fae174db1e7a7315b5690e1dbb9a65d0d6d08d5c22099e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-ray: 53bfb8775e1a5964-VIE
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 180
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://blog.bluetriangle.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent

GET
H2 200 fingerprint2.min.js Show response
cdnjs.cloudflare.com/ajax/libs/fingerprintjs2/2.0.0/ 29 KB
10 KB 18ms
18ms Script
application/javascript 2606:4700::6811:4004
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/fingerprintjs2/2.0.0/fingerprint2.min.js

Requested by

Host: www.clickcease.com
URL: https://www.clickcease.com/monitor/stat.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2878e261f4608effb59d39ee9e01dd3ea7c16c7ff60b470ee8032009c8994099

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
cf-cache-status: HIT
age: 2602001
cf-ray: 53bfb877790bcbb8-VIE
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
alt-svc: h3-23=":443"; ma=86400
last-modified: Tue, 09 Oct 2018 20:45:54 GMT
server: cloudflare
etag: W/"5bbd1382-7255"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Tue, 13 Oct 2020 18:34:05 GMT
cache-control: max-age=30672000
timing-allow-origin: *
served-in-seconds: 0.001

GET
H2 200 /
www.google.com/pagead/1p-user-list/799952972/ 42 B
110 B 19ms
19ms Image
image/gif 2a00:1450:4001:818::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/799952972/?random=1574811764363&cv=9&fst=1574809200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&async=1&fmt=3&is_vtc=1&random=2499248618&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/799952972/ 42 B
110 B 21ms
21ms Image
image/gif 2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/799952972/?random=1574811764363&cv=9&fst=1574809200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgav9&sendb=1&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&async=1&fmt=3&is_vtc=1&random=2499248618&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
94 B 47ms
46ms Image
text/plain 2620:1ec:c11::200
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=5089847&Ver=2&mid=6c2c77ad-e216-2cd7-192b-9304edddd520&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&p=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&r=&lt=2334&evt=pageLoad&msclkid=N&rn=493153
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: 620FCB76BFE148CB8B7116D63B55CAB4 Ref B: VIEEDGE0418 Ref C: 2019-11-26T23:42:44Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cc-snapshot.js Show response
www.clickcease.com/monitor/ 17 KB
6 KB 19ms
19ms Script
application/javascript 2606:4700:20::6819:5b6e
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clickcease.com/monitor/cc-snapshot.js
Requested by: Host: www.clickcease.com
URL: https://www.clickcease.com/monitor/stat.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:5b6e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1fa8d14f642792816ff50b0fa340d9a606112e414bcf670e4690b1fd5fa6f670

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
cf-cache-status: HIT
age: 123108
status: 200
access-control-max-age: 1728000
last-modified: Mon, 11 Nov 2019 13:30:10 GMT
server: cloudflare
etag: W/"4444-597122174ca17"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,DELETE,PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: true
cf-ray: 53bfb877bb015a00-VIE
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,C$
expires: Mon, 02 Dec 2019 13:30:54 GMT

GET
H/1.1 200
OK consent.js Show response
s.adroll.com/j/ 243 KB
33 KB 11ms
10ms Script
application/javascript 2.18.233.40
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/consent.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f82c9f099656346f543c66ba009bd5f18010c7b41ad43d47a7f762121ad4496d

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: W7pJTDq0578OcjyRZxtRH_BjDuWCGgRc
Content-Encoding: gzip
x-amz-request-id: BFDDD219E02D63AA
x-amz-server-side-encryption: AES256
Access-Control-Max-Age: 600
Date: Tue, 26 Nov 2019 23:42:44 GMT
Connection: keep-alive
Content-Length: 33195
x-amz-id-2: 0vEYWSNr8BIWIFx+Vt855bKM9PGQi1O3TTl+RSbaQgK2eZJeo3lhhvwHGpfanAseKG0Oz2obOWc=
Last-Modified: Tue, 19 Nov 2019 20:42:26 GMT
Server: AmazonS3
ETag: "2f9f76c2d377be42af05cdf34c632618"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=300, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:821::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-799952972

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d226759a3f1ffded6e6aa782860c25f43a8adc03d835dec3a6823d502eb0a340

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
last-modified: Tue, 26 Nov 2019 21:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27665
x-xss-protection: 0
expires: Tue, 26 Nov 2019 23:42:44 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 121 KB
26 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

71b52274b1b43661e6523b2774c9fa98a673e1861703bea5f32d75a32a850394

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
content-length: 26702
x-xss-protection: 0
pragma: public
x-fb-debug: 5sDsbB+5JmkZW/Ai7DF7YOjE72pPWvmFVvG9etzEsOZn9ETAjtpCfeuZbLE4+7ZZJzr0M4CWNlIuPSzTDTyigA==
x-fb-trip-id: 420120009
date: Tue, 26 Nov 2019 23:42:44 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 hod
d.adroll.com/consent/ 42 B
180 B 30ms
30ms Image
image/gif 54.154.177.155
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/consent/hod?_e=view_banner&_s=13401dd05d3e4dcb83b2ef989269e829&_b=2.1&_a=7S4DVTUJ2JESLNZBKXA4WS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.177.155 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-154-177-155.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 26 Nov 2019 23:42:44 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.16.1
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2 200 cc-recorder.js Show response
www.clickcease.com/monitor/ 8 KB
2 KB 16ms
16ms Script
application/javascript 2606:4700:20::6819:5b6e
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clickcease.com/monitor/cc-recorder.js
Requested by: Host: www.clickcease.com
URL: https://www.clickcease.com/monitor/stat.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::6819:5b6e , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dde196e7d7168fa7fd462d80a28377c38441df81e0857f202de239238ea3aec3

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: br
cf-cache-status: HIT
age: 48345
status: 200
access-control-max-age: 1728000
last-modified: Tue, 12 Nov 2019 10:16:30 GMT
server: cloudflare
etag: W/"1ea5-597238abd7178"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET,POST,OPTIONS,DELETE,PUT
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
access-control-allow-credentials: true
cf-ray: 53bfb877fb1a5a00-VIE
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,C$
expires: Tue, 03 Dec 2019 10:16:51 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 25 KB
9 KB 15ms
14ms Script
text/javascript 172.217.23.98
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-799952972

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

69e3a796f4b120879065a812b95b56fd4d28f88faf8c1976ad9b0fa2f31dc0eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9614
x-xss-protection: 0
server: cafe
etag: 5296095546589048175
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 26 Nov 2019 23:42:44 GMT

GET
H2 200 1233830516773023 Show response
connect.facebook.net/signals/config/ 349 KB
85 KB 7ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
Facebook

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1233830516773023?v=2.9.14&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

Resource Hash

c850ac754fd1340bdb72b13494ae3e0353e035a8e48ffcefedf2c59f2e7531da

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-23=":443"; ma=3600
content-length: 86935
x-xss-protection: 0
pragma: public
x-fb-debug: W0MjGeoV1zBBxKjMaHFAUnVNpBCwnl8QwZNYE6tSChSU19l0QDPkStp1xpzHEgDlmb29K/aNjZcBIn1RefUVzA==
x-fb-trip-id: 420120009
date: Tue, 26 Nov 2019 23:42:44 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame CABA 0
0 11ms
10ms Document
text/html 13.225.78.44
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1574811900000/d93sirwhny9r.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.225.78.44 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-13-225-78-44.fra2.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Tue, 26 Nov 2019 21:47:51 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 26 Nov 2019 23:42:44 GMT
etag: "5ea16178ffca480f3ed98938ff2d9559"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 2fcedcc055e24d7ac99fbc19ed8fc8ec.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: 6ARYRIZRfXwJrvqigTxP0K301L2vx1mDs_vZRfoWYEFdn4aj_IUYSA==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/799952972/ 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:800::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/799952972/?random=1574811764521&cv=9&fst=1574811764521&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaav9&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

9b4f3b8793d00d8ae45f7017e1da55cda1fe70d01d96b5f46ed62d03f03feb2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1137
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
103 B 41ms
40ms Image
image/gif 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=12&aij=%5B%221a0e3486-ed3f-4fe8-96c9-c197ea352d9d%22%2C%22011b105c-c4d8-4605-869c-6451c9cfe595%22%5D&rfc=8&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=5417298&pi=8880541776&ct=blog-post&ccu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&cpi=8880541776&cgi=7354672154&lpi=8880541776&lvi=8880541776&lvc=en&pu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&t=The+Anatomy+of+a+Magecart+Attack+and+How+to+Protect+Your+Site+in+2019&cts=1574811764523&vi=22add7a8df0e07765801c6eb7d193ebb&nc=true&u=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&b=83254537.1.1574811764299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb8785a428c6e-VIE
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
103 B 46ms
46ms Image
image/gif 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=12&aij=%5B%2266b04195-5274-4fb4-b37e-b7858df94db1%22%2C%22c5aae3c1-e4e4-445e-bd6f-4709e1b6eb14%22%5D&rfc=8&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=5417298&pi=8880541776&ct=blog-post&ccu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&cpi=8880541776&cgi=7354672154&lpi=8880541776&lvi=8880541776&lvc=en&pu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&t=The+Anatomy+of+a+Magecart+Attack+and+How+to+Protect+Your+Site+in+2019&cts=1574811764529&vi=22add7a8df0e07765801c6eb7d193ebb&nc=true&u=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&b=83254537.1.1574811764299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb8785a448c6e-VIE
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
103 B 49ms
49ms Image
image/gif 2606:4700::6810:fa05
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=12&aij=%5B%2249b2effe-e2da-47d6-a7b3-a1ce3e300ae2%22%2C%223c081ae7-837c-44ec-be18-436aab4201a1%22%5D&rfc=8&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2430194794&v=1.1&a=5417298&pi=8880541776&ct=blog-post&ccu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site&cpi=8880541776&cgi=7354672154&lpi=8880541776&lvi=8880541776&lvc=en&pu=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&t=The+Anatomy+of+a+Magecart+Attack+and+How+to+Protect+Your+Site+in+2019&cts=1574811764530&vi=22add7a8df0e07765801c6eb7d193ebb&nc=true&u=83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1&b=83254537.1.1574811764299

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:fa05 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
p3p: CP="NOI CUR ADM OUR NOR STA NID"
status: 200
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 53bfb8785a458c6e-VIE
content-type: image/gif
content-length: 45
x-robots-tag: none

GET
H2 200 /
www.facebook.com/tr/ 44 B
246 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1233830516773023&ev=PageView&dl=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&rl=&if=false&ts=1574811764541&sw=1600&sh=1200&v=2.9.14&r=stable&a=tmhubspot&ec=0&o=30&fbp=fb.1.1574811764541.433584263&it=1574811764481&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Tue, 26 Nov 2019 23:42:44 GMT

GET
H2 200 cta-loaded.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 0
91 B 169ms
168ms Script
text/plain 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/cta-loaded.js?pid=5417298&pg=1a0e3486-ed3f-4fe8-96c9-c197ea352d9d&lt=1574811762804&dt=1574811764302&at=1574811764548&ae=1&sl=1&an=1
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2BB2CAF7414017D349AB3A5C2AA399B201DD03D973000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
status: 200
cache-control: no-cache, no-store, no-transform, max-age=0
access-control-allow-credentials: false
cf-ray: 53bfb8787f3ecbc8-VIE
x-robots-tag: noindex, follow

GET
H2 200 cta-loaded.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 0
124 B 163ms
163ms Script
text/plain 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/cta-loaded.js?pid=5417298&pg=66b04195-5274-4fb4-b37e-b7858df94db1&lt=1574811762848&dt=1574811764304&at=1574811764550&ae=1&sl=1&an=1
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2B3B3FA5FD699BB6F897608D8CE239A906D7AC0931000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
status: 200
cache-control: no-cache, no-store, no-transform, max-age=0
access-control-allow-credentials: false
cf-ray: 53bfb8787f40cbc8-VIE
x-robots-tag: noindex, follow

GET
H2 200 cta-loaded.js Show response
blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/ 0
92 B 181ms
180ms Script
text/plain 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/hs/cta/ctas/v2/public/cs/cta-loaded.js?pid=5417298&pg=49b2effe-e2da-47d6-a7b3-a1ce3e300ae2&lt=1574811762806&dt=1574811764303&at=1574811764550&ae=1&sl=1&an=1
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/hs/cta/cta/current.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:44 GMT
cf-cache-status: BYPASS
server: cloudflare
x-trace: 2B4B78601D4A3F5FE95B6CC08D4922C664E2665A86000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
status: 200
cache-control: no-cache, no-store, no-transform, max-age=0
access-control-allow-credentials: false
cf-ray: 53bfb8787f42cbc8-VIE
x-robots-tag: noindex, follow

GET
H2 200 /
www.google.com/pagead/1p-user-list/799952972/ 42 B
110 B 21ms
19ms Image
image/gif 2a00:1450:4001:818::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/799952972/?random=1574811764521&cv=9&fst=1574809200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaav9&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&async=1&fmt=3&is_vtc=1&random=3014854048&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/799952972/ 42 B
110 B 22ms
20ms Image
image/gif 2a00:1450:4001:800::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/799952972/?random=1574811764521&cv=9&fst=1574809200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oaav9&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&tiba=The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019&async=1&fmt=3&is_vtc=1&random=3014854048&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 26 Nov 2019 23:42:44 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
246 B 7ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
Facebook

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1233830516773023&ev=Microdata&dl=https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%3F_hsenc%3Dp2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A%26_hsmi%3D79947511&rl=&if=false&ts=1574811765052&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019%22%2C%22meta%3Adescription%22%3A%22Magecart%20is%20responsible%20for%20the%20Newegg%2C%20Ticketmaster%2C%20and%20British%20Airways%20data%20breaches.%20Learn%20how%20they%20operate%20and%20the%20ways%20you%20can%20protect%20your%20site.%22%7D&cd[OpenGraph]=%7B%22og%3Adescription%22%3A%22Magecart%20is%20responsible%20for%20the%20Newegg%2C%20Ticketmaster%2C%20and%20British%20Airways%20data%20breaches.%20Learn%20how%20they%20operate%20and%20the%20ways%20you%20can%20protect%20your%20site.%22%2C%22og%3Atitle%22%3A%22The%20Anatomy%20of%20a%20Magecart%20Attack%20and%20How%20to%20Protect%20Your%20Site%20in%202019%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fblog.bluetriangle.com%2Fhubfs%2Fthe-anatomy-of-a-magecart-attack-featured-iamge.png%23keepProtocol%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fblog.bluetriangle.com%2Fmagecart-attack-how-to-protect-your-site%22%2C%22og%3Atype%22%3A%22article%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.14&r=stable&a=tmhubspot&ec=1&o=30&fbp=fb.1.1574811765049.327954516&it=1574811764481&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 26 Nov 2019 23:42:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-23=":443"; ma=3600
content-length: 44
expires: Tue, 26 Nov 2019 23:42:45 GMT

POST
H2 200 perf Show response
blog.bluetriangle.com/_hcms/ 2 B
373 B 201ms
201ms XHR
text/plain 2606:4700::6811:72b4
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://blog.bluetriangle.com/_hcms/perf
Requested by: Host: blog.bluetriangle.com
URL: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:72b4 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://blog.bluetriangle.com/magecart-attack-how-to-protect-your-site?_hsenc=p2ANqtz-8C2XaVCCLlpuOPZdG2YnNGReT6bRUz5y9onPX2Th_JtEdM9lesvQ1DOt3Q3emchJSN2GzYs51n4QgR_hGrC2Az8uvA1A&_hsmi=79947511
Origin: https://blog.bluetriangle.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/json

Response headers

cf-ray: 53bfb889aff2cbc8-VIE
date: Tue, 26 Nov 2019 23:42:47 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-trace: 2B014DF40B539DFE821A7C7CD920C144D471E802A5000000000000000000
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
access-control-allow-credentials: false
accept-ranges: bytes
x-robots-tag: none
content-length: 2

Verdicts & Comments Add Verdict or Comment

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bluetriangle.com/	1970-01-19 05:26:53	Name: __hssc Value: 83254537.1.1574811764299
.bluetriangle.com/	1970-01-19 14:48:27	Name: hubspotutk Value: 22add7a8df0e07765801c6eb7d193ebb
.bluetriangle.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.bluetriangle.com/	1970-01-19 14:48:27	Name: __hstc Value: 83254537.22add7a8df0e07765801c6eb7d193ebb.1574811764299.1574811764299.1574811764299.1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	debug	URL: https://he.t.hubspotemail.net/e2t/c/W1Y5hKJ52H3dTW7Rq10x99Rs7p0/W77CfM36nwNvfW79VGr871HV5_0/5/f18dQhb0J5p3HxgVV5Qk9T7J-t6PVWdbJY20ZTNgW20Yb8N1xV1CpV2P14M45V83_W1LvFJt3NBBkFW4hF83j3SXXBXW3ZV6nw43T4P1W3zb1Dt3zgF7wW3zht5L3F8JC-W43Yfl-43mz5-W43X4Sf4fdjqwW4hLr_X3T3QQtW3vfnk741QpM-W1S8vX34fRdgHW2sBzcV38b_08W3ZZQRG2YykPVW1Sly5d2CL4z8W1_jqY14t6XcGW43Tz7K1SjsbZW2KWRpK2Rm-l1W4cR41w2vPcYcW2-cFVZ3F7vL9W2ThygP3gvB33W41rVc130xwxmW49sfCy4t88jKW2nF0JM3vfnkhN3SFSGGmhwKlCvFpFDk7HW2lm8Yh43Pt00W4hKL5w2m3_GBW3K9dG544_Yj4MBzPlPmWcPtW9lpqTl7s8-FSV25qRn8Sd0wnW7SfD2C918ybJW8z2D-n1sXYl_W44_v2S78cfZ3102(Line 13) Message: toS

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubapi.com
api.hubspot.com
bat.bing.com
blog.bluetriangle.com
bluetriangle213691z.btttag.com
cdn1.hubspot.com
cdn1.hubspot.net
cdn2.hubspot.net
cdnjs.cloudflare.com
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
d10lpsik1i8c69.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
forms.hubspot.com
googleads.g.doubleclick.net
he.t.hubspotemail.net
js.driftt.com
js.hs-analytics.net
js.hsadspixel.net
js.hsleadflows.net
js.usemessages.com
no-cache.hubspot.com
pro.fontawesome.com
px.ads.linkedin.com
s.adroll.com
secure.leadforensics.com
snap.licdn.com
stats.g.doubleclick.net
track.hubspot.com
www.clickcease.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
13.224.197.175
13.225.78.44
151.139.128.10
172.217.23.98
2.18.233.40
2606:4700:10::6814:4461
2606:4700:20::6819:5b6e
2606:4700::6810:f905
2606:4700::6810:fa05
2606:4700::6811:4004
2606:4700::6811:46b0
2606:4700::6811:72b4
2606:4700::6811:74b0
2606:4700::6811:c9cc
2606:4700::6811:e9cc
2606:4700::6811:edcc
2606:4700::6811:f2cc
2606:4700::6811:f4cc
2606:4700::6812:a205
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:800::2003
2a00:1450:4001:809::2003
2a00:1450:4001:818::2004
2a00:1450:4001:81b::200e
2a00:1450:4001:821::2008
2a00:1450:4001:825::200a
2a00:1450:400c:c08::9b
2a02:26f0:6c00:296::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
51.140.49.131
54.154.177.155
046fa5c62e3b17b46ea2f8c601465dacfd5c153aee7a71754a9be582de74a385
0762605abe4faf4af6a4d446dca4c476e44b8ac409bd772fa6ebcf5fec0cb452
0799fd090f6b1a51535966a1df57e213e7717ff4caccdb659de314ac845e43ae
08dc0d88069665fb124f7354f3aa62710dac90c69c0f7915896b64d61ad4014b
09f439b49fd8ccd1abd10c152ca30c78bb690ecd5f0e556eb01a08f352a14158
0f97ba673682b5ad3cc72c412f2db3fd0f37940aba44d19347322a19de4ac4fd
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
124cb811ab8e9a60b1e46a89741faebf40126102251abf8df17bcfab09b3498a
14b0e8205075770c1ef7258e123e7e225cb3170da3655a963f2e8d8b8e8a1186
186343eda356f800dea4ef94793cdd28dcd7ac555765ba7b578527508ab64286
1894bf26f25a0760600ab765f9b228ada17262e32d1ac3a18ce48e144dfe80f4
1fa8d14f642792816ff50b0fa340d9a606112e414bcf670e4690b1fd5fa6f670
219ab0ad68af94a75770c2d8404433b3ca47fd6bf900464b058f50c21ed87854
22e8511d926b4417a1d5e65a1b1b9d21f0e6ad3cb637cf6d91ac8492758d22f2
2629973d84bc996f5c05a9ff6d4f4128da3ba443c218c7596cc07ecd587bc6dd
2878e261f4608effb59d39ee9e01dd3ea7c16c7ff60b470ee8032009c8994099
298b31e4d53f54b3acd2bc16ba3fe309966a61bf27c3a77792af1c49dc334ccf
2e0fd9812ea2aad0ed2fa667b8f591d2008e1a4a238b365c7b07c9365f487c16
2fb49dc337de2fd56391fdf6a21285a45d13eda67ecf3bcb4cb91b9d950481d0
32c834e0490368f8cb3a5a2b0ffabb2bf659d04ee98ed50e95b59ce4d1389529
32d7a2718589bfa36eb20290f96157a89e02e3892281ed6bba2781e151bdc949
341a4d40ad1b2560db940f906716d0e9539d4c0785399d7e0348fd0d3af00170
389ffd7acc39e9f0ab132ce3003653a03e41216767d29aeb597d0c7b544c95a7
38df5ac8112ce99f0ad0f20d7d90d565d1e44b299d5855fb75e91e691ef2c00c
3df2fd21e6d876fa4046f81457edfaa69c8c19cb6035b6c704c0ec503a967ff2
3e5f27d5e5d92a7499b2c01025e9d8f6c78effa35afbe71156159a221be6cece
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
4575a25af8345837dd1a37196f64353b7048950ec75026329aedcb3afd5c0775
4ac59c255f27f0ad9fd791b9863315e8d60ce01f40ffd9ad3cb9c427308ba1e6
4c868f8d8e86e0011551d14489eec739976cd48bffd079e267d076461bbf6482
4e05a9ad259d6ffedac19829e0c769e8dc334dc948faba4562cf76c2ea7f9aa9
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5658878d487ead1eab8f2f7117554a344a0c14ed34dedf0f29785579e3df412b
5c1dde4cdc5c608da53737233f02219a7421ab6870d5d90bc0b7b294d571942c
69b15f6f0590e69f824e7cf7011f564cd00ff6c2365237c57c917a40298069b9
69e3a796f4b120879065a812b95b56fd4d28f88faf8c1976ad9b0fa2f31dc0eb
6fd1c1ee483d732f38b984e2ba61b2fa118fe93d557e68d86f88d05a88cd0a5c
71b52274b1b43661e6523b2774c9fa98a673e1861703bea5f32d75a32a850394
725203aac115a2a5623ad3e69272a79791474f21c5cf5f313482e81651f56d84
75b857fc1e6ed070dffbbbf67e18a4e99ff49d805f5a924a0417ff0138ddf6d8
76186412b0f34c4bd53596ca92ca72f4a5a34bceffd58a16ac0375c53db23305
76680627c94cb5c715ff09eaa8db4acdeae2b2de5b499748a37dc4e556b339b8
770109b53b1128e2ab2c51cf7f8fbf6ef8e8a184dc6cb4bed373d1f4611037cf
776746fcb8c8067d9a60fdd74f723cfe17c0cea2c44b5366394422017da20a05
788300b4cf29c0cbbf8a130a30885dc9c2d6bd36f47864f0774f6231c8cf1586
7e347b66fb1145f780600551e06778b33ecaca5c45897ac90eb96eb4b6afd082
837158f34cd5382cd99e6a3010f11bf2060ee9a4caaa887cac23bf14087f3d6f
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
963323f5069a74e9824fd4e610d8c9f5e57192b93c6d3ce9ed54b93d20872f03
9860bb71bf5869abc3558ff5c148a642e0e3e6b498f34bb56960931aed712e51
9a55c02888038e59252778d81b592f942ea904c3dca19f539e3376b4a0a0c6b2
9b4f3b8793d00d8ae45f7017e1da55cda1fe70d01d96b5f46ed62d03f03feb2d
a057803c4d59d0857335d68bacbc3042a6454820e7e0897db48c11a1bf40e826
a6d9d9e6046d227df0c818d934dadd9fadf08687308138b91376258494826f9b
ab449241b50123673e76dbcd70f869ae11d26920f0ce1670fdfd266308058179
b139982ce002c53ddfb65aec1e90704c0a3704fc5aa35247f9323b74a1d3f721
bf43cb8fbceabffcfa45c1118c210159362b2b8ed865038b0eeeac749e90c312
c850ac754fd1340bdb72b13494ae3e0353e035a8e48ffcefedf2c59f2e7531da
c8b23413b6bf6c17478b7c2f786737f34a78abcb17c8d3f5a2fada53c0ede751
cea35bd5b16edacf49a4735cdcab5146cd97b87f94faebb353ff6c5ad7e33cac
ced3e9b2977cf51cdfad8c8b60f6f2d697ca654fac7b63bdedcd4be0a6004304
cede182386b932d42fb668cdf59a6b6e879134fcb446fe85817119ab9db94d0f
d0f73e51310837b633c23876d6659493cd0f3454f740f2106ae9ac381ba97287
d226759a3f1ffded6e6aa782860c25f43a8adc03d835dec3a6823d502eb0a340
d46184e3ad2183e1a889fde5e307a049ac9fb792675b967da8ae97e5e3667ad8
d64849d9ec4afd8eb21b289c99a9d785eb7079d893b899490132fb4707447457
da267e7fd628d92d78d976eb4a1c71a63a077c6a3b893ed19d628fe3e8ec0c09
db0f2f9be48c4c934fae174db1e7a7315b5690e1dbb9a65d0d6d08d5c22099e5
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dd75e2024e90ad31a4b3aa1d98ff19332ba8a52034cc3f35b9c7ff81cb006023
dde196e7d7168fa7fd462d80a28377c38441df81e0857f202de239238ea3aec3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5a4bac612876ebeb85ebbf30159d39e512fbd603b9c8cc8d2e415fd69ffcd91
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1f4e97dbc0364cd73b3b590130506d4cb722e0aba1bac74300fa962be259e81
f2e30530e228fe037f4aafc1da93b314375e57801ed90a7ea56f405940b1b418
f3f526d1f9606629c8b92ee6e5912010c2c10563ae39241c7c5f08a5c88ca570
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f5b9c05ae7b05e6ef6129a065795922649a71851bd9f57d080dc86e3efa34a51
f82c9f099656346f543c66ba009bd5f18010c7b41ad43d47a7f762121ad4496d
f9db1b06a7cfcabc0a842a496f6af2ab20c2e9aa6482210313b3c1588f4a066a

blog.bluetriangle.com Open in urlscan Pro 2606:4700::6811:72b4 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

101 Requests

100 %HTTPS

80 %IPv6

31 Domains

39 Subdomains

33 IPs

6 Countries

1945 kBTransfer

4176 kBSize

4 Cookies

63 Outgoing links

Page URL History

Redirected requests

101 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

blog.bluetriangle.com Open in urlscan Pro
2606:4700::6811:72b4 Public Scan

Screenshot
Live screenshot

Full Image

101
Requests

100 %
HTTPS

80 %
IPv6

31
Domains

39
Subdomains

33
IPs

6
Countries

1945 kB
Transfer

4176 kB
Size

4
Cookies

101 HTTP transactions
0 data transactions