www.crowdstrike.com Open in urlscan Pro
2606:4700::6810:b576 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Submission: On May 09 via api (May 9th 2024, 5:01:20 am UTC) from IN — Scanned from DE

Summary HTTP 151 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 19 IPs in 4 countries across 14 domains to perform 151 HTTP transactions. The main IP is 2606:4700::6810:b576, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.crowdstrike.com. The Cisco Umbrella rank of the primary domain is 101949.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 27th 2023. Valid for: a year.

This is the only time www.crowdstrike.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
80	2606:4700::68... 2606:4700::6810:b576	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:4700::68... 2606:4700::6813:b234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700:303... 2606:4700:3037::ac43:8ef5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2600:9000:26e... 2600:9000:26e8:7400:a:de52:1580:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a02:26f0:480... 2a02:26f0:480:99e::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:350... 2a02:26f0:3500:16::215:1493	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a03:2880:f08... 2a03:2880:f084:d:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:2089	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:148b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	2a02:6ea0:c70... 2a02:6ea0:c700::10	60068 (CDN77 _) (CDN77 _)
3	2600:1f14:5db... 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d	16509 (AMAZON-02) (AMAZON-02)
9	2.17.147.176 2.17.147.176	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	37.252.173.215 37.252.173.215	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:480... 2a02:26f0:480:23::1726:629c	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	76.223.9.105 76.223.9.105	16509 (AMAZON-02) (AMAZON-02)
6	2a02:6ea0:c70... 2a02:6ea0:c700::21	60068 (CDN77 _) (CDN77 _)
151	19

80 2606:4700::6810:b576 (United States)

ASN13335 (CLOUDFLARENET, US)

www.crowdstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:4700::6813:b234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3037::ac43:8ef5 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:26e8:7400:a:de52:1580:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.addsearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:480:99e::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:16::215:1493 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:d:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:148b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.crowdstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a02:6ea0:c700::10 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)

cdn.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d (Boardman, United States)

ASN16509 (AMAZON-02, US)

api.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2.17.147.176 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-176.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.173.215 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:23::1726:629c (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.9.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: ac3ff6aafb2cddae2.awsglobalaccelerator.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:6ea0:c700::21 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)

cdn77.api.userway.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	crowdstrike.com www.crowdstrike.com — Cisco Umbrella Rank: 101949 go.crowdstrike.com — Cisco Umbrella Rank: 237757	8 MB
19	userway.org cdn.userway.org — Cisco Umbrella Rank: 3155 api.userway.org — Cisco Umbrella Rank: 3077 cdn77.api.userway.org — Cisco Umbrella Rank: 6160	221 KB
12	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 312	181 KB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 5787 c.6sc.co — Cisco Umbrella Rank: 8716 ipv6.6sc.co — Cisco Umbrella Rank: 5928 b.6sc.co — Cisco Umbrella Rank: 3876	20 KB
6	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 425	121 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 448 p.typekit.net — Cisco Umbrella Rank: 565	73 KB
4	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1230	282 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	302 KB
3	addsearch.com cdn.addsearch.com — Cisco Umbrella Rank: 168612	84 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 9185	714 B
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 64	69 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 183	62 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 482	703 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 533	303 B
151	14

	Domain	Requested by
80	www.crowdstrike.com	www.crowdstrike.com
12	cdn.cookielaw.org	www.crowdstrike.com cdn.cookielaw.org
10	cdn.userway.org	assets.adobedtm.com cdn.userway.org
7	b.6sc.co
6	cdn77.api.userway.org	cdn.userway.org
6	assets.adobedtm.com	www.crowdstrike.com assets.adobedtm.com
4	use.typekit.net	www.crowdstrike.com use.typekit.net
4	use.fontawesome.com	www.crowdstrike.com use.fontawesome.com
3	api.userway.org	cdn.userway.org
3	www.googletagmanager.com	assets.adobedtm.com www.googletagmanager.com
3	cdn.addsearch.com	www.crowdstrike.com cdn.addsearch.com
2	epsilon.6sense.com	j.6sc.co
2	www.youtube.com	assets.adobedtm.com www.youtube.com
2	connect.facebook.net	assets.adobedtm.com connect.facebook.net
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	j.6sc.co	assets.adobedtm.com
1	go.crowdstrike.com	www.crowdstrike.com
1	p.typekit.net	use.typekit.net
1	geolocation.onetrust.com	cdn.cookielaw.org
151	21

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.linkedin.com
www.youtube.com
go.crowdstrike.com
gist.github.com
github.com
www.hybrid-analysis.com
www.instagram.com
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
crowdstrike.com Cloudflare Inc ECC CA-3	`2023-11-27` - `2024-11-26`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
cdn.addsearch.com Amazon RSA 2048 M03	`2024-01-14` - `2025-02-11`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
use.typekit.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-01` - `2025-03-03`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2024-02-16` - `2024-05-16`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
go.crowdstrike.com Cloudflare Inc ECC CA-3	`2024-02-06` - `2024-12-31`	a year	crt.sh
1667503734.rsc.cdn77.org R3	`2024-05-07` - `2024-08-05`	3 months	crt.sh
api.userway.org Amazon RSA 2048 M03	`2023-09-02` - `2024-09-30`	a year	crt.sh
6sc.co R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2024-02-14` - `2025-03-16`	a year	crt.sh
*.6sense.com Amazon RSA 2048 M03	`2024-03-31` - `2025-04-29`	a year	crt.sh
1784939676.rsc.cdn77.org R3	`2024-03-22` - `2024-06-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Frame ID: 59976E238C2484ABCCB953E1B5F1C9E2
Requests: 147 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

HijackLoader Expands Techniques to Improve Defense Evasion

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

UserWay (Accessibility) Expand

Overall confidence: 100%
Detected patterns

cdn\.userway\.org/widget.*\.js

Page Statistics

151
Requests

100 %
HTTPS

79 %
IPv6

14
Domains

21
Subdomains

19
IPs

4
Countries

9653 kB
Transfer

14515 kB
Size

13
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/CrowdStrike

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CrowdStrike

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/crowdstrike

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/CrowdStrike

Search URL Search Domain Scan URL

URL: https://go.crowdstrike.com/try-falcon-prevent.html
Title: Start Free Trial

Search URL Search Domain Scan URL

URL: https://gist.github.com/Cr4sh/76b66b612a5d1dc2c614#file-wow64_call-cpp-L61
Title: existing

Search URL Search Domain Scan URL

URL: https://github.com/hasherezade/transacted_hollowing/blob/main/transacted_file.cpp#L13C29
Title: this project

Search URL Search Domain Scan URL

URL: https://www.hybrid-analysis.com/sample/6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748
Title: 6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=HijackLoader+Expands+Techniques+to+Improve+Defense+Evasion&url=https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Title: Tweet

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.crowdstrike.com/blog/hijackloader-expands-techniques/&title=HijackLoader+Expands+Techniques+to+Improve+Defense+Evasion
Title: Share

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CrowdStrike/

Search URL Search Domain Scan URL

URL: https://www.instagram.com/crowdstrike/?hl=en

Search URL Search Domain Scan URL

URL: http://www.youtube.com/user/CrowdStrike

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information.

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

151 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.crowdstrike.com/blog/hijackloader-expands-techniques/ 83 KB
19 KB 190ms
172ms Document
text/html 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

317fde7d62285ea19f6d792d7933a77dc6d479f735da04504c1544c967ed36b0

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: public, max-age=14400
cf-cache-status: EXPIRED
cf-ray: 880f21666f078ffe-FRA
content-encoding: br
content-security-policy: upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
content-type: text/html
date: Thu, 09 May 2024 05:01:14 GMT
expires: Thu, 09 May 2024 09:01:14 GMT
last-modified: Fri, 23 Feb 2024 05:27:24 GMT
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 b08e1d433d62b5ab056680968a8cc7ea.cloudfront.net (CloudFront)
x-amz-cf-id: iosl3ivQHo0Pd8prh6FqkUVJOfmuUGaLga4cKYxALpOyz_Q2OexiUA==
x-amz-cf-pop: FRA60-P7
x-amz-version-id: 4RCvKB.06wm05E57WF6LLhQbnQGjdQk4
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-frame-options: ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
x-xss-protection: 1; mode=block

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/ 8 KB
3 KB 52ms
32ms Script
application/x-javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/OtAutoBlock.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a5519e5e3a790d684daf67a4888160187a1359dd446b05fa89cbdaabc66221f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 41292
content-md5: /BI5P0G2/48FKPHd2CJvWw==
content-length: 2565
x-ms-lease-status: unlocked
last-modified: Tue, 13 Feb 2024 15:51:08 GMT
server: cloudflare
etag: 0x8DC2CAB981762B3
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 816d0a71-101e-007e-1e67-79a9c4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f2167992fbb79-FRA
expires: Fri, 10 May 2024 05:01:14 GMT

GET
H2 200 single-post.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/ 42 KB
6 KB 53ms
49ms Stylesheet
text/css 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4e6f2cd344033e402e9a3a5297028b8535d7352829a4ec0c1f61c7879132e6ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f2a51982e289d888963f4f93b48c5f22.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: n4lg2MRkKPvZBG0lqlsh5FSxPVPCoRg7
age: 177
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:53 GMT
server: cloudflare
etag: W/"df29effc48cbc2a12b6d6236f58a4ee0"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 880f21678fbb8ffe-FRA
x-amz-cf-id: ynaEZ9fDChW0wQil2KI6fiCb_H0X3FtrFc1_krEfUXs3CaLJ0YexjQ==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 crowdstrike-wp-header.css
www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/ 100 KB
15 KB 45ms
42ms Stylesheet
text/css 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/crowdstrike-wp-header.css?ver=6.4.3

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca2428595f920f37d3b750303eae6ba6f9cda8ae9abdd7eeacc5c1e0866349d9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
content-security-policy: upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
age: 16986
x-vhost: crowdstrikewwwvhost
x-cache: HIT
x-served-by: cache-dfw-kdfw8210042-DFW
last-modified: Tue, 30 Apr 2024 11:56:06 GMT
cf-bgj: minify
server: cloudflare
x-timer: S1715213813.542163,VS0,VS0,VE3
etag: W/"187b5-2386f26fb1bdc0-gzip"
vary: Accept-Encoding,Origin
x-frame-options: SAMEORIGIN
content-type: text/css;charset=utf-8
cache-control: public, max-age=2592000
cf-ray: 880f21678fbd8ffe-FRA
expires: Sat, 08 Jun 2024 05:01:14 GMT

GET
H2 200 theme-styles.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/ 430 KB
74 KB 40ms
36ms Stylesheet
text/css 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd422fe1ca96d3917040ae74dcf9d0cdf9e248f72e92e6e2cd88ae9158b028ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0be6ab2f92b7567e05a874f049abbbe6.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: Q4cWJj1FD37rj71xZqJNPa65Clo8CmDI
age: 1252
x-amz-cf-pop: AMS58-P1
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:54 GMT
server: cloudflare
etag: W/"a7e12ce188d6d76520812875ce163982"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 880f21678fbe8ffe-FRA
x-amz-cf-id: B8ImihGOfn-KOIjpiWWGM7goZACoCrIA0nKO9S7rULHNOZsuKfIehw==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 tablepress-combined.min.css
www.crowdstrike.com/wp-content/ 6 KB
2 KB 41ms
37ms Stylesheet
text/css 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/tablepress-combined.min.css?ver=31

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db69a3d25d8125632acede7426cfaa714390a3a713e8fb38fca4264581341744

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 256cd380c9790a2b71d68709829caa18.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: tsHm.4aglhivxJ6SfEs8YL4ACcBPHmEM
age: 326
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Tue, 30 Aug 2022 15:32:39 GMT
server: cloudflare
etag: W/"e246c6f72f6db9cc7c8a1061c6b8717b"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 880f21678fc08ffe-FRA
x-amz-cf-id: JPvjuddrmb8QLv_DcDOZs25jaQ_limz_hvVoo_qS04tasTWGHSVlFw==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v6.4.2/css/ 100 KB
23 KB 39ms
19ms Stylesheet
text/css 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1409443
etag: W/"5222e06b77a1692fa2520a219840e6be"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RtE%2F%2FBraTCTqrkOHfBR8yRR5MKAveAEZg%2FxPz5%2BMQuBMwHAQi4aPpBAUWysZxSlToHY%2FHAl%2BrUlgaDFn9IVpPE0lHRPCgZhJq%2BFLBL6G%2BmiIiWy5Yzx5Xa1Y3wyLsFUA7A4HSSGlBYJagx5yGTVbhfmL"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 880f21679d8937d2-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v6.4.2/css/ 27 KB
5 KB 37ms
18ms Stylesheet
text/css 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/css/v4-shims.css
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e0a27c105caf20bd4cc76fe58f222d856ab8f626447846842dddca8ce7509ef

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1405556
etag: W/"665de85010641f678f0178a9d330a7af"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=anMTIBlLmtuquhHBQ7HrZIqnD1QSrqJ0WSM5Nm9n%2FUqkclm0riJN%2FqKga3kKdndhmNqdSQ6q4mVKH9uwccaWM5bHnVm3SjdQkrZBlBPjnGj2QtbnqZBA1mOUQYpTF4aHulkCSKJ5aj9fleRvU9K1Op6m"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 880f21679d8b37d2-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 fetch-inject.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/ 1 KB
902 B 49ms
47ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/fetch-inject.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eee66297afe4bfd363c9e7b27978892a34adffde1664ef7509335aff8aa31cc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8006f736d3dc32a20a91813f2f50fa2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 7kORJYf.ywWIFW0rO_BCsvWk3gsXGmq_
age: 1252
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=1343
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:49 GMT
cf-bgj: minify
server: cloudflare
etag: W/"e80eef79b8a9c769c9fe24903f880fb5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f21678fc28ffe-FRA
x-amz-cf-id: nJoZYJBdlZPutTy75WuuZWJI6rBVpwTeYu-G0tIQUmeVAsJQls5S3A==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 blog-free-trial.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 2 KB
1 KB 39ms
37ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-free-trial.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4d22dfdc3a4b880ea008f8ad5b4da8ee444f86321400a2be83bc468c83da1c5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 256cd380c9790a2b71d68709829caa18.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: of5VuokMy94PK85FmoifoeBm7ZkJvG2A
age: 1251
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"11b341a1cb97a2a86661339b8c79305e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f21678fc38ffe-FRA
x-amz-cf-id: 7kxDY7y9Bs_EfazHOY1HElb_Q8uUOJnDctge9JaSiZJoOsLpQLG9CA==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 blog-categories.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 6 KB
2 KB 47ms
45ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-categories.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

01a7aa05d82b70da32c8a24ac7db1933bb73b146b00a482c1a0d4305e4d84659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d0a36dbd6f5cc87855296f2852cab3ec.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 9llJGIXS2i4wjVAxJKkjzia5sJW5qMui
age: 1251
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"9db22b59a3ae10c8bc22a6d9645708ec"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f21678fc48ffe-FRA
x-amz-cf-id: Gbwth65DGJHxeDBwLVAisdka-uTY59ORwzbe-Q0Ems2DHipAPUhjVw==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 blog-category-sidebar.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 6 KB
2 KB 49ms
46ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8eed6c8b6895d63f1a7f0c5917e211e516bcb45cb5cf9726eeb01ca36cca539

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3e28473376ca49b2cafcfef86a39cf34.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: 2zFaCu2vlUfhPn6a2VQwFehAymWldOQR
age: 1252
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"3c4da1237088a8b1dfb2aeeff5db5730"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f21678fc68ffe-FRA
x-amz-cf-id: kCgCk97v42LDoiO8liFh9lmyXkNxkiHRhlE-WCrIWHPtYurfCl3hiw==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 addsearch-ui.min.js Show response
cdn.addsearch.com/v5/ 312 KB
76 KB 66ms
8ms Script
application/javascript 2600:9000:26e8:7400:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addsearch.com/v5/addsearch-ui.min.js?key=7737a29b854de71521b1cd72c4118cfc&id=asw_01
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26e8:7400:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ced035236ef87e76d0e300e6c7c507d982c4a48c99a137f3a7fb61a94cb83688

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 01:14:03 GMT
content-encoding: br
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
last-modified: Tue, 07 Nov 2023 15:45:02 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
age: 13632
x-amz-server-side-encryption: AES256
etag: W/"b04213a26b90b906bfdd4edace511330"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: minMynQMq4vPHxDrxfnSJVMgSsKCRDY2yWa6Q699Y-_d-2Pq5eLZEA==

GET
H2 200 Blog_1060x698-4.jpeg
www.crowdstrike.com/wp-content/uploads/2021/09/ 1 MB
1 MB 154ms
153ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/09/Blog_1060x698-4.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d9e2ec9ac961fa1ffd21bb7e6dd88b78409a02ae21a146c4cd5453bdef88b10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 7115bbde016dc7107bc64db76ba40c56.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-version-id: 6A4VWEoFEx1xl.ER2C_R3JnDa9Xn7Mvd
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 1130870
last-modified: Wed, 14 Feb 2024 18:30:48 GMT
server: cloudflare
etag: "bfeb06b718111c5af0d785febcb47cfb-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f21678fc78ffe-FRA
x-amz-cf-id: 6OdwrS6K5X73ZS3L-6PKCSAwah6tSDsSSrzSqKdINR0RYzdMpN9oMg==
expires: Thu, 09 May 2024 09:01:14 GMT

GET
H2 200 Figure1-2.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 81 KB
81 KB 159ms
158ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Figure1-2.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea3c802e8d4cf12efe24d09a58f7aebbd24cb0a1aa717dfb16e4b567410261c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 134eef7df83fe066fda8a86e722c33dc.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-version-id: MHLdK_kzFtsblQxiN3xD994non8ZN4oU
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 82804
last-modified: Sat, 20 Apr 2024 03:00:43 GMT
server: cloudflare
etag: "7a3bd88d8d111626e4b8681845fc0e30"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f21678fc98ffe-FRA
x-amz-cf-id: Tg4Py92lKJIi5bqIxsd59VOB3d8a9DdWhEptsAKSfi65YooCBRABnA==
expires: Sun, 04 May 2025 05:01:14 GMT

GET
H2 200 Figure2a.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 40 KB
40 KB 172ms
171ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Figure2a.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ec1ce75f2ef5a3385c2fa08d0609c4fd118c8a465c00158e1db3f809d308fbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e9b74ccbde368a1365608891aeccb498.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-version-id: 77z3P3ozcx_wMQcA24TGGWLybkJ3lP2u
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 40986
last-modified: Sat, 20 Apr 2024 03:00:45 GMT
server: cloudflare
etag: "573efd1f8a50727e3b187898ec16d6ea"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f21678fcb8ffe-FRA
x-amz-cf-id: Uy0TAhS-zczDQJRSIvOrxN4xCZ8oAum948NvxXrBtxtW05eBoOgQrw==
expires: Sun, 04 May 2025 05:01:14 GMT

GET
H2 200 23-OTH-060_adversary-1-kitten-iran.png
www.crowdstrike.com/wp-content/uploads/2023/11/ 288 KB
289 KB 43ms
42ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/23-OTH-060_adversary-1-kitten-iran.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

371c77d9d1f5d96c55daf6224cb162828509919e3f97f59722ef1b1dc971571a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 56df5811b9d89103539b9b0b5fd9b262.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-version-id: 16kPsaqChARD4H3m0B85P236Puid7KBy
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 294977
last-modified: Sat, 20 Apr 2024 03:08:00 GMT
server: cloudflare
etag: "a1459f0d77849505999e718f2b74b2c6"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216888488ffe-FRA
x-amz-cf-id: ZR5ZfnHcREh9bgZgRkpFWFxHpeHmBUWaWxG2nS-yF0q7u6gD8QL4pg==
expires: Sun, 04 May 2025 05:01:14 GMT

GET
H2 200 0123_06_Linux-Container-Escapes_Blog_1060x698.jpg
www.crowdstrike.com/wp-content/uploads/2023/01/ 705 KB
706 KB 49ms
49ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/0123_06_Linux-Container-Escapes_Blog_1060x698.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6336f6146b0004f594b94f313f32c6e00ba1750314e6dfe8e73a86d833f22ec7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 b77e6c4c926acdb5c1a30b7465e6750e.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-version-id: kI2TPO2g9387qmF4vKU28PPKkSW0TzpZ
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 721850
last-modified: Sat, 20 Apr 2024 03:03:58 GMT
server: cloudflare
etag: "4f76075ebc4bf1d303f6589608506a26"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f2168985a8ffe-FRA
x-amz-cf-id: HSY_AxaJDVs3nW14MuZBz_0IJ2SfgsU6hUzOSK1mmarKJa6bLmzbYw==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 0823_01_MSFT-Windows-Restart-Manager.jpg
www.crowdstrike.com/wp-content/uploads/2023/08/ 88 KB
89 KB 33ms
33ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/08/0823_01_MSFT-Windows-Restart-Manager.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ac2cea87b2980e211b88ecc676e39fe1ecf5bb25f3596f94534e6e786e22a962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e9b74ccbde368a1365608891aeccb498.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: AmLcBRmW3QciPQsExAGCSkdED_uG7qLY
age: 16117
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=332841
x-cache: Hit from cloudfront
content-length: 90269
last-modified: Sat, 20 Apr 2024 03:06:29 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "5f730fffcc5da15482afb9220f16d83a"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216978c38ffe-FRA
x-amz-cf-id: k-6HmDJvRisrGHAyQQxCHGkWJszTM_Q6AScLdRe1kXpGjhKhe9NZdg==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 exit-promoter.min.css
www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/components/ 5 KB
1 KB 39ms
38ms Stylesheet
text/css 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/components/exit-promoter.min.css?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c0b8d5e9b7d24a63fd54cbf0002f396e8de5c44644eb72556d0c2cb78497c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 c0db8c417b5a375429fc7f3c54841604.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: zU5B1B8eQkDMeTGc_WH1on7TJrxcoWPN
age: 1253
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:51 GMT
server: cloudflare
etag: W/"1f772eef740a2abf51fd8782f91682d3"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 880f2168c87d8ffe-FRA
x-amz-cf-id: G0O4gZZ1MLZZ9fpVxS3AYRFyMoQRb4ARoC8K2_wJWHzog7fuBxOLYQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 footer-navigation.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 24 KB
9 KB 39ms
39ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

902319cc2d2d4f29ed41fb75a5d166a4f81c06eb6f402de843234776fb3e1217

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 a5607d37f6322bee208b762f730550a0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: GpR4vnHynOAc1stTcLxiH2cwzFKHYNWZ
age: 1253
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"8a2041506b62acf4590b1918e0063948"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f2168f88e8ffe-FRA
x-amz-cf-id: OwqrLTK45-7DCa5NzmaX684u_F5P4jmVjX0CYBWBA2VNuEiP2Yttvw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 theme-scripts.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/ 203 KB
66 KB 33ms
33ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5f5fd1f7dc9650e8afc43033aa578d827d4083000a32778ebe888d7199dfd46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 1903071a927324e2fb28199ee96c4bb2.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: vDL242XqmilJ3at4W5itwyq.jj6KiolM
age: 1252
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:50 GMT
server: cloudflare
etag: W/"ddf84330b1b358db7da795af6ec6a0c7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f2169a8e88ffe-FRA
x-amz-cf-id: YyQGVWelqquP00QZACPGEHAYLeHnbKgrXsZ9yQkKobAdy_AMmJ7pOQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 blog-navigation.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 7 KB
3 KB 34ms
34ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d33cd073dfadc9f9b02d1755dcb0f1db480730776fa00daff8c331e9fdcd8f80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 88fd4dc311317996718ed4ed98e5cbda.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: cFQT571jB36hG6kv1GVyBRHn18BBEpPU
age: 1252
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"25804c6f2832baa386384ccd4374eaf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f216908968ffe-FRA
x-amz-cf-id: xYSu2JHD82cptFT1bikikzinZBmpETGqFu0wnkE4uRafNr50thkU7w==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 exit-promoter.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/plugins/ 23 KB
8 KB 33ms
33ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/plugins/exit-promoter.min.js?ver=1708658992

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c0ee9cd232505fc312c60460fdb62192b38a66306b862c185a27a4828331008e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f59e52adbf3a58a76dec03547cb4b34c.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: ZpdNsS34dfMhGQlqgTCU_2q0Aqpuj2gk
age: 1252
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:50 GMT
server: cloudflare
etag: W/"0aa10d3f8003fa7c9aaccb32a5177a25"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f216938a58ffe-FRA
x-amz-cf-id: GFJrSYy4_BeZY5i-0pXgtmz-6N0STgZxYXAMx-_xDBPTCHkBkTGGPA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 launch-6cccf53edc18.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/ 438 KB
116 KB 41ms
8ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b1aa700c75bd81ca58d45064234bcbedb61dc77ddd65394a7c739b031b2cdcb3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:24 GMT
server: AkamaiNetStorage
etag: "0da21049f5dc3bb2dcd3d7042ce6cec5:1715106084.352916"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 118721
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 19ms
19ms Script
application/javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a2f825beb3b540a044cdb0515177c34497aa2ce92e335bf1498fa42bb5baf88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Dw6K+rTuf8kOuPIEBw1QQA==
age: 30104
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6881
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 06:40:04 GMT
server: cloudflare
etag: 0x8DC6F29B1A99C59
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 0ca4e475-001e-0088-1962-a1f9b0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216a5b49bb79-FRA

GET
H2 200 zya3koo.css
use.typekit.net/ 3 KB
915 B 493ms
442ms Stylesheet
text/css 2a02:26f0:3500:16::215:1493
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/zya3koo.css

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1493 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

nginx /

Resource Hash

d1c90bd20c04adf24d97ff015095058b528a293e12533fcc37a6f4b61970785e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
date: Thu, 09 May 2024 05:01:15 GMT
server: nginx
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 692

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 218 KB
59 KB 24ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://.google-analytics.com .google.com;style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' https://.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 09 May 2024 05:01:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57845
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=6, rtx=0, c=12, mss=1326, tbw=2766, tp=-1, tpl=-1, uplat=0, ullat=-1
pragma: public
x-fb-debug: AJb1+IYgHk5L5Vvv1OdWpxcZgsO6/jw9pIQAvHwn1IZWfJLCi9eR9mIFn787WkAi5kxM9NFvXmgVZsHzvI2FiQ==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 207 KB
75 KB 42ms
20ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0351efa95fd4f68ead466b96016e7f9cdac4de6adbe6e938c308e19688364c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76414
x-xss-protection: 0
last-modified: Thu, 09 May 2024 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 993 B
2 KB 49ms
28ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c443dbf6031bb78343d0bc46b1b1375e6311497b72ed843c89fedb018e5963b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
origin-trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 bee15b7c-b632-450e-9003-9c8b60b3b978.json Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/ 5 KB
2 KB 43ms
27ms XHR
application/x-javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/bee15b7c-b632-450e-9003-9c8b60b3b978.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

384ad6c5085d773700ca45bd99e00f40335779afc64e4715cda26ea57aecfce8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 41746
content-md5: PFk9Sm6GkrwJIyuXlA1ktw==
content-length: 1760
x-ms-lease-status: unlocked
last-modified: Tue, 13 Feb 2024 15:51:07 GMT
server: cloudflare
etag: 0x8DC2CAB97E97B9A
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7bc3088e-701e-0035-0e94-5e5597000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216a9a661d9e-FRA
expires: Fri, 10 May 2024 05:01:15 GMT

GET
H2 200 950083805267950 Show response
connect.facebook.net/signals/config/ 6 KB
3 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f084:d:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/950083805267950?v=2.9.156&r=stable&domain=www.crowdstrike.com&hme=c3a545c63044e8e9102d4f32d84a1137594d024f28e801d670bc76dc5c075575&ex_m=67%2C112%2C99%2C103%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C158%2C161%2C172%2C168%2C169%2C171%2C28%2C94%2C50%2C73%2C170%2C153%2C156%2C165%2C166%2C173%2C121%2C14%2C48%2C178%2C177%2C123%2C17%2C33%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C100%2C102%2C37%2C101%2C29%2C25%2C154%2C157%2C130%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C39%2C34%2C80%2C2%2C35%2C60%2C40%2C98%2C43%2C75%2C65%2C104%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C105

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:d:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

15e5e119a6cc35c5d0ac09790842740d42ce39a8f4a7db088198d39e95bdec1f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 09 May 2024 05:01:15 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2435
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=11, rtx=0, c=62, mss=1326, tbw=63266, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: KEU6YdDXWvTCDcoHRlmv7/vPxfvRIFq2UUTflHo9b+3S2gtF5MFOp4MRCvGG7G831Dyw/MiF9KlubBC+SmRVpw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 66 B
303 B 88ms
69ms XHR
application/json 2606:4700:4400::6812:2089
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
accept: application/json
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 880f216afe2f9f48-FRA
access-control-allow-headers: Content-Type

GET
H2 200 p.css
p.typekit.net/ 5 B
172 B 61ms
14ms Stylesheet
text/css 2a02:26f0:3500:16::215:148b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=zya3koo&ht=tk&f=39496.39498.39500&a=30979937&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
last-modified: Fri, 23 Jun 2023 17:09:47 GMT
server: nginx
etag: "6495d1db-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 354 KB
114 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZKTET1D58V&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

92ce9b7eae17ae621370ed9e105d3360affd18431e0c100c76acac7621739a21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 116195
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 354 KB
114 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-797629828&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-12037336&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ba71eb07a002e99f2ad394a63e255c6b82739c48b39acf0460248c002c835d6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 116220
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/178de1f2/www-widgetapi.vflset/ 215 KB
67 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/178de1f2/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

07cd8a0ea2b5b9fa0845c4f3a17ba1c634b7404c92f8c18012a8d933f59f26a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 04:27:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2005
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68217
x-xss-protection: 0
last-modified: Tue, 07 May 2024 04:18:47 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 09 May 2025 04:27:50 GMT

GET
H2 200 free-trial-content.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 334 B
506 B 31ms
30ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/free-trial-content.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-free-trial.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d871b6771dfa1a9115eee87e6dbb038d19387e11f27904622a56ff9bd4d2b84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 88fd4dc311317996718ed4ed98e5cbda.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: gNqYXVrwn1mJuDlLzIC67C5djLIJhWel
age: 1252
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:52 GMT
server: cloudflare
etag: W/"d13c1d173c9555b867c53fc3779c2543-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59b68ffe-FRA
x-amz-cf-id: MFKBt0lo-7liVhT0-shSkUBAFsgFmuWCOkl3E3QESfDqEaZV_VDpNg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 categories-all-info.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 1 KB
672 B 32ms
31ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/categories-all-info.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ec4ce4e4230709219ab33c29136a83b12cbaf54388098424a18d63ee6fe7286

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e9b74ccbde368a1365608891aeccb498.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: ZXgZ_FNefDMhJTfUlotbKC1z9IYuc9Hv
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:51 GMT
server: cloudflare
etag: W/"affa682b79c28663edd1fe69c7c2ea2a-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59ba8ffe-FRA
x-amz-cf-id: _uXNcFOLOkLX2E3xv-Hfg3im2tX46sobPxuQZDKqbDxRj_YpmSIyeQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 footer-social-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 605 B
464 B 35ms
34ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-social-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c847dce1cd0746b8168211b5b9b41c397aff2b4d94e3eaeacb41eb572ef6b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6ca8e27dbbf453f10039db7154486394.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: LHP4rSM6DYhUJSqpGjX4O2hcQO.TenI0
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:49 GMT
server: cloudflare
etag: W/"4b2342e2bee8e0a62854c6b97a5e430d-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59bb8ffe-FRA
x-amz-cf-id: CWr2bt-k0l_LqA2ZqKk_2H0o1zdvs9by8VGn-2c2XaHPphhtBcipCA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 sidebar-free-trail.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 159 B
359 B 40ms
39ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-free-trail.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d6a8b2d8de96a693a7f089ff23c3f7aa66ed14718e0d4464a1df1ffb828c8609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 9ec406dc5379d974fc3d9f41dd497bf0.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: aJcexxLEpU4hpo2af0oS40HIx0HOTHoo
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:27 GMT
server: cloudflare
etag: W/"df1b037e9cbf2d8045e53137b1055ebe"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59bd8ffe-FRA
x-amz-cf-id: iYj0qwSbv-VHc469OEYXIUxKgjy4Wm3zNQm5_xo8MskzU0WjTihHkw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 sidebar-featured-articles.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/ 4 KB
2 KB 33ms
32ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/widgets/sidebar-featured-articles.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c69b1157201ef74f0637c6f06440680d3cd108ca73c825661925ddd891ec3d7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 99a0678067c9afa5ffc6dde34b960d40.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: qLs9Mr_yuj.3g6CC1s6Nhc8rViX5wMxf
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:52 GMT
server: cloudflare
etag: W/"791647caa8aa63e2c545fc8cba174511-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59bf8ffe-FRA
x-amz-cf-id: GtwD6Rnys3az5A0Jo8umx11KCotx8wG_Fd5SVzUTerIGzm9c8KIijA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 sidebar-subscribe.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 178 B
385 B 35ms
35ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-subscribe.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b93680a9f50608d09c147af33f3e897a4b376ff3efb696bb062ed2e0f862d819

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 444bee00bd8f759506e806be3c13fa6c.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: IwajhwTRtz4un4UZu0xIWiyCfCgLYo35
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:27 GMT
server: cloudflare
etag: W/"1fbd7b14b1667df99fa1837a82639ee7"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59c08ffe-FRA
x-amz-cf-id: SPkgmKuf-AGPTNvIXZGoHEir68IouTa25qYh_wAG4-VFBcqccbBj3w==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 sidebar-demo.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/ 345 B
471 B 38ms
38ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/sidebar/sidebar-demo.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-category-sidebar.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52b269545d8b0251f5f585cfa9572691d8d50a4a55ddcd6c5dd4e5718136e4f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 96f7375d4633bdc30f727db82897e3b4.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: H5qAxEG7mvyT59t3ARxwRx7xZFS4bWpB
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:27 GMT
server: cloudflare
etag: W/"4d636d45eeb8585ade6681163017cc09"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59c28ffe-FRA
x-amz-cf-id: 0MIKLj1WzBmMJ3uXROe4vvHcK1FP1QHIo9yKhgG7Xd28O_PCN9wNlg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 addsearch-ui.min.css
cdn.addsearch.com/v5/ 42 KB
6 KB 7ms
7ms Stylesheet
text/css 2600:9000:26e8:7400:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.addsearch.com/v5/addsearch-ui.min.css
Requested by: Host: cdn.addsearch.com
URL: https://cdn.addsearch.com/v5/addsearch-ui.min.js?key=7737a29b854de71521b1cd72c4118cfc&id=asw_01
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26e8:7400:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ebe1e4135bb845bd442e32f716d10da89f715f890bdfe4b71354edb5c7f17f8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 17:30:31 GMT
content-encoding: gzip
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
last-modified: Tue, 07 Nov 2023 15:45:00 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
age: 41445
x-amz-server-side-encryption: AES256
etag: W/"38b86b391d57228f06ed64ca140efd1d"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: XY2VNBMN4RyZyf2PJ1ZBGhgfeSrtL5vj0F6PKpA5CmNiyiXUeOMhXw==

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v6.4.2/webfonts/ 147 KB
147 KB 21ms
19ms Font
font/woff2 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1409444
alt-svc: h3=":443"; ma=86400
content-length: 150020
last-modified: Fri, 22 Sep 2023 01:46:37 GMT
server: cloudflare
etag: "d5e647388e2415268b700d3df2e30a0d"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uM99bhHnWIQ6MIIk86su9hNL1jKD4uW9t%2BfBhyuVBTJiBLHcW%2Btl5W%2BVeyouj9f95OyzgtO%2FwBr%2FImD3lEnNezXjHh%2BQ74V4g6Gp6RlRrzHp6p1OA0N2Snt7Zc2bm7iZt8Apr9A3sdgIhos01Oyvl5ep"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 880f216b987037d2-FRA

GET
H2 200 l
use.typekit.net/af/28f000/00000000000000003b9b2048/27/ 23 KB
23 KB 64ms
18ms Font
application/font-woff2 2a02:26f0:3500:16::215:1493
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/28f000/00000000000000003b9b2048/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n5&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1493 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: b332a3fa616df968bdd71567cde2fe6031561746f6022d06993bde4001ec2730

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
server: nginx
etag: "5d5df1b25290dc82b22a668f0395604299f16750"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 23176

GET
H2 200 logo-red.svg
cdn.addsearch.com/v4/assets/ 4 KB
2 KB 9ms
8ms Image
image/svg+xml 2600:9000:26e8:7400:a:de52:1580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.addsearch.com/v4/assets/logo-red.svg
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26e8:7400:a:de52:1580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bee78f076d7ef9d9be92fb1f293909e529c5b61891a52557d51e7183971e02cc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 17:21:49 GMT
content-encoding: gzip
via: 1.1 5d59ec457bae9e2b9df45a357eeeffd2.cloudfront.net (CloudFront)
last-modified: Mon, 27 Jun 2022 06:28:24 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P10
age: 41966
etag: W/"8c2b9e4242eb4f2a16941b1de3656f64"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: S19y_kQRomULk3dlPmMuNNxh_GZRKPF578dj_JoxbIWSL_gdLFgHAA==

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/ 430 KB
105 KB 23ms
23ms Script
application/javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6972c49e66fe3c5026a1a1e26a06c49995cec36fc522cb56461f5cf0b2b2978

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ekgyiOgvSPjNzcyXVUS11Q==
age: 39619
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 106739
x-ms-lease-status: unlocked
last-modified: Thu, 07 Mar 2024 11:26:28 GMT
server: cloudflare
etag: 0x8DC3E996ED117D9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: e31c6377-501e-009b-7f34-71f886000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216b8c27bb79-FRA

GET
H2 200 footer-social-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 605 B
0 1ms
1ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-social-nav.json
Requested by: Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8c847dce1cd0746b8168211b5b9b41c397aff2b4d94e3eaeacb41eb572ef6b0b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
via: 1.1 6ca8e27dbbf453f10039db7154486394.cloudfront.net (CloudFront)
content-encoding: br
cf-cache-status: HIT
x-amz-version-id: LHP4rSM6DYhUJSqpGjX4O2hcQO.TenI0
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:49 GMT
server: cloudflare
etag: W/"4b2342e2bee8e0a62854c6b97a5e430d-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216b59bb8ffe-FRA
x-amz-cf-id: CWr2bt-k0l_LqA2ZqKk_2H0o1zdvs9by8VGn-2c2XaHPphhtBcipCA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 forms2.min.js Show response
go.crowdstrike.com/js/forms2/js/ 199 KB
67 KB 164ms
23ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.crowdstrike.com/js/forms2/js/forms2.min.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 23 Apr 2024 04:13:58 GMT
server: cloudflare
age: 2457
etag: "340e11-31af8-616bbc873ed80"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 880f216c7f121e4d-FRA
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 marketo-forms.min.js Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/ 29 KB
10 KB 36ms
35ms Script
application/javascript 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/marketo-forms.min.js

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d43f14e95f58559c890af8404c7ce4ac13dc55c50868d8bb7941fdb68bcb94c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f2a51982e289d888963f4f93b48c5f22.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: fJP5cE7yuky0qEtszE1cPlE13qkVO9K_
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:48 GMT
server: cloudflare
etag: W/"a221e78ffa0ac9978ca2a58973e9896b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 880f216b99f18ffe-FRA
x-amz-cf-id: FIDHzhAOJIask5UnrQUXe1-e89Tqxq2iU8r8hvrywlQ461t4lh5EIQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 widget.js Show response
cdn.userway.org/ 2 KB
2 KB 49ms
6ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widget.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: d9fd01231f7ed666f18f59b6b63884a142f7575c577369d8e26693eab528d77f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:15 GMT
via: 1.1 6ee47dd27ca379a812104b559e9a5a22.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 910
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 775
x-accel-date: 1715230100
x-77-nzt: EgwBw7WvDgH3BwMAAAwBisclxAH3CQAAAA
x-accel-expires: @1715233700
x-77-age: 775
last-modified: Tue, 07 May 2024 09:31:14 GMT
server: CDN77-Turbo
etag: W/"957345a0548a7658da78197ffae2394d"
x-77-nzt-ray: 908339302894cc139b583c66599fef1d
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=3600, public
content-type: application/javascript
x-amz-cf-id: fmx6Ik5FM6FU_dMaIzt5q77lNnQUhiQbSdQ5oiim9ZyRyr-ifMT_Jg==

GET
H2 200 l
use.typekit.net/af/8a200c/00000000000000003b9b204a/27/ 24 KB
24 KB 23ms
20ms Font
application/font-woff2 2a02:26f0:3500:16::215:1493
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/8a200c/00000000000000003b9b204a/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1493 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0f9c2ce6f85c93eed9e3e0917378e13d9ecc30b3690a2c97f9eb013b81244f4b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
server: nginx
etag: "98e94e3a4f18a4bde13fe394b9115dd62fc5445b"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 24452

GET
H2 200 l
use.typekit.net/af/d562ce/00000000000000003b9b204c/27/ 25 KB
25 KB 23ms
20ms Font
application/font-woff2 2a02:26f0:3500:16::215:1493
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/d562ce/00000000000000003b9b204c/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/zya3koo.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:1493 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: nginx /
Resource Hash: 0bf90a8569ed246ad28d91458f6771f6934a0c4983243eca5f6accf91d6979cc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.typekit.net/zya3koo.css
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
server: nginx
etag: "79b73a8b60023503d1f34e07b81f37976902b3f9"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 25780

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v6.4.2/webfonts/ 107 KB
108 KB 15ms
14ms Font
font/woff2 2606:4700:3037::ac43:8ef5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::ac43:8ef5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://use.fontawesome.com/releases/v6.4.2/css/all.css
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1420456
alt-svc: h3=":443"; ma=86400
content-length: 109808
last-modified: Fri, 22 Sep 2023 01:46:37 GMT
server: cloudflare
etag: "005c9aa92b564b73b7582cc4f1fa49cb"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nhTTmi4YW7REzuWnvlbQeIvwjNsIeIDqwqJ1JVJKkHup%2BGiF1%2B56SHyLpNuMeUK3DvwfQPZIHAI0U1TopIgcaUKiCd4Jqx8U5tCPB04Q7VUlj%2FXUL6s6ZUEGnOiBxGmP03Jry6if%2FWmvEOe2fn5iwvkd"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 880f216bd8a737d2-FRA

GET
H2 200 Fatman-Light.woff2
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/Fatman/ 17 KB
18 KB 29ms
29ms Font
font/woff2 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/Fatman/Fatman-Light.woff2

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cc6addb827a2a39237154916d2a692464bceb44dc7bd73e7cdeb7150181615b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f59e52adbf3a58a76dec03547cb4b34c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: o4W_JbItmXXh4YLYnV4bhI97J8OErCcj
age: 2118
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 17736
last-modified: Fri, 03 May 2024 15:22:28 GMT
server: cloudflare
etag: "85db19d40add135904a6215a2a29ef38"
vary: Accept-Encoding
content-type: font/woff2
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216bda1a8ffe-FRA
x-amz-cf-id: MTLtTcUV4OquW5cvoJaR90Ub7-ToHk4x7MsJL_mg_mfxAHAOf232cA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 crowdstrike.ttf
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/CrowdStrike/ 82 KB
47 KB 31ms
31ms Font
font/ttf 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/CrowdStrike/crowdstrike.ttf?sfjo45

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9f9f09220578095d79ded54e8c0ee6ef21bc38e86475d2645b8656bbef22bbeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: jQ_91ALya34NaotAjqAvJs3t2Z_xo4gt
age: 2118
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:27 GMT
server: cloudflare
etag: W/"ad87bba53a140fc17152a36f87a03f2f"
vary: Accept-Encoding
content-type: font/ttf
cache-control: public, max-age=14400
cf-ray: 880f216bda1c8ffe-FRA
x-amz-cf-id: ZD2EECBhg0ku45RgsG1Z7hzWp9sYG_-XlLdpVpu0STMcZUFfs4OH2g==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 promo.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/promo-json/ 11 KB
3 KB 38ms
32ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/promo-json/promo.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/theme-scripts.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c0f88c76542a810095f923bfb2190343461e4809e37ba46c4805c1fe4ee9307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 21f03f5333352c6494e837ba1b3bb6ce.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: Qe3PcflK2GG8pCz12jEB3xgbszZ7l_xK
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 26 Apr 2024 21:17:44 GMT
server: cloudflare
etag: W/"ff3c503477e49e60cb3722cf06e2aecc"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216bda158ffe-FRA
x-amz-cf-id: nZSHmkmqfzdL3gqCvL1DiZnNXRwj2ZwVHdSdGPR6kGq2CgUzPk5MPw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 RC5910e49187214b008804185231e5dd78-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/ 4 KB
2 KB 8ms
7ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/RC5910e49187214b008804185231e5dd78-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 27ac6f95e059494054ce94aedba1dc9f05a0b4b299c57a7ce7cad5bb202c0b00

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:29 GMT
server: AkamaiNetStorage
etag: "cf4b8194ccec67f24f91df8ceb320644:1715106089.87901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1348
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 blog-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/ 70 KB
6 KB 42ms
41ms XHR
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/data/blog/blog-nav.json?ts=1715230860000

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/blog-navigation.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

400fc41defa4e25e79e0bdf645c0317ef1aac5b65879eb6572ea9cc60c5f1a5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8006f736d3dc32a20a91813f2f50fa2.cloudfront.net (CloudFront)
cf-cache-status: MISS
content-encoding: br
x-amz-version-id: lm5vaxbQRB8yvPh4hMOuEyZJH3MujNJ.
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:50 GMT
server: cloudflare
etag: W/"426bc96f0fc0fb3c73d34a559471c541-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216bda178ffe-FRA
x-amz-cf-id: iq5kRRv--lTvNwB0TFppldJ6eFtezhCbUuUQIFFLKJFBOtShIM8wXw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 breaches-stop-here-post-cta.jpeg
www.crowdstrike.com/wp-content/uploads/2021/07/ 17 KB
18 KB 30ms
29ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/breaches-stop-here-post-cta.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8e0c9ad71fdf2b8553461659e37cfbb453a5a569c5f8c67273cded5fc9e0d2ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d8006f736d3dc32a20a91813f2f50fa2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: aPnhXcSd19qyXFMnDtLV9aa66s2nMfzf
age: 5018
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=17921
x-cache: Hit from cloudfront
content-length: 17580
last-modified: Mon, 21 Aug 2023 21:48:07 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "d954c6a287707fc4afac139378aae270"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216bda198ffe-FRA
x-amz-cf-id: _POMwX5uATs0pC4kwfSG6vzbzdtpab2-_i_LZaoOuRznBF3KUKIoXw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 red-falcon.svg
www.crowdstrike.com/wp-content/uploads/2021/07/ 4 KB
2 KB 32ms
32ms Image
image/svg+xml 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/red-falcon.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f8f105a0a91843bdeac95e6aff14d7753ca2aaff00c942cf1bcb1da1025cff4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 aa393156633f77c48a95484592ea7686.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: TcFqfoqw60gqGStaXtVlISxjk.DdUyRi
age: 5017
x-amz-cf-pop: MXP53-P2
x-cache: Hit from cloudfront
last-modified: Mon, 10 Jul 2023 19:37:50 GMT
server: cloudflare
etag: W/"2c1e9eeb3990af43e758701889df354a-1"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 880f216c2a4d8ffe-FRA
x-amz-cf-id: kuvB0ow_8w1IrsJoMGnm6cZ2SN7Uez2vpxNMPbBuHU50qV59pZYCbQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 CS_Free_Trial_blog_300x600_final.jpg
www.crowdstrike.com/wp-content/uploads/2021/07/ 34 KB
34 KB 32ms
32ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/07/CS_Free_Trial_blog_300x600_final.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

04466026773f10391f6d0d84d702b9eef45db6438822b4edcd931cf5cc89d2d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 07dc9b17b30dcc449c3f0b2ee0f2372c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: EJ_aFabM3o635qgcr2FEa3Hy9LQEbmwv
age: 5018
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=105065
x-cache: Hit from cloudfront
content-length: 34443
last-modified: Tue, 23 Apr 2024 16:41:04 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "11edcc35473c47fabaa1e19b2f186d08-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c2a4f8ffe-FRA
x-amz-cf-id: 5Nx_osQ6EhWZWvMAFK3pUdThk3OtODN4kHvtv-0y6y3gTj2W0oQUng==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 23-m-156_cloud-security-icon.svg
www.crowdstrike.com/wp-content/uploads/2023/11/ 3 KB
2 KB 34ms
34ms Image
image/svg+xml 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/23-m-156_cloud-security-icon.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dcb4b8f8926bf46fb35389caec38cf06c566048372f67646d40efce85e24346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1708658992
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: NgaaV.iMDMt9O0hbFenuhjLV.LzdMed0
age: 16117
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Sat, 20 Apr 2024 03:08:00 GMT
server: cloudflare
etag: W/"ad1aee8fa1ac90ea74a166f24797a258"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=31104000
cf-ray: 880f216c3a528ffe-FRA
x-amz-cf-id: zQyP8OJ5Yyc1doaBZElaHbRHYo063K7mbn1ho3t7jtokRlOQQlv_ug==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 24-OTH-053-new-blog-category-options-final-300-dpi.png
www.crowdstrike.com/wp-content/uploads/2024/03/ 25 KB
25 KB 46ms
46ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/03/24-OTH-053-new-blog-category-options-final-300-dpi.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e47442c7c2965e8f0bc4b6fac7647f64bf93d1e468f88adf18cdd651713b5fae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/pages/single-post.min.css?ver=1708658992
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 dc468f8259c800daf36aec7b41b2dac8.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: dS3WSOANA3Xjr8pa.c0Q.SL8D0s9wO6G
age: 16117
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=79900
x-cache: Hit from cloudfront
content-length: 25096
last-modified: Sat, 20 Apr 2024 03:01:17 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "f8eaaa036b0a0a864cac0d683905da82"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c3a538ffe-FRA
x-amz-cf-id: HkONOUf4eNoqARnya7EMtDrFfgbjHcgEw40gMbXrRUWHpHsRSIwV7Q==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 itcavantgardepro-xlt-webfont.woff
www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/ITCAvantGardePro/ 26 KB
26 KB 59ms
59ms Font
font/woff 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/fonts/ITCAvantGardePro/itcavantgardepro-xlt-webfont.woff

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f1c1c319dae1d32ef2feaa657e6d82c5f8fe4c98aa8bbc7ee0aab8b5b9d5d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/styles/theme-styles.min.css?ver=1708658992
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 dc929648f0c936ae1fcea0675ad0382c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: NiPxCCXXx3db32GETtlvzayC6AbzQmga
age: 232
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 26532
last-modified: Fri, 03 May 2024 15:22:30 GMT
server: cloudflare
etag: "97e5d80225ecf45f6488b9f660ecfd8c"
vary: Accept-Encoding
content-type: font/woff
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c7a998ffe-FRA
x-amz-cf-id: DsbqtuPI5JA2oOJ9iIVTbyl8qTr-2STyA2N_AaOfORZI-IbIFe1xHw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 RedLogoCS.svg
www.crowdstrike.com/wp-content/themes/main-theme/dist/images/logos/crowdstrike/ 6 KB
2 KB 61ms
56ms Image
image/svg+xml 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/images/logos/crowdstrike/RedLogoCS.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74a8d08bfffcc2b091168ebe5d30299c4857f962280f3b214ec64f460587b4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 56df5811b9d89103539b9b0b5fd9b262.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: iGOMJSiv_osPg6n2k5j.v5_j29oTq9xr
age: 3615
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Fri, 03 May 2024 15:22:41 GMT
server: cloudflare
etag: W/"81ee08b1302889572e1a229ba2a2029b"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=14400
cf-ray: 880f216c5a658ffe-FRA
x-amz-cf-id: 2nx-TwJcSlRYR4z2XNsVy-KbJY6JxDZPCWncuP5malDAvBwvHpY_QA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0524_01_RSA-Cloud-GK-MS.png
www.crowdstrike.com/wp-content/uploads/2024/05/ 6 KB
6 KB 145ms
141ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/05/0524_01_RSA-Cloud-GK-MS.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8de531ed3fc9724c8b33d6a57316745cd501f3d34be28ee570424c936b525b86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0d1be73e3b2e8182cec120b73bf8d5c4.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: _krrz.w5AcbGIJ6fvjBtTxccIZGnEXKh
x-amz-cf-pop: IST50-P1
cf-polished: origSize=13922
x-cache: Hit from cloudfront
content-length: 5839
last-modified: Mon, 06 May 2024 16:54:05 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "d07ae82b6894897e251a63805e00b2af-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a668ffe-FRA
x-amz-cf-id: QYe-qp5_-0VpqHFzE_0gcMfTiFursU1aWffRB6a-v_9YFQKYFgrT-g==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 IDC-MDR-Marketscape_Blog_1060x698_01.png
www.crowdstrike.com/wp-content/uploads/2024/04/ 70 KB
70 KB 144ms
139ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/IDC-MDR-Marketscape_Blog_1060x698_01.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05db34dcf79d4e424f9ce53bd296810b78e0b16ff3f88018d1268cfdf414c4f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 842d85c428fb555387845cac126b76de.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: 666vET__XdNP4iAXpofk1mP9PNH_iXwU
x-amz-cf-pop: IST50-P1
cf-polished: origSize=79918
x-cache: Hit from cloudfront
content-length: 71244
last-modified: Tue, 30 Apr 2024 16:30:33 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4eb26830c8874efe7880038d508a7691-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a688ffe-FRA
x-amz-cf-id: WqIwZfHi8jhbJgeqjB8SxIYbYeDtPGZZs2Dh7ZB0XUepcsPf1XjdAw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 eZg59Nv0.jpeg
www.crowdstrike.com/wp-content/uploads/2023/02/ 103 KB
104 KB 47ms
42ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/02/eZg59Nv0.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

842581d3ebd410d0439e20ea651261cf05f395b3e53d06a6fefecb317725985b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 ed43f95f84873d9e5f85d831904df206.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 4dddMgcLaWwvdOn2vBuul6F6t1iMYCxp
age: 2483
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=116045
x-cache: Hit from cloudfront
content-length: 105935
last-modified: Tue, 23 Apr 2024 18:08:31 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "e5b34d144fdb9ef173748aa2d2859212-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a6a8ffe-FRA
x-amz-cf-id: leCoqc_gX4tVn9BIS9VzrVufLQzC2Ulf27_D7rwd47CgJVjHPI0uXw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2024/04/ 64 KB
65 KB 79ms
74ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83342c6d1e4b839f96cd1eb5c48bb78db500c6ebf0ae67b62a599c03e815d662

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d0a36dbd6f5cc87855296f2852cab3ec.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: ZvR_K.H77yXspOqyXUJ_sOQjIs9BaO.e
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=76202
x-cache: Hit from cloudfront
content-length: 65994
last-modified: Tue, 30 Apr 2024 18:09:36 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "8cbb31e9cfb45bfe1a87d4f5f2d17247-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a6b8ffe-FRA
x-amz-cf-id: SjQilj6p8KveeeUkls3CIdrNfRF6vPANT92w0bhcm54Wfwczai5euw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0222_03_Falcon_Platform_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2022/02/ 23 KB
23 KB 45ms
41ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/02/0222_03_Falcon_Platform_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4909664b2cd227fc85ce6fd9d530ec41bef8528f31af916ba9ed95a2cb230823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 f2a51982e289d888963f4f93b48c5f22.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: lPcEIOhyLune5I0qvDFpICDBhNijw.lq
age: 3352
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=96931
x-cache: Hit from cloudfront
content-length: 23201
last-modified: Tue, 30 Apr 2024 16:30:26 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "a8826c5d8fe6f92d156adfc33de6387d-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a6c8ffe-FRA
x-amz-cf-id: xXxF_lIoqzSm6NEYgSdiT3Nce96t_dUwWchiXxraDBt9JhUMkJnYAg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 IR-Video-Blog-1.jpg
www.crowdstrike.com/wp-content/uploads/2019/12/ 14 KB
14 KB 59ms
55ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/12/IR-Video-Blog-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e36ce51df6d05a63225d449ba07b002ef1c2cd73b946e21e27456b251449712b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e7901684d85170d527aec3a64956def6.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: nbdAY4DJBodYlrtDuuY4xz8e9cBFgrB0
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=60108
x-cache: Hit from cloudfront
content-length: 14351
last-modified: Thu, 11 Apr 2024 05:03:07 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "96e7d13e7744d7a668c204a2d141f878-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a6e8ffe-FRA
x-amz-cf-id: 9-1vophwoYiwYlZCXGdHxkVH8r9D5zi4BuYxQdlEE6n2tKMa4YYM-w==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 video-ATTCK2-1.png
www.crowdstrike.com/wp-content/uploads/2019/01/ 253 KB
254 KB 47ms
42ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2019/01/video-ATTCK2-1.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b5139a4d5589798c94dce13e6aab1a0c1d438d43e30de6ea0c16ec4dfa16432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6dcc6937cfa978a65f9d5d75296b24a6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: X9FDjy5wtgPs.AJzugOsazBj_PpP2gbE
age: 2482
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=283973
x-cache: Hit from cloudfront
content-length: 259317
last-modified: Thu, 11 Apr 2024 05:03:08 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "6e08b90e0bdd132d24324963245f811d-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a708ffe-FRA
x-amz-cf-id: Oh7a0uAwUD95JvL7rqcfv2Sdnc2WS8caMD3biSDSMWrpWw3uEcEmtw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Edward-Gonam-Qatar-Blog2-1.jpg
www.crowdstrike.com/wp-content/uploads/2018/08/ 21 KB
21 KB 154ms
150ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2018/08/Edward-Gonam-Qatar-Blog2-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acd5a461e585b6daebe6b512b1b486c58859a51db413c98ae041881a0641bfc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e9b74ccbde368a1365608891aeccb498.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: rtYne1zzQZOf08mRT67e53BUVebBO1g6
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=93166
x-cache: Hit from cloudfront
content-length: 21432
last-modified: Thu, 11 Apr 2024 05:03:09 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "09a35cad8fef9a1381967287e350fbdb-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a718ffe-FRA
x-amz-cf-id: 35kDsrZRHpdOJCVsAhPA-jY-JY_AiPIYepTvBDIpyqELqNbSNuUJyA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 TSA-blog_v1-1.jpg
www.crowdstrike.com/wp-content/uploads/2023/04/ 397 KB
397 KB 145ms
141ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/04/TSA-blog_v1-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

36c366753aa6b7728f8e7e6bfee5ef08beead5e81f66a2a5a37d66397c62e90c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 21f03f5333352c6494e837ba1b3bb6ce.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-version-id: u4.q4Q7ZGD_Dm4tG.oT2_XWJbnbSGGjF
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
content-length: 406252
last-modified: Tue, 23 Apr 2024 18:08:36 GMT
server: cloudflare
etag: "2bf951336c67d54908e3bf23a91b2f55-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a728ffe-FRA
x-amz-cf-id: vLFtG5qsOsSE2cdyWDmTqJilPswZiNMxDxmLNb1DoOqQ1CN6RCNK0A==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Google-Cloud-blog-main-image.jpeg
www.crowdstrike.com/wp-content/uploads/2024/04/ 206 KB
207 KB 50ms
46ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/Google-Cloud-blog-main-image.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6fef5b62fd9d623df26be0846ccfaf8dcf3625a427fd6cbf8d3630db1a869627

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e52bcf1348d845bf9cba26a32bfa6366.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: nIRZeLv9HY.LnXedFB878zn5JAijntUk
age: 2483
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=839932
x-cache: Hit from cloudfront
content-length: 211173
last-modified: Tue, 23 Apr 2024 18:08:37 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "690ad6a7c4436358a884c456a832039e-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a748ffe-FRA
x-amz-cf-id: GU52EcpaRUemhYksrwgdIQXXh8s5eRDMGHK_8har6K3SiOTVKwNqIg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 AppSec-blog-main-image.jpeg
www.crowdstrike.com/wp-content/uploads/2024/04/ 135 KB
136 KB 42ms
38ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/AppSec-blog-main-image.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08f07cdbd7f53f837d4dc69b6c619efc1b2a8daf0324533e1e385a65fc25a269

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8cf15674907b671b603aab6ae6d0f70e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: _8mehlnZ.o2OB.oWQMdotLGpHr4sagGI
age: 4904
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=141445
x-cache: Hit from cloudfront
content-length: 138668
last-modified: Thu, 25 Apr 2024 23:41:57 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "49c3a96717cfbf026999766d9918d3ae-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c5a768ffe-FRA
x-amz-cf-id: _9UimssvlKxIr_JXo9K2xxSgfqqDVI_COROwEcZ-GzQwqZ-p8MqBzg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0424_01_Protecting-High-Profile-Employee-Info_Dark-Web.jpg
www.crowdstrike.com/wp-content/uploads/2024/04/ 92 KB
93 KB 53ms
49ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/0424_01_Protecting-High-Profile-Employee-Info_Dark-Web.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e9afb228584852481bf1ba4429809bb248c8c8ae703086bcf60c2bff4799bf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 dc929648f0c936ae1fcea0675ad0382c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: CoYGqH_Tf3EvGF7CAZS245WKzQjQzq6T
age: 16117
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=381919
x-cache: Hit from cloudfront
content-length: 94709
last-modified: Sat, 20 Apr 2024 03:03:22 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4fb71bab826f1bccfdd15bd72fe68f3c"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c5a778ffe-FRA
x-amz-cf-id: ReNa9Bt9mmXkGzJoxb0Hc7kw0zsbQRW2hSb-AVVCtc5iZIvZAK6gqA==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 0224_02_LATAM-Malware-Update.jpg
www.crowdstrike.com/wp-content/uploads/2024/02/ 171 KB
171 KB 86ms
83ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/0224_02_LATAM-Malware-Update.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c9b70899317b4f9929f9b5cf67a0d4400c02cf537e74cc6dd89cf2a507d9a241

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 2484a98c2bb72ea475d1dedc9738ceda.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: heXY07HWCKJGLPjVlOubBZP9glYpYDtJ
age: 16118
x-amz-cf-pop: FCO50-C1
cf-polished: degrade=85, origSize=602905
x-cache: Hit from cloudfront
content-length: 175019
last-modified: Sat, 20 Apr 2024 03:00:32 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "e491a85442ca3003c9c7237bd43c72c0"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a7c8ffe-FRA
x-amz-cf-id: m8Z7DAKB2rAvRbWoLxNC6CtG6TYoYx1DVOIV__KHRl81E7FBPUZNzw==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 GTR_BlogImage_1060x698-1.jpg
www.crowdstrike.com/wp-content/uploads/2024/02/ 87 KB
87 KB 75ms
71ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/GTR_BlogImage_1060x698-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5664b220d6d29f411a49a186aa9bf5b5ddf366861ea50c1259402adef251e91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8cf15674907b671b603aab6ae6d0f70e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: yQolcLx55eqaSke3IBBIUSNK.PGAMuMV
age: 16495
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=106997
x-cache: Hit from cloudfront
content-length: 88706
last-modified: Sat, 20 Apr 2024 03:00:48 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "8abf62a4083103ec76baf13bb6060d15"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a7e8ffe-FRA
x-amz-cf-id: 8p-gL-Zf9DnJxLMFq1p-sTDPy4BDOnONyIzAzzqkg0dtoL13HFHsYQ==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 1123_08_Insider-Vulnerabilities.jpg
www.crowdstrike.com/wp-content/uploads/2023/12/ 92 KB
93 KB 50ms
47ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/12/1123_08_Insider-Vulnerabilities.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6dee6c73c3fffab45a1d559044b3806b79ce98c1370945608a1121f3badea14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: rCy.p.jWVh1ysXaA3ny40Ws9mPbOsJwS
age: 16118
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=422581
x-cache: Hit from cloudfront
content-length: 94294
last-modified: Sat, 20 Apr 2024 03:08:20 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "7aa08aae96f17829f6cc7c9219e787ca"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a7f8ffe-FRA
x-amz-cf-id: 2GBERYNZd3KsKeOwCVG7d19V3Z0wlx8v0IcgO7Lljl2N3BnK1m5Jzw==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 0424_03_Falcon-Fund_Nagomi.jpg
www.crowdstrike.com/wp-content/uploads/2024/04/ 85 KB
85 KB 51ms
48ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/04/0424_03_Falcon-Fund_Nagomi.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a6fbab70ed837a9233f08368820c775da5c1ce98be0df60488be3916ec747836

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 b61b5f3c15622d1e1eea9ca8cce9b10e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: Y2yhBoCMHxW9PBPHM1vk.ZuafvMpUupi
age: 2482
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=309153
x-cache: Hit from cloudfront
content-length: 86614
last-modified: Tue, 30 Apr 2024 16:30:34 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "52c401c4dc72563e80ac97ebf6d40361-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a818ffe-FRA
x-amz-cf-id: wRQzhzGN1AFU_PWiPYDi--uSXpeRx1Fcpzd4tThy5jbI-0wwzB8eCA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_1060x698-3.jpeg
www.crowdstrike.com/wp-content/uploads/2021/08/ 252 KB
253 KB 82ms
79ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/08/Blog_1060x698-3.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beed8a77bc3034508e3b5d9b994b14064965d55a39d920e8818afbe93bd75559

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 134eef7df83fe066fda8a86e722c33dc.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: Xf8EKkwzN16LHC0YMeELG_AtwDCVS99Z
age: 3138
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=748754
x-cache: Hit from cloudfront
content-length: 258225
last-modified: Tue, 30 Apr 2024 16:30:35 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "59ac6d1ba2a1ec6db85dc871faac8cee-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a838ffe-FRA
x-amz-cf-id: PiarXGV-8mBPVhZLsdwmvrQZwQpRbgUNmrSSa0q0-l5WGJrvX0tjVw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 XXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2022/11/ 265 KB
265 KB 82ms
78ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2022/11/XXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0f5a20aea350274cc88cc79a153797c6b253aec6a77259467378f0ca2dc29203

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 b08e1d433d62b5ab056680968a8cc7ea.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: .ym9ARqm3hG6EyzhkJILH18NVJLbhy1C
age: 3138
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=810899
x-cache: Hit from cloudfront
content-length: 270962
last-modified: Fri, 03 May 2024 18:21:39 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "566134bd7bd51455c57a56f0e2931258-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a848ffe-FRA
x-amz-cf-id: WsiSYSo47s2tsjl8UCZkKiBuaYgwzYbs9iOGZhC3Q7BEoq421HfXLA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg
www.crowdstrike.com/wp-content/uploads/2023/02/ 187 KB
188 KB 54ms
51ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/02/0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b461442bdf6f086af9023de4b6f909e8b21599229c8a8ba3ae4fc92a5c08a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e9b74ccbde368a1365608891aeccb498.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 2ZI3UfW7QFEI7qn5zqdiJHyUV.7E3Gh4
age: 16117
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=617363
x-cache: Hit from cloudfront
content-length: 191687
last-modified: Sat, 20 Apr 2024 03:04:21 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "ad56c9975f298de4502cebbd095f85f2"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a858ffe-FRA
x-amz-cf-id: XpYsVJu4bVGpfKLiLWezrcyLT16aNDkJWDxfD2iugvpHOtNCPOwW-w==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 0324_01_Flow-Security_Acquisition.jpg
www.crowdstrike.com/wp-content/uploads/2024/03/ 19 KB
19 KB 81ms
78ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/03/0324_01_Flow-Security_Acquisition.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

130a995d67fcc6db4eb38729f7b2d751e4d01b3a0ec2baf598053936fb712e9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0833e8be76641de099b8f4a92c7a1c4e.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: xnpZktO6.pVvDoSuN4uB6AhH5U25wXUf
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=63210
x-cache: Hit from cloudfront
content-length: 19380
last-modified: Mon, 06 May 2024 16:54:11 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "c2d35f578c18ef562d0784f8c190b5a9-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a868ffe-FRA
x-amz-cf-id: Pqxeef6Ue_GO7F-8UGunrhV5Wqb3NRGfavPwNgsoPxKrL5gGz9xDmQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0224_01_CS-Sponsors-MacAdmins.jpg
www.crowdstrike.com/wp-content/uploads/2024/02/ 69 KB
69 KB 56ms
53ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/0224_01_CS-Sponsors-MacAdmins.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e70d87cc646b752a84f80c2035242c4617184c6de87de95aa178c8d3161e9c97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 444bee00bd8f759506e806be3c13fa6c.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: t5DtAnUEp8aqXXLo4Gfzr4w7aPCsQT_0
age: 2482
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=245545
x-cache: Hit from cloudfront
content-length: 70191
last-modified: Mon, 06 May 2024 16:54:11 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "3453dadc0791331f9f4c5f90338cb1da-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a878ffe-FRA
x-amz-cf-id: mxzVhedK4rZOs-3ks2fwVGXGZdZbdeHdVschoC4dbKw1W9Wd2HYV_Q==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg
www.crowdstrike.com/wp-content/uploads/2023/05/ 52 KB
53 KB 74ms
71ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/05/23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62fd61035104aaa35fe90d9fe8cb52aa5bff1c8685b5825862b3a75bc89a5470

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 beb586b594a87825655272217085a8de.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: wCgIQ5e1XWKIGwPw5wsypfdOKKKiLhaN
age: 2483
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=159117
x-cache: Hit from cloudfront
content-length: 53445
last-modified: Mon, 06 May 2024 16:54:12 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "eab16fd8ba31c8b16cf6d42c7972d73c-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a888ffe-FRA
x-amz-cf-id: UaJdRFEr0Sx_2jMAPqHzacF0qGZuAaaFvNiHxYFV833okbA5j89N5A==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_0520_08-1.jpeg
www.crowdstrike.com/wp-content/uploads/2021/06/ 49 KB
50 KB 60ms
57ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/06/Blog_0520_08-1.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

23f86ae2e5fc068cff7f339b994573c23c8799f01acf1b5c097153376bde7ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 47d03277bf0664a678da84ef19658d28.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: fdydh4JB1onSUrvO1oaW0uGpy50CD_T9
age: 2483
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=153874
x-cache: Hit from cloudfront
content-length: 50597
last-modified: Wed, 03 Apr 2024 16:38:05 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "e841e4395058829456592d41d68a2622-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a898ffe-FRA
x-amz-cf-id: r5hElUMFA9klN4bFBj-Orc54lEGDEHEvPZFYmksEr52qKqKjQ0PKVg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 SPIDER-adversary-blog-main-image.jpg
www.crowdstrike.com/wp-content/uploads/2024/03/ 300 KB
300 KB 85ms
82ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/03/SPIDER-adversary-blog-main-image.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21cf396be385b21e8311d96026d57f639323043d2f17f42f6864a615b5fca86c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 134eef7df83fe066fda8a86e722c33dc.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: .h_fCStB071dPfYvUd3y1yQaDaPSzfry
age: 3137
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=1108311
x-cache: Hit from cloudfront
content-length: 307031
last-modified: Tue, 07 May 2024 21:39:14 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "87bc03c762a64cbae95fd154a1b82915-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a8a8ffe-FRA
x-amz-cf-id: b_V64Jb9-_2ty4nmNzFX8hwW9GIQkin97xMvFLux7NtVdncT-jXdGg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0122_03_IR_Tracker_for_DFIR_Community.jpg
www.crowdstrike.com/wp-content/uploads/2023/10/ 262 KB
263 KB 77ms
75ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/10/0122_03_IR_Tracker_for_DFIR_Community.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa242f524a71571952cc44ed52cca22fae9718a281a24a8bd9029b959fbf1261

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 6ca8e27dbbf453f10039db7154486394.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: rkQvAJg6O64Xt782YCFHOCGNoiDx5WcW
age: 16117
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=861794
x-cache: Hit from cloudfront
content-length: 268270
last-modified: Sat, 20 Apr 2024 03:07:32 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "2649ce9f5e329baa21c530273c09b435"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a8b8ffe-FRA
x-amz-cf-id: 5-YmZr702lxZdaOmJEhim0QsrbQpXB5cY-KoT5AUCm20I6DYNEk9Pw==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 23-OTH-060_adversary-5-panda-china.png
www.crowdstrike.com/wp-content/uploads/2023/06/ 292 KB
293 KB 60ms
58ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/06/23-OTH-060_adversary-5-panda-china.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

001be4366308a1bd4a6b8939f8f5228ed510d6994e5087f4b70bd82806a6c103

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cce339e34372cea758a4181fcf4e7c14.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: ERPiPNhUt6Bc70_ua5mkyWsuFFEa6ptg
age: 5019
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=429520
x-cache: Hit from cloudfront
content-length: 299242
last-modified: Wed, 08 May 2024 22:34:26 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "595d23ef3dcb777f3f92bd3dc5ceb7f6-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a8c8ffe-FRA
x-amz-cf-id: TcQCo3UcMenNvgeR4FmlQHWYrXwKkA1nURCOWSZ-PUXY-bhxnwrpmg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 1023_03_Compromising-Identity-Provider-Federation.jpg
www.crowdstrike.com/wp-content/uploads/2023/11/ 19 KB
19 KB 53ms
51ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/11/1023_03_Compromising-Identity-Provider-Federation.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47e481a493d04f026f580970f11202249f511bf8e7d362873a0a14706ffe975e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0833e8be76641de099b8f4a92c7a1c4e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: XKrwab.eMrBAp0A84fv9cR5yy9E9vzoD
age: 2482
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=58737
x-cache: Hit from cloudfront
content-length: 19578
last-modified: Mon, 06 May 2024 19:07:08 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "f0fb34839cfea571c64cea7dc6d83c97-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a8d8ffe-FRA
x-amz-cf-id: qCGVBvpur0EI9nhT_iZ0dBgOfjEufi_493iNQyfq9vy9PVog_NJRMA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0124_02_FalconFund-Partners-with-Aembit.jpg
www.crowdstrike.com/wp-content/uploads/2024/01/ 86 KB
86 KB 83ms
81ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/01/0124_02_FalconFund-Partners-with-Aembit.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9d83005e4063452d9acb302b65af86458855e86d18d882925daf717881bb02a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 2bd32a27a379e75d9a060c8c86489b2e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: 774kgkiYbosjOVYEFqmRLpVtaXA6nHZD
age: 2483
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=312984
x-cache: Hit from cloudfront
content-length: 87773
last-modified: Tue, 30 Apr 2024 18:09:45 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "bd69a0dca2f45f29886e3de77637556f-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a8e8ffe-FRA
x-amz-cf-id: AJDs08ZO5XsuiNIPemtcISmkOWNaO738L68hDm7r_wLbezbCZ1U0-Q==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0222_05_FalconFusion_Ransomware_Malware.jpg
www.crowdstrike.com/wp-content/uploads/2023/12/ 201 KB
201 KB 87ms
85ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/12/0222_05_FalconFusion_Ransomware_Malware.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

912aa1e8380e28a95269a2997c3ddf4ec6ceed1f90df5487ada201c88f96536d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 d0a36dbd6f5cc87855296f2852cab3ec.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: ttFjed.aiO2ybV1vfUMUQSB4IZbpTGkN
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=659573
x-cache: Hit from cloudfront
content-length: 205713
last-modified: Mon, 06 May 2024 19:07:13 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "f17e5c56bc8a786d7dba31c15c3ac698-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a8f8ffe-FRA
x-amz-cf-id: MUOPsxQirPlD0d50Tv05XHPMzCbwshjT5laEAxP4u6Hf-MxtWN_WgA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 0324_02_Next-Gen_SIEM.jpg
www.crowdstrike.com/wp-content/uploads/2024/03/ 182 KB
183 KB 79ms
77ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/03/0324_02_Next-Gen_SIEM.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0e37a51f2ce749817083d5705f9da5d198563ede193b737cbf3446796cb1514

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cce339e34372cea758a4181fcf4e7c14.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: kmauYqCUhDZfswjYfNMR4w8zwWz90oUs
age: 2482
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=558432
x-cache: Hit from cloudfront
content-length: 186694
last-modified: Wed, 08 May 2024 23:32:36 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "78a1ea70c100801e19deb21db541706c-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a908ffe-FRA
x-amz-cf-id: aLXH-4L5k24V_Swgg_-srXKxxaJVT5JVeQSNw6DYYfxk2Q82z_NwSQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_1060x698-2.jpeg
www.crowdstrike.com/wp-content/uploads/2021/09/ 254 KB
255 KB 85ms
83ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/09/Blog_1060x698-2.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bad8b30ab652865aa3436ed59c84c6bfa71ccd25e174dadd792fa09bef62cc59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8bd22c4e977189bdb5963957ff8477de.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: ZxtHZJBwaFXy7PQBYMTLAo4Gj4kCpkLy
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=929436
x-cache: Hit from cloudfront
content-length: 260190
last-modified: Wed, 08 May 2024 22:40:44 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "18d34b7b319565442104264eb7f89ab8-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a918ffe-FRA
x-amz-cf-id: coECEyyaEiekAQdeWkAmrJdIiizlk9WXeCdO14NaKzlSiQQ7uPCYag==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_1060x698-2.jpeg
www.crowdstrike.com/wp-content/uploads/2021/10/ 216 KB
217 KB 167ms
165ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2021/10/Blog_1060x698-2.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c36239bcd80f237805e530e80214ecc5b43821a943bb7aa744bfbaa87c4415f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 933c6a5aa13cc4841a77c34a0db3a826.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: QeyYX25P4mFDBfI06Gs2ZMneaVu7SBFb
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=664953
x-cache: Hit from cloudfront
content-length: 221139
last-modified: Fri, 03 May 2024 18:15:25 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "1789900ad04733812ed89f0015539646-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a928ffe-FRA
x-amz-cf-id: pgQ4jok95RbzfKutp5FJyUnFjNyACoEH-z5o9LBQamLjTKr6VokHvg==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_1060x698-21-1.jpg
www.crowdstrike.com/wp-content/uploads/2020/10/ 255 KB
256 KB 52ms
51ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2020/10/Blog_1060x698-21-1.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0a4b5cd397df6ad5f6061cbc201cd98c9c808119b643f09a4a2e19d7327394a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 85b175d782816d34ed73f9ca030bf062.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: bTHXz9Cu85ny_GwvnwGxcu7RPFIHjL2C
age: 2482
x-amz-cf-pop: FRA60-P7
cf-polished: degrade=85, origSize=926444
x-cache: Hit from cloudfront
content-length: 261166
last-modified: Wed, 08 May 2024 22:40:43 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "676d6f9b9ab970196689c3374ff0694d-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a938ffe-FRA
x-amz-cf-id: 8HJ8TR9BP_C_OQHx_6sojg95SRd5YUA3zTebIMlJwFl3CXjJ5aF5Ig==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Identity-protection-for-government-blog-main-image.png
www.crowdstrike.com/wp-content/uploads/2024/02/ 469 KB
470 KB 88ms
86ms Image
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2024/02/Identity-protection-for-government-blog-main-image.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee5e1d4fe48e41d970d2517df8e4eec977f66a74c6dfceb8895e022bea26e619

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 98845fbd1cb14abbe9d464a4caf17976.cloudfront.net (CloudFront)
cf-cache-status: REVALIDATED
x-amz-version-id: j4iuIpIxYot.1aRruJFHdjzrCXmGmG8P
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=590947
x-cache: Hit from cloudfront
content-length: 480745
last-modified: Wed, 08 May 2024 22:40:45 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "cd5515e94b6ded1fc76e93ce2463dd74-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a948ffe-FRA
x-amz-cf-id: ohFgESownv4Iac2S7c0LEX-rFJkYLsrrn91oi8aRCdgHHSfc9WDXcQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 Blog_1060x698-1-1.jpeg
www.crowdstrike.com/wp-content/uploads/2023/01/ 120 KB
121 KB 60ms
59ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2023/01/Blog_1060x698-1-1.jpeg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e9f39654eac26623ffbf7e6da9953393cd48b8b6e94d41b1a1cc28a6f4c005da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 2bd32a27a379e75d9a060c8c86489b2e.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: AtXL2vCz0z_X3moeXNqT8qTeEF3f5WhI
age: 16495
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=476622
x-cache: Hit from cloudfront
content-length: 123274
last-modified: Sat, 20 Apr 2024 03:04:01 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4b8093ff846f0ecde49e1c5b17fb0182"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=31104000
accept-ranges: bytes
cf-ray: 880f216c6a958ffe-FRA
x-amz-cf-id: hduN-0edtsI676hzAlBXZBwl3w8JhX0oW0Nd_0RROJcoktylkDd7iw==
expires: Sun, 04 May 2025 05:01:15 GMT

GET
H2 200 TechCenter-2.jpg
www.crowdstrike.com/wp-content/uploads/2016/07/ 28 KB
28 KB 54ms
53ms Image
image/jpeg 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.crowdstrike.com/wp-content/uploads/2016/07/TechCenter-2.jpg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0d7247f9a18889ae8a68fd56edaa202264826e284c725ce09964a71d1ee663e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 0c0c1b83147bd3b522e590fc95a19ce2.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: iJgITzyOcIgf.wS29ajDhRSqgHp3A0p5
age: 6014
x-amz-cf-pop: IST50-P1
cf-polished: degrade=85, origSize=111775
x-cache: Hit from cloudfront
content-length: 28432
last-modified: Tue, 23 Apr 2024 16:40:54 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "3fb44700e9a9760adce14063cd8304dc-1"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216c6a978ffe-FRA
x-amz-cf-id: yVR80EnuNgN3OdrEkVoSjC60k75GVnGgcqhWt8GsPyc7dcao02H0NA==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 footer-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 3 KB
846 B 70ms
69ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06adbc033a1a4d6c04306c51945d1661225aa304b703660fd4347e73109802b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 cce339e34372cea758a4181fcf4e7c14.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: qY7yC_p6u2Rg3mUDzbLqb3b_QqwFYvFl
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:48 GMT
server: cloudflare
etag: W/"422f593cb3099a6075480fbde861b7e1-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216c5a6f8ffe-FRA
x-amz-cf-id: Uespohf3ie0I73qAMN1xhkKbvgLrIdHJd3cJr2hG0rFPy4skrKYtQQ==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/b2193cd5-8954-4870-b8f7-b3be5ea49b82/ 66 KB
16 KB 30ms
30ms Fetch
application/x-javascript 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/b2193cd5-8954-4870-b8f7-b3be5ea49b82/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e84d80292bc4853823a35693f016d26ceeeac38e04aee5d286d933b8973b7d7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 84283
content-md5: xaZTIOTutEqwYe5ZTb4YkA==
content-length: 16506
x-ms-lease-status: unlocked
last-modified: Tue, 13 Feb 2024 15:51:18 GMT
server: cloudflare
etag: 0x8DC2CAB9E1369F9
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7679f21b-201e-0028-3f94-5e582b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216c5bcd1d9e-FRA
expires: Fri, 10 May 2024 05:01:15 GMT

GET
H2 200 widget_app_base_1715074136168.js Show response
cdn.userway.org/widgetapp/2024-05-07-09-28-56/ 153 KB
44 KB 22ms
9ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 39d5e6434d7521dce9c650691c620817fe3a13e03c43ead6ad86771f06f5d9e2

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:15 GMT
via: 1.1 603f36cbe39a66d93949b80e7296dad4.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 914
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155609
x-accel-date: 1715075266
x-77-nzt: EgwBw7WvDgH32V8CAAwBnJIhJwH3BAAAAA
x-accel-expires: @1740995262
x-77-age: 155609
last-modified: Tue, 07 May 2024 09:31:09 GMT
server: CDN77-Turbo
etag: W/"a18ac8e6db35cf1874c6c61e7f524afb"
x-77-nzt-ray: 908339308b997c159b583c666cc3de24
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: KWB0q0y8NoCbxsI1mjhLej6r8Ou_pl146AGuC00UmZkhAnzxoCenTQ==

GET
H2 200 RC369f56a228fd49358259b1def8e172b2-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/ 2 KB
1 KB 45ms
43ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/RC369f56a228fd49358259b1def8e172b2-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 31cf81fde5eb7bf0c859cd7181b64e13e3f49899db65b688d0612cca3929f9bc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:29 GMT
server: AkamaiNetStorage
etag: "cf4b8194ccec67f24f91df8ceb320644:1715106089.87901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1021
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/ 13 KB
3 KB 20ms
19ms Fetch
application/json 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: BhDz7QN6NZvDbVeQXXKKbA==
age: 41416
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3041
x-ms-lease-status: unlocked
last-modified: Thu, 07 Mar 2024 11:26:21 GMT
server: cloudflare
etag: 0x8DC3E996A8D0BAE
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: d8189417-201e-0065-01a9-7097c7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216cdc561d9e-FRA

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/v2/ 63 KB
13 KB 21ms
20ms Fetch
application/json 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/v2/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d18f313f2489ed91cd15cf94a1e5668b8b0da8318f593d980228000a1757702f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: +VcLy0Fhvi3ZWKBwz9NNzQ==
age: 41444
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 13587
x-ms-lease-status: unlocked
last-modified: Thu, 07 Mar 2024 11:26:24 GMT
server: cloudflare
etag: 0x8DC3E996C0939E8
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: f82a588d-e01e-007a-42aa-7024c3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216cdc581d9e-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202401.2.0/assets/ 21 KB
4 KB 37ms
36ms Fetch
text/css 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202401.2.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: c7xAZ9MSGAobGaTYg/Qtag==
age: 40596
x-ms-lease-status: unlocked
last-modified: Thu, 07 Mar 2024 11:26:34 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: efe512ab-a01e-006b-72aa-70be77000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 880f216cdc5b1d9e-FRA

POST
H2 200 dyvvHf6oG0 Show response
api.userway.org/api/tunings/ 3 KB
3 KB 526ms
169ms XHR
application/json 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/tunings/dyvvHf6oG0
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 12b51723b88776da7af89c473be27dfe4cfad21fa1640a7ce81bdf2842987b05

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 09 May 2024 05:01:16 GMT
etag: W/"b05-oTUs87vdFxtHDO4pq26t3asAuvc"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-service-request-id: usr48f066164bb2407
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: *
content-length: 2821
x-service-version: uw-pr

GET
H2 200 footer-privacy-nav.json Show response
www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/ 670 B
643 B 31ms
31ms Fetch
application/json 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/footer/footer-privacy-nav.json

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/wp-content/themes/main-theme/dist/scripts/components/footer-navigation.min.js?ver=1708658992

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8eda05fa3bffe9499012fd70f4e296d97d91026b0db3682b2d12be64f005f81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 98845fbd1cb14abbe9d464a4caf17976.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-amz-version-id: xuxl.umtlS2lCGol4DMR91irTaBSnRzJ
age: 2142
x-amz-cf-pop: FRA60-P7
x-cache: Hit from cloudfront
last-modified: Wed, 08 May 2024 22:40:49 GMT
server: cloudflare
etag: W/"e13f44c8662344f8e44d882469f48d34-1"
vary: Accept-Encoding
content-type: application/json
cache-control: public, max-age=14400
cf-ray: 880f216d6b4b8ffe-FRA
x-amz-cf-id: KUjcPQp8xcEbX1UnKc1cpvuo6gBu9e0vZHXBpU0LptaIPTZBqLepXw==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 RC53059e847e054c9dbde2ee394fc1558b-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/ 376 B
502 B 7ms
7ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/RC53059e847e054c9dbde2ee394fc1558b-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: b2ce4d601a16291ec66774c3c0f83bae8715a7e3bfd1b4155e4256f902d21362

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:29 GMT
server: AkamaiNetStorage
etag: "cf4b8194ccec67f24f91df8ceb320644:1715106089.87901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 244
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 65 KB
18 KB 105ms
17ms Script
application/javascript 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

58a28a0a755fb393b8a69834ee61ea85b0a2f0edb0db062a4e5e928028edb882

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 May 2024 20:19:21 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "663bde49-10585"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 17942
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 RC698dc8385de1411c824b73d0b3be0648-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/ 626 B
578 B 7ms
7ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/RC698dc8385de1411c824b73d0b3be0648-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 904a1945e008d329ef6330bc09d044aca791656990a9ba0add9b8e7461aff8a7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:29 GMT
server: AkamaiNetStorage
etag: "cf4b8194ccec67f24f91df8ceb320644:1715106089.87901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 321
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
600 B 19ms
19ms Image
image/svg+xml 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 48446
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 02:06:33 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ebdf8db5-501e-005c-23f7-a0b090000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 880f216d9dbabb79-FRA

GET
H2 200 HaasGrotDisp-65Medium.woff2
www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/crowdstrike-wp-header/resources/fonts/haas_grot_disp/ 32 KB
33 KB 30ms
30ms Font
font/woff2 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/crowdstrike-wp-header/resources/fonts/haas_grot_disp/HaasGrotDisp-65Medium.woff2

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/crowdstrike-wp-header.css?ver=6.4.3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5f3898fe99aab483801a9f4149fc85c0d9e6281aba989b8b085fce8db09710d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/etc.clientlibs/crowdstrike/clientlibs/crowdstrike-wp-header.css?ver=6.4.3
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: HIT
content-security-policy: upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
age: 16732
x-vhost: crowdstrikewwwvhost
x-cache: HIT
x-served-by: cache-dfw-kdfw8210132-DFW
last-modified: Wed, 24 Apr 2024 20:55:04 GMT
server: cloudflare
x-timer: S1715213800.767840,VS0,VS0,VE3
etag: W/"806c-616dde281ba00-gzip"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: https://www.crowdstrike.com
cache-control: public, max-age=2592000
access-control-allow-credentials: true
access-control-max-age: 1800
cf-ray: 880f216dcb728ffe-FRA
access-control-allow-headers: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
x-frame-options: SAMEORIGIN
expires: Sat, 08 Jun 2024 05:01:15 GMT

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
494 B 18ms
18ms Fetch
image/svg+xml 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202401.2.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 28932
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 06:40:06 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: e3b31e46-901e-008d-4e4e-a10dcf000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 880f216dad161d9e-FRA

GET
H2 200 CS_Logos_2020_InlineRed_b.png
cdn.cookielaw.org/logos/c109dae9-46f3-4e91-a59e-7844ef645107/cad7e755-8c86-4939-8df1-4d68f074f0fc/53cb332e-5cc4-44a8-9590-9e086136bfe9/ 23 KB
24 KB 21ms
21ms Image
application/octet-stream 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/c109dae9-46f3-4e91-a59e-7844ef645107/cad7e755-8c86-4939-8df1-4d68f074f0fc/53cb332e-5cc4-44a8-9590-9e086136bfe9/CS_Logos_2020_InlineRed_b.png

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0dbd9ca47f4fd338efab8e6f5188a6de45cf390f04cfaea4a65abc47635550c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: QB/VUZMYBu/LYPsEI/xs+w==
age: 47677
content-length: 24007
x-ms-lease-status: unlocked
last-modified: Tue, 21 Jul 2020 19:10:59 GMT
server: cloudflare
etag: 0x8D82DA9CDE4D646
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
x-ms-request-id: a3e13deb-301e-001b-4546-230780000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 880f216dadc8bb79-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 19ms
19ms Image
image/svg+xml 2606:4700::6813:b234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Host: www.crowdstrike.com
URL: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 17006
x-ms-lease-status: unlocked
last-modified: Wed, 08 May 2024 06:40:07 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 8374a36e-501e-005c-237a-a1b090000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 880f216dadcabb79-FRA

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
703 B 41ms
10ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:15 GMT
an-x-request-uuid: b1bde07a-cee8-40d7-ad9e-c9af23aecd5d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.crowdstrike.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 146.70.117.102; 146.70.117.102; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
196 B 58ms
20ms XHR
text/html 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-147-176.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.crowdstrike.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 19 B
311 B 49ms
10ms XHR
text/html 2a02:26f0:480:23::1726:629c
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: ac8d539fa2691c69c61152294bdd1bfb5c36c4235d4856ef737533f3f562ef17

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:15 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:20:272::2e
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1715230875926_388391900_528335743_20_750_6_14_219";dur=1
content-length: 19
expires: Thu, 09 May 2024 05:01:15 GMT

GET
H2 200 RC8de780f02ed7489ea63027c24b833a79-source.min.js Show response
assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/ 571 B
595 B 7ms
7ms Script
application/x-javascript 2a02:26f0:480:99e::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/df03e9ef598b/RC8de780f02ed7489ea63027c24b833a79-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/d72cd986aea0/09e1256af957/launch-6cccf53edc18.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ce70126699d888ff3ee8d1e47d92fd4e581785b047ecef6d4f6373260e5b9b4b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2024 18:21:29 GMT
server: AkamaiNetStorage
etag: "cf4b8194ccec67f24f91df8ceb320644:1715106089.87901"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.crowdstrike.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 337
expires: Thu, 09 May 2024 06:01:15 GMT

GET
H2 200 favicon-96x96.png
www.crowdstrike.com/wp-content/uploads/2018/09/ 3 KB
3 KB 30ms
30ms Other
image/png 2606:4700::6810:b576
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.crowdstrike.com/wp-content/uploads/2018/09/favicon-96x96.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:b576 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aacc10887dd04b98aaef2ef28edd9f1d7701c4e533f4490de1dec25e3ed1c10f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/blog/hijackloader-expands-techniques/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e7901684d85170d527aec3a64956def6.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-version-id: xzQ50oa4JIywxLj5hARZkgDJ9YqHXEhx
age: 6014
x-amz-cf-pop: FRA60-P7
cf-polished: origSize=2800
x-cache: Hit from cloudfront
content-length: 2670
last-modified: Mon, 04 Mar 2024 19:01:37 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
etag: "4a45a80764ed940d22195c87571e4162-1"
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 880f216e6bd28ffe-FRA
x-amz-cf-id: UWkUDeC3SM5VApm05QXHotvG80BV0s5ftOUgPGajgP8-_JZPTUoA4w==
expires: Thu, 09 May 2024 09:01:15 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 131ms
119ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:16 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:16 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 132ms
121ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2212b151d5b8d6b92a46cc0179565c5a619e148092%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22840a4ffa1a26e59267b6b28298d972e1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:16 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:16 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 123ms
120ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A272%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:16 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:16 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 729 B
714 B 28ms
13ms XHR
application/json 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash: f77e613ee5f3e6d5249fe3ac28450cae2fffef6fdf5ca832117cb88089f87beb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Authorization: Token 12b151d5b8d6b92a46cc0179565c5a619e148092
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
X-6s-CustomID: WebTag1.0 840a4ffa1a26e59267b6b28298d972e1
Referer: https://www.crowdstrike.com/
sec-ch-ua-platform: "Win32"

Response headers

x-trace-id: 7068633820764484072
date: Thu, 09 May 2024 05:01:16 GMT
content-encoding: gzip
server: nginx
vary: Origin, Accept-Encoding
content-type: application/json
x-6si-region: eu-central-1a
access-control-allow-origin: https://www.crowdstrike.com
access-control-expose-headers: X-6si-Region
access-control-allow-credentials: true
timing-allow-origin: https://6sense.com, https://www.ssga.com
content-length: 391

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ 0
0 35ms
12ms Preflight 76.223.9.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 76.223.9.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ac3ff6aafb2cddae2.awsglobalaccelerator.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,x-6s-customid
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: authorization,x-6s-customid
access-control-allow-methods: OPTIONS,GET
access-control-allow-origin: https://www.crowdstrike.com
access-control-expose-headers: X-6si-Region
access-control-max-age: 1800
date: Thu, 09 May 2024 05:01:16 GMT
server: nginx
timing-allow-origin: https://6sense.com, https://www.ssga.com
x-6si-region: eu-central-1a
x-trace-id: 5935401900078138827

GET
H2 200 en-US.json Show response
cdn.userway.org/widgetapp/2024-05-07-09-28-56/locales/ 621 B
1006 B 7ms
7ms XHR
application/json 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/locales/en-US.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 4ad9a5493aafc1f43e8882aeb9d07b945139ad6326d82a04b5237ee1a3283538

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 5bbaa27b453dc834289b91c14bbb4934.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 906
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155604
x-accel-date: 1715075272
x-77-nzt: EgwBw7WvDgH31F8CAAwBisclxAH3EAAAAA
x-accel-expires: @1740995256
x-77-age: 155604
last-modified: Tue, 07 May 2024 09:31:08 GMT
server: CDN77-Turbo
etag: W/"85d8c40aac9c25bb0b993d4aa039a56f"
x-77-nzt-ray: 908339308b997c159c583c66b52c4d10
access-control-max-age: 3000
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/json
x-amz-cf-id: 8MyVtt4cUUO98HhiWJiqbBq453Jz4-T5egDuDqWEk7mj2bXgVIXYWw==

GET
H2 200 remediation_1715074136168.js Show response
cdn.userway.org/widgetapp/2024-05-07-09-28-56/remediation/ 105 KB
29 KB 21ms
21ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/remediation/remediation_1715074136168.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: d6ec38d82efa2aa7a5fb4f60ac7cd8408baefa75b6a7281e15bb59a98f0b9ea1

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 67a9db8bae62321fca21cfd1c50bec56.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-P10
age: 882
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155609
x-accel-date: 1715075267
x-77-nzt: EgwBw7WvDgH32V8CAAwB1GY4EQH3BwAAAA
x-accel-expires: @1740995260
x-77-age: 155609
last-modified: Tue, 07 May 2024 09:31:09 GMT
server: CDN77-Turbo
etag: W/"fbac621e929ea4b85713c1c5f08f3631"
x-77-nzt-ray: 908339308b997c159c583c661924502e
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: FIUzgS8qh6FCh_sywEbpdsRWlE8I4VvFAZgW19d7dQqXt9bORYajVw==

GET
H2 200 kckEHvS1pAYTRYmI.json Show response
cdn.userway.org/remediations/consolidated/2376540/ 799 KB
104 KB 9ms
9ms XHR
application/json 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediations/consolidated/2376540/kckEHvS1pAYTRYmI.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 1e4d8ca9f70fc95ebc0d95d3c39b21541cf2440c22bdfe01c6108cbb188dcfa8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 8c2a58b44ec0f49caee32696bddc8526.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 116362
x-accel-date: 1715114514
x-77-nzt: EgwBw7WvDgH3isYBAAwBJRPCNAH3pAcAAA
x-accel-expires: @1746648558
x-77-age: 116362
last-modified: Tue, 07 May 2024 20:09:15 GMT
server: CDN77-Turbo
etag: W/"a852cf68025410fbee16af5544c9c940"
x-77-nzt-ray: 908339308b997c159c583c663321392e
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: public, max-age=31536000
content-type: application/json
x-amz-cf-id: 3qVIjRrz_kPwMcvrANA4b0G9swzZ9kHHokVYCjDnQpy-s7fgDxAivQ==

GET
H2 200 body_wh.svg
cdn.userway.org/widgetapp/images/ 4 KB
3 KB 7ms
6ms Image
image/svg+xml 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/body_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 21eb1e487c899c6192c31800445bfb81caa7ff1fca550ea3fdb3444834d85710

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 5bbaa27b453dc834289b91c14bbb4934.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 8
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155609
x-accel-date: 1715075267
x-77-nzt: EgwBw7WvDgH32V8CAAwBnJIhJwH3BQAAAA
x-accel-expires: @1740995262
x-77-age: 155609
last-modified: Fri, 22 Mar 2024 12:49:37 GMT
server: CDN77-Turbo
etag: W/"1d8b1582fe82bd329041cc1982ad42e4"
x-77-nzt-ray: 908339302894cc139c583c6642dd882f
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: image/svg+xml
x-amz-cf-id: FbtYzIS0yGtX8_McvZe9UwOhVvxdOQD5bMSQ4DQuQDwI-7zeZ3QZGA==

GET
H2 200 spin_wh.svg
cdn.userway.org/widgetapp/images/ 2 KB
1 KB 8ms
7ms Image
image/svg+xml 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.userway.org/widgetapp/images/spin_wh.svg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 b61ff825a3ca0ff851caf7741034ca52.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155609
x-accel-date: 1715075267
x-77-nzt: EgwBw7WvDgH32V8CAAwB1GY4EQH3BgAAAA
x-accel-expires: @1740995261
x-77-age: 155609
last-modified: Fri, 22 Mar 2024 12:49:37 GMT
server: CDN77-Turbo
etag: W/"8e0a35946bf39d10f46a1f1653366a0a"
x-77-nzt-ray: 908339302894cc139c583c66e6ef8d2f
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: image/svg+xml
x-amz-cf-id: 9MGSIrZ3kbElM27P65aeJ7UItON2hRCoCnfaj7gvJIU1WxDkzlWmRg==

GET
H2 200 remediation-tool.js Show response
cdn.userway.org/remediation/2024-05-07-09-28-56/paid/ 57 KB
21 KB 7ms
7ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: aa058084762ccc24b31ccadb0437c5a9863e1d1f675c7494e44f352b3a14d9cb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 6fa384f51cde51d7c86ee18d17ac3eaa.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155609
x-accel-date: 1715075267
x-77-nzt: EgwBw7WvDgHX2V8CAAwBJRPCLgH3eAMAAA
x-accel-expires: @1740994379
x-77-age: 155609
last-modified: Tue, 07 May 2024 09:31:13 GMT
server: CDN77-Turbo
etag: W/"2c3734050ee439d0bc0578c15afbbbc4"
x-77-nzt-ray: 908339308b997c159c583c66bfa02130
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: Q5N8o336Dt_7UdlHUXOBY3ACZMfkxoQEx81LwJDEjRrszIyb3KyaNA==

GET
H2 200 kckEHvS1pAYTRYmI.json Show response
cdn.userway.org/remediations/consolidated/2376540/ 799 KB
0 0ms
0ms Fetch
application/json 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/remediations/consolidated/2376540/kckEHvS1pAYTRYmI.json
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 1e4d8ca9f70fc95ebc0d95d3c39b21541cf2440c22bdfe01c6108cbb188dcfa8

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:16 GMT
via: 1.1 8c2a58b44ec0f49caee32696bddc8526.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: FRA56-P10
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 116362
x-accel-date: 1715114514
x-77-nzt: EgwBw7WvDgH3isYBAAwBJRPCNAH3pAcAAA
x-accel-expires: @1746648558
x-77-age: 116362
last-modified: Tue, 07 May 2024 20:09:15 GMT
server: CDN77-Turbo
etag: W/"a852cf68025410fbee16af5544c9c940"
x-77-nzt-ray: 908339308b997c159c583c663321392e
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: public, max-age=31536000
content-type: application/json
x-amz-cf-id: 3qVIjRrz_kPwMcvrANA4b0G9swzZ9kHHokVYCjDnQpy-s7fgDxAivQ==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
258 B 122ms
122ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A15%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:17 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:17 GMT

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 231ms
169ms Preflight 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fthemes%2Fmain-theme%2Fdist%2Fimages%2Flogos%2Fcrowdstrike%2FRedLogoCS.svg%22%2C%22alt%22%3A%22CrowdStrike%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Thu, 09 May 2024 05:01:17 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggB1GY4sQAACAElE8I0AAA
x-77-nzt-ray: 1cb09c0e9258cfdd9d583c6616d87c18
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-727604a1

GET
H2 200 2376540 Show response
api.userway.org/api/br-links/v0/contribute/ 51 B
429 B 174ms
174ms Fetch
application/json 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/br-links/v0/contribute/2376540
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: a371978536745668f9c16dcbdbf0d5ca436d146906664dcc0529f16d70567fdf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:17 GMT
etag: W/"33-H+KjAZZBE0PpJIInQTjCoPBRoaQ"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: no-cache, no-store, must-revalidate
vary: Accept-Encoding
access-control-allow-headers: *
content-length: 51
x-service-version: apps-ddb67952

GET
H2 200 2376540 Show response
api.userway.org/api/br-links/v0/links/ 12 KB
3 KB 175ms
175ms Fetch
application/json 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.userway.org/api/br-links/v0/links/2376540
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 5746d3d3e64d46bca6c478a9a05b27640fa2f9cd29f99b3106ebed16721248d7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 09 May 2024 05:01:17 GMT
content-encoding: gzip
etag: W/"2fd3-aq/jAx2iiQ7oKMn2R5rcJxRPvv4"
access-control-max-age: 3000
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=300, public
vary: Accept-Encoding
access-control-allow-headers: *
x-service-version: apps-ddb67952

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 284 B
809 B 7ms
6ms Fetch
application/json 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fthemes%2Fmain-theme%2Fdist%2Fimages%2Flogos%2Fcrowdstrike%2FRedLogoCS.svg%22%2C%22alt%22%3A%22CrowdStrike%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: cd24f5bed39abff3794a1239dba98000015195dce1486f8bfbcfc364417f49eb

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:17 GMT
content-encoding: gzip
x-77-cache: HIT
x-cache: HIT
x-age: 51382
x-accel-date: 1715179495
x-service-version: img-dscr-srv-727604a1
x-77-nzt: EgwB1GY4sQHXtsgAAAwBJRPCNAH3xQEAAA
x-accel-expires: @1715783842
x-77-age: 51382
server: CDN77-Turbo
etag: W/"11c-mqzrkG3g8ICAqtilMG3dKqjInKY"
x-77-nzt-ray: 1cb09c0e9258cfdd9d583c6679cc9a22
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

GET
H2 200 nav_menu_helper_1715074136168.js Show response
cdn.userway.org/widgetapp/2024-05-07-09-28-56/remediation/ 23 KB
7 KB 8ms
8ms Script
application/javascript 2a02:6ea0:c700::10
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/remediation/nav_menu_helper_1715074136168.js
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/widgetapp/2024-05-07-09-28-56/widget_app_base_1715074136168.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 48eef7fe61a3e2c7c88ac1c6a263bd851b6a05363607e52fd2be4e4472d42255

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Origin: https://www.crowdstrike.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:17 GMT
via: 1.1 c114c55bb579a01518cf64c447d45272.cloudfront.net (CloudFront)
content-encoding: gzip
x-amz-cf-pop: DUS51-P1
age: 882
x-amz-server-side-encryption: AES256
x-77-cache: HIT
x-cache: HIT
x-age: 155611
x-accel-date: 1715075266
x-77-nzt: EgwBw7WvDgH3218CAAwBnJIhJwH3BAAAAA
x-accel-expires: @1740995262
x-77-age: 155611
last-modified: Tue, 07 May 2024 09:31:09 GMT
server: CDN77-Turbo
etag: W/"d5babf1f477d0f7bf4044b0693b956d9"
x-77-nzt-ray: 908339308b997c159d583c66179f4530
access-control-max-age: 3000
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
cache-control: max-age=25920000, public
content-type: application/javascript
x-amz-cf-id: Zc7Gq-pPH9Z_R7sc2JKaXMIbRi_yCx2WiG0DE4bOVSiBb7qbtzn8ew==

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 124ms
124ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:18 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:18 GMT

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 177ms
177ms Preflight 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fc109dae9-46f3-4e91-a59e-7844ef645107%2Fcad7e755-8c86-4939-8df1-4d68f074f0fc%2F53cb332e-5cc4-44a8-9590-9e086136bfe9%2FCS_Logos_2020_InlineRed_b.png%22%2C%22alt%22%3A%22Company%20Logo%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fstatic%2Fpowered_by_logo.svg%22%2C%22alt%22%3A%22Powered%20by%20Onetrust%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F07%2FTechCenter-2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2018%2F08%2FEdward-Gonam-Qatar-Blog2-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F01%2Fvideo-ATTCK2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F12%2FIR-Video-Blog-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2020%2F10%2FBlog_1060x698-21-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F06%2FBlog_0520_08-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fbreaches-stop-here-post-cta.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2FCS_Free_Trial_blog_300x600_final.jpg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fred-falcon.svg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F08%2FBlog_1060x698-3.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-4.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F10%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F02%2F0222_03_Falcon_Platform_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F11%2FXXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_06_Linux-Container-Escapes_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2FBlog_1060x698-1-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2FeZg59Nv0.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F04%2FTSA-blog_v1-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2F23-OTH-060_adversary-5-panda-china.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Thu, 09 May 2024 05:01:18 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggB1GY4sQAACAGckiEfAAA
x-77-nzt-ray: 1cb09c0e9258cfdd9e583c667a15a315
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-727604a1

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 5 KB
1 KB 9ms
8ms Fetch
application/json 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fc109dae9-46f3-4e91-a59e-7844ef645107%2Fcad7e755-8c86-4939-8df1-4d68f074f0fc%2F53cb332e-5cc4-44a8-9590-9e086136bfe9%2FCS_Logos_2020_InlineRed_b.png%22%2C%22alt%22%3A%22Company%20Logo%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fcdn.cookielaw.org%2Flogos%2Fstatic%2Fpowered_by_logo.svg%22%2C%22alt%22%3A%22Powered%20by%20Onetrust%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2016%2F07%2FTechCenter-2.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2018%2F08%2FEdward-Gonam-Qatar-Blog2-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F01%2Fvideo-ATTCK2-1.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2019%2F12%2FIR-Video-Blog-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2020%2F10%2FBlog_1060x698-21-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F06%2FBlog_0520_08-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fbreaches-stop-here-post-cta.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2FCS_Free_Trial_blog_300x600_final.jpg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F07%2Fred-falcon.svg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F08%2FBlog_1060x698-3.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F09%2FBlog_1060x698-4.jpeg%22%2C%22alt%22%3A%22%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2021%2F10%2FBlog_1060x698-2.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F02%2F0222_03_Falcon_Platform_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2022%2F11%2FXXXX_Falcon-LogScale-So-Fast_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2F0123_06_Linux-Container-Escapes_Blog_1060x698.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F01%2FBlog_1060x698-1-1.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2F0123_11_DLL-Sideloading_Advanced-Memory-Scanning_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F02%2FeZg59Nv0.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F04%2FTSA-blog_v1-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F05%2F23-SRV-013_Forrester-Wave_MDR_2023_Blog_1060x698_V1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F06%2F23-OTH-060_adversary-5-panda-china.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: eb103692879e6e072fd50706cdd5adf9af26e46f008e824dc6833a55ceacc641

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:18 GMT
content-encoding: gzip
x-77-cache: HIT
x-cache: MISS
x-accel-date: 1714809138
x-service-version: img-dscr-srv-727604a1
x-77-nzt: EggB1GY4sQFBDAGckiEfAddsbwYA
x-accel-expires: @1715413938
x-77-age: 421740
server: CDN77-Turbo
etag: W/"1408-Zkzv/ZPRO7eh1EfxIMjv+LKB5Yo"
x-77-nzt-ray: 1cb09c0e9258cfdd9e583c6669544920
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

GET
H2 200 alts.json Show response
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 5 KB
1 KB 203ms
202ms Fetch
application/json 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F08%2F0823_01_MSFT-Windows-Restart-Manager.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F10%2F0122_03_IR_Tracker_for_DFIR_Community.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1023_03_Compromising-Identity-Provider-Federation.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F23-OTH-060_adversary-1-kitten-iran.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F0222_05_FalconFusion_Ransomware_Malware.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F1123_08_Insider-Vulnerabilities.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F0124_02_FalconFund-Partners-with-Aembit.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0224_01_CS-Sponsors-MacAdmins.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0224_02_LATAM-Malware-Update.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure1-2.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure2a.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FGTR_BlogImage_1060x698-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FIdentity-protection-for-government-blog-main-image.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2F0324_01_Flow-Security_Acquisition.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2F0324_02_Next-Gen_SIEM.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2FSPIDER-adversary-blog-main-image.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0424_01_Protecting-High-Profile-Employee-Info_Dark-Web.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0424_03_Falcon-Fund_Nagomi.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FAppSec-blog-main-image.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FGoogle-Cloud-blog-main-image.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FIDC-MDR-Marketscape_Blog_1060x698_01.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F05%2F0524_01_RSA-Cloud-GK-MS.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Requested by: Host: cdn.userway.org
URL: https://cdn.userway.org/remediation/2024-05-07-09-28-56/paid/remediation-tool.js?ts=1715074136168
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash: 8d2ed3f7875ce5040835486d25dd82e263e984d9c85987819dce940f79c13f97

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

x-77-pop: frankfurtDE
date: Thu, 09 May 2024 05:01:18 GMT
content-encoding: gzip
x-77-cache: MISS
x-cache: MISS
x-service-version: img-dscr-srv-727604a1
x-77-nzt: EggB1GY4sQFBCAGckiEnAUE
server: CDN77-Turbo
etag: W/"1388-6SvgplEbAJwLxnAslYbx3mwTgAs"
x-77-nzt-ray: 1cb09c0e9258cfdd9e583c66a2764f20
vary: Accept-Encoding, Accept-Encoding
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
access-control-allow-headers: *

OPTIONS
H2 200 alts.json
cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/ 0
0 178ms
177ms Preflight 2a02:6ea0:c700::21
CDN77 _

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn77.api.userway.org/api/img-dscr/v2/dyvvHf6oG0/2376540/BvBnLxcgsitibG0n/alts.json?dto=%7B%22sorted%22%3A%5B%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F08%2F0823_01_MSFT-Windows-Restart-Manager.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F10%2F0122_03_IR_Tracker_for_DFIR_Community.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F1023_03_Compromising-Identity-Provider-Federation.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F11%2F23-OTH-060_adversary-1-kitten-iran.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F0222_05_FalconFusion_Ransomware_Malware.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2023%2F12%2F1123_08_Insider-Vulnerabilities.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F01%2F0124_02_FalconFund-Partners-with-Aembit.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0224_01_CS-Sponsors-MacAdmins.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2F0224_02_LATAM-Malware-Update.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure1-2.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FFigure2a.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FGTR_BlogImage_1060x698-1.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F02%2FIdentity-protection-for-government-blog-main-image.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2F0324_01_Flow-Security_Acquisition.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2F0324_02_Next-Gen_SIEM.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F03%2FSPIDER-adversary-blog-main-image.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0322_02_Reinventing_MDRIDP_Blog_1060x698.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0424_01_Protecting-High-Profile-Employee-Info_Dark-Web.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2F0424_03_Falcon-Fund_Nagomi.jpg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FAppSec-blog-main-image.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FGoogle-Cloud-blog-main-image.jpeg%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F04%2FIDC-MDR-Marketscape_Blog_1060x698_01.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%2C%7B%22src%22%3A%22https%3A%2F%2Fwww.crowdstrike.com%2Fwp-content%2Fuploads%2F2024%2F05%2F0524_01_RSA-Cloud-GK-MS.png%22%2C%22alt%22%3A%22%22%2C%22dir%22%3A%22RO%22%7D%5D%2C%22tier%22%3A%22PAID_QUOTA_TIER%22%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:6ea0:c700::21 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software: CDN77-Turbo /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.crowdstrike.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, HEAD, PUT, PATCH, POST, DELETE
access-control-allow-origin: *
access-control-expose-headers: Content-Range, Content-Length, ETag, Content-Type
access-control-max-age: 3000
cache-control: max-age=604800
date: Thu, 09 May 2024 05:01:18 GMT
server: CDN77-Turbo
x-77-cache: MISS
x-77-nzt: EggB1GY4sQAACAGckiEnAAA
x-77-nzt-ray: 1cb09c0e9258cfdd9e583c668252a915
x-77-pop: frankfurtDE
x-service-version: img-dscr-srv-727604a1

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 137ms
137ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A18%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A17%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:19 GMT
x-content-type-options: nosniff
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:19 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
257 B 120ms
120ms Image
image/gif 2.17.147.176
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=840a4ffa1a26e59267b6b28298d972e1&svisitor=null&visitor=40e4e21a-300a-4afa-8944-5d60b8ba0f5e&session=626e591b-7a45-42ab-8434-8dd04fbc44a2&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A19%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2009%20May%202024%2005%3A01%3A18%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Read%20this%20blog%20to%20learn%20about%20the%20HijackLoader%20sample%20that%20employs%20sophisticated%20evasion%20techniques%20to%20enhance%20the%20complexity%20of%20the%20threat.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22HijackLoader%20Expands%20Techniques%20to%20Improve%20Defense%20Evasion%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&pageViewId=87351376-f5a2-44cf-8ac2-c4164d6f97a4&an_uid=0&v=1.1.19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.176 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-176.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www.crowdstrike.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 09 May 2024 05:01:20 GMT
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Thu, 09 May 2024 05:01:20 GMT

Verdicts & Comments Add Verdict or Comment

103 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

13 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.crowdstrike.com/	1970-01-20 20:27:12	Name: __cf_bm Value: QWt8q_bAcsV.UjFYvZOqCiIq8dplrmZSIyDGIKxu7gY-1715230874-1.0.1.1-DgfUuanzJnj_i6EEkpJhQQCqBCV64ReazNQiuB9kcGw4f8WA.HobBPXMheXvh2_ueI_SB5t64.turMqFRInVew
.crowdstrike.com/	1969-12-31 23:59:59	Name: _gcl_au Value: 1.1.159128610.1715230875
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: KxNiRgRRyNU
.youtube.com/	1970-01-21 00:46:22	Name: VISITOR_INFO1_LIVE Value: bv99PhpkoNE
.youtube.com/	1970-01-21 00:46:22	Name: VISITOR_PRIVACY_METADATA Value: CgJERRIEEgAgJQ%3D%3D
.crowdstrike.com/	1969-12-31 23:59:59	Name: _csUtms3 Value: %7B%22utm_medium%22%3A%22dir%22%7D
.go.crowdstrike.com/	1970-01-20 20:27:12	Name: __cf_bm Value: 7S1rT92aZHaF5fJDqodF0MH1wW4vJQHofyTnbF6nVpA-1715230875-1.0.1.1-Oo5W6iEmhRamyaslazrZbtfeVGXEm9tfDg6.kP_2YyRFgQnyl5hIOuPXLi0DSTGGt88PUI2avtyYhEdmp9e35g
.crowdstrike.com/	1970-01-21 05:12:46	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Thu+May+09+2024+07%3A01%3A15+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202401.2.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=25cd64d2-e2dd-4dd0-8b5c-a7573ffdc033&interactionCount=0&landingPath=https%3A%2F%2Fwww.crowdstrike.com%2Fblog%2Fhijackloader-expands-techniques%2F&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0
.adnxs.com/	1970-01-21 06:03:10	Name: receive-cookie-deprecation Value: 1
www.crowdstrike.com/	1970-01-20 20:37:15	Name: _an_uid Value: 0
www.crowdstrike.com/	1970-01-21 06:03:10	Name: _gd_visitor Value: 40e4e21a-300a-4afa-8944-5d60b8ba0f5e
www.crowdstrike.com/	1970-01-20 20:27:25	Name: _gd_session Value: 626e591b-7a45-42ab-8434-8dd04fbc44a2
www.crowdstrike.com/	1970-01-20 20:27:12	Name: _csRef Value: www.crowdstrike.com/blog/hijackloader-expands-techniques/

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;report-uri /csp-violation-report-endpoint/
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM https://crowdstrike.pathfactory.com https://crowdstrike.com
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.userway.org
assets.adobedtm.com
b.6sc.co
c.6sc.co
cdn.addsearch.com
cdn.cookielaw.org
cdn.userway.org
cdn77.api.userway.org
connect.facebook.net
epsilon.6sense.com
geolocation.onetrust.com
go.crowdstrike.com
ipv6.6sc.co
j.6sc.co
p.typekit.net
secure.adnxs.com
use.fontawesome.com
use.typekit.net
www.crowdstrike.com
www.googletagmanager.com
www.youtube.com
104.17.72.206
2.17.147.176
2600:1f14:5db:eb11:5ace:4d21:5f9e:ca6d
2600:9000:26e8:7400:a:de52:1580:93a1
2606:4700:3037::ac43:8ef5
2606:4700:4400::6812:2089
2606:4700::6810:b576
2606:4700::6813:b234
2a00:1450:4001:80e::200e
2a00:1450:4001:82f::2008
2a02:26f0:3500:16::215:148b
2a02:26f0:3500:16::215:1493
2a02:26f0:480:23::1726:629c
2a02:26f0:480:99e::1e80
2a02:6ea0:c700::10
2a02:6ea0:c700::21
2a03:2880:f084:d:face:b00c:0:3
37.252.173.215
76.223.9.105
001be4366308a1bd4a6b8939f8f5228ed510d6994e5087f4b70bd82806a6c103
01a7aa05d82b70da32c8a24ac7db1933bb73b146b00a482c1a0d4305e4d84659
04466026773f10391f6d0d84d702b9eef45db6438822b4edcd931cf5cc89d2d2
05db34dcf79d4e424f9ce53bd296810b78e0b16ff3f88018d1268cfdf414c4f0
06adbc033a1a4d6c04306c51945d1661225aa304b703660fd4347e73109802b8
07cd8a0ea2b5b9fa0845c4f3a17ba1c634b7404c92f8c18012a8d933f59f26a2
08f07cdbd7f53f837d4dc69b6c619efc1b2a8daf0324533e1e385a65fc25a269
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
0a5519e5e3a790d684daf67a4888160187a1359dd446b05fa89cbdaabc66221f
0bf90a8569ed246ad28d91458f6771f6934a0c4983243eca5f6accf91d6979cc
0dbd9ca47f4fd338efab8e6f5188a6de45cf390f04cfaea4a65abc47635550c6
0dcb4b8f8926bf46fb35389caec38cf06c566048372f67646d40efce85e24346
0e0a27c105caf20bd4cc76fe58f222d856ab8f626447846842dddca8ce7509ef
0e9afb228584852481bf1ba4429809bb248c8c8ae703086bcf60c2bff4799bf0
0ec1ce75f2ef5a3385c2fa08d0609c4fd118c8a465c00158e1db3f809d308fbb
0f1c1c319dae1d32ef2feaa657e6d82c5f8fe4c98aa8bbc7ee0aab8b5b9d5d38
0f5a20aea350274cc88cc79a153797c6b253aec6a77259467378f0ca2dc29203
0f9c2ce6f85c93eed9e3e0917378e13d9ecc30b3690a2c97f9eb013b81244f4b
12b51723b88776da7af89c473be27dfe4cfad21fa1640a7ce81bdf2842987b05
130a995d67fcc6db4eb38729f7b2d751e4d01b3a0ec2baf598053936fb712e9c
15e5e119a6cc35c5d0ac09790842740d42ce39a8f4a7db088198d39e95bdec1f
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1c36239bcd80f237805e530e80214ecc5b43821a943bb7aa744bfbaa87c4415f
1e4d8ca9f70fc95ebc0d95d3c39b21541cf2440c22bdfe01c6108cbb188dcfa8
21cf396be385b21e8311d96026d57f639323043d2f17f42f6864a615b5fca86c
21eb1e487c899c6192c31800445bfb81caa7ff1fca550ea3fdb3444834d85710
23f86ae2e5fc068cff7f339b994573c23c8799f01acf1b5c097153376bde7ad6
27ac6f95e059494054ce94aedba1dc9f05a0b4b299c57a7ce7cad5bb202c0b00
2b5139a4d5589798c94dce13e6aab1a0c1d438d43e30de6ea0c16ec4dfa16432
317fde7d62285ea19f6d792d7933a77dc6d479f735da04504c1544c967ed36b0
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
31cf81fde5eb7bf0c859cd7181b64e13e3f49899db65b688d0612cca3929f9bc
36c366753aa6b7728f8e7e6bfee5ef08beead5e81f66a2a5a37d66397c62e90c
371c77d9d1f5d96c55daf6224cb162828509919e3f97f59722ef1b1dc971571a
384ad6c5085d773700ca45bd99e00f40335779afc64e4715cda26ea57aecfce8
39d5e6434d7521dce9c650691c620817fe3a13e03c43ead6ad86771f06f5d9e2
3b461442bdf6f086af9023de4b6f909e8b21599229c8a8ba3ae4fc92a5c08a6a
3d43f14e95f58559c890af8404c7ce4ac13dc55c50868d8bb7941fdb68bcb94c
3d871b6771dfa1a9115eee87e6dbb038d19387e11f27904622a56ff9bd4d2b84
3d9e2ec9ac961fa1ffd21bb7e6dd88b78409a02ae21a146c4cd5453bdef88b10
400fc41defa4e25e79e0bdf645c0317ef1aac5b65879eb6572ea9cc60c5f1a5e
47e481a493d04f026f580970f11202249f511bf8e7d362873a0a14706ffe975e
48eef7fe61a3e2c7c88ac1c6a263bd851b6a05363607e52fd2be4e4472d42255
4909664b2cd227fc85ce6fd9d530ec41bef8528f31af916ba9ed95a2cb230823
4ad9a5493aafc1f43e8882aeb9d07b945139ad6326d82a04b5237ee1a3283538
4d22dfdc3a4b880ea008f8ad5b4da8ee444f86321400a2be83bc468c83da1c5c
4e6f2cd344033e402e9a3a5297028b8535d7352829a4ec0c1f61c7879132e6ce
52b269545d8b0251f5f585cfa9572691d8d50a4a55ddcd6c5dd4e5718136e4f5
5746d3d3e64d46bca6c478a9a05b27640fa2f9cd29f99b3106ebed16721248d7
58a28a0a755fb393b8a69834ee61ea85b0a2f0edb0db062a4e5e928028edb882
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
62fd61035104aaa35fe90d9fe8cb52aa5bff1c8685b5825862b3a75bc89a5470
6336f6146b0004f594b94f313f32c6e00ba1750314e6dfe8e73a86d833f22ec7
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6a2f825beb3b540a044cdb0515177c34497aa2ce92e335bf1498fa42bb5baf88
6ebe1e4135bb845bd442e32f716d10da89f715f890bdfe4b71354edb5c7f17f8
6fef5b62fd9d623df26be0846ccfaf8dcf3625a427fd6cbf8d3630db1a869627
74a8d08bfffcc2b091168ebe5d30299c4857f962280f3b214ec64f460587b4c7
7c0b8d5e9b7d24a63fd54cbf0002f396e8de5c44644eb72556d0c2cb78497c37
83342c6d1e4b839f96cd1eb5c48bb78db500c6ebf0ae67b62a599c03e815d662
842581d3ebd410d0439e20ea651261cf05f395b3e53d06a6fefecb317725985b
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
8c0f88c76542a810095f923bfb2190343461e4809e37ba46c4805c1fe4ee9307
8c847dce1cd0746b8168211b5b9b41c397aff2b4d94e3eaeacb41eb572ef6b0b
8d2ed3f7875ce5040835486d25dd82e263e984d9c85987819dce940f79c13f97
8de531ed3fc9724c8b33d6a57316745cd501f3d34be28ee570424c936b525b86
8e0c9ad71fdf2b8553461659e37cfbb453a5a569c5f8c67273cded5fc9e0d2ae
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
902319cc2d2d4f29ed41fb75a5d166a4f81c06eb6f402de843234776fb3e1217
904a1945e008d329ef6330bc09d044aca791656990a9ba0add9b8e7461aff8a7
912aa1e8380e28a95269a2997c3ddf4ec6ceed1f90df5487ada201c88f96536d
92ce9b7eae17ae621370ed9e105d3360affd18431e0c100c76acac7621739a21
9ec4ce4e4230709219ab33c29136a83b12cbaf54388098424a18d63ee6fe7286
9f9f09220578095d79ded54e8c0ee6ef21bc38e86475d2645b8656bbef22bbeb
a371978536745668f9c16dcbdbf0d5ca436d146906664dcc0529f16d70567fdf
a6972c49e66fe3c5026a1a1e26a06c49995cec36fc522cb56461f5cf0b2b2978
a6dee6c73c3fffab45a1d559044b3806b79ce98c1370945608a1121f3badea14
a6fbab70ed837a9233f08368820c775da5c1ce98be0df60488be3916ec747836
aa058084762ccc24b31ccadb0437c5a9863e1d1f675c7494e44f352b3a14d9cb
aacc10887dd04b98aaef2ef28edd9f1d7701c4e533f4490de1dec25e3ed1c10f
ac2cea87b2980e211b88ecc676e39fe1ecf5bb25f3596f94534e6e786e22a962
ac8d539fa2691c69c61152294bdd1bfb5c36c4235d4856ef737533f3f562ef17
acd5a461e585b6daebe6b512b1b486c58859a51db413c98ae041881a0641bfc7
b1aa700c75bd81ca58d45064234bcbedb61dc77ddd65394a7c739b031b2cdcb3
b2ce4d601a16291ec66774c3c0f83bae8715a7e3bfd1b4155e4256f902d21362
b332a3fa616df968bdd71567cde2fe6031561746f6022d06993bde4001ec2730
b5664b220d6d29f411a49a186aa9bf5b5ddf366861ea50c1259402adef251e91
b93680a9f50608d09c147af33f3e897a4b376ff3efb696bb062ed2e0f862d819
b9649e0e9e5790f8d6b5e69aa4ff9969e8f7d72a84f8501ff9379078005124d8
b9d83005e4063452d9acb302b65af86458855e86d18d882925daf717881bb02a
ba71eb07a002e99f2ad394a63e255c6b82739c48b39acf0460248c002c835d6c
bad8b30ab652865aa3436ed59c84c6bfa71ccd25e174dadd792fa09bef62cc59
bd422fe1ca96d3917040ae74dcf9d0cdf9e248f72e92e6e2cd88ae9158b028ee
bee78f076d7ef9d9be92fb1f293909e529c5b61891a52557d51e7183971e02cc
beed8a77bc3034508e3b5d9b994b14064965d55a39d920e8818afbe93bd75559
c0ee9cd232505fc312c60460fdb62192b38a66306b862c185a27a4828331008e
c443dbf6031bb78343d0bc46b1b1375e6311497b72ed843c89fedb018e5963b6
c45f637f905e1ea01ba81aa39e8da62ee7e7f8703c3da4c3bba55f6192e5834c
c5f5fd1f7dc9650e8afc43033aa578d827d4083000a32778ebe888d7199dfd46
c69b1157201ef74f0637c6f06440680d3cd108ca73c825661925ddd891ec3d7a
c9b70899317b4f9929f9b5cf67a0d4400c02cf537e74cc6dd89cf2a507d9a241
ca2428595f920f37d3b750303eae6ba6f9cda8ae9abdd7eeacc5c1e0866349d9
cc6addb827a2a39237154916d2a692464bceb44dc7bd73e7cdeb7150181615b5
cd24f5bed39abff3794a1239dba98000015195dce1486f8bfbcfc364417f49eb
ce70126699d888ff3ee8d1e47d92fd4e581785b047ecef6d4f6373260e5b9b4b
ced035236ef87e76d0e300e6c7c507d982c4a48c99a137f3a7fb61a94cb83688
d0351efa95fd4f68ead466b96016e7f9cdac4de6adbe6e938c308e19688364c0
d18f313f2489ed91cd15cf94a1e5668b8b0da8318f593d980228000a1757702f
d1c90bd20c04adf24d97ff015095058b528a293e12533fcc37a6f4b61970785e
d33cd073dfadc9f9b02d1755dcb0f1db480730776fa00daff8c331e9fdcd8f80
d3f7b0ec4de079928a999641e781e80f33597a392a561bc460276dfb4efb6eec
d6a8b2d8de96a693a7f089ff23c3f7aa66ed14718e0d4464a1df1ffb828c8609
d6ec38d82efa2aa7a5fb4f60ac7cd8408baefa75b6a7281e15bb59a98f0b9ea1
d9fd01231f7ed666f18f59b6b63884a142f7575c577369d8e26693eab528d77f
db69a3d25d8125632acede7426cfaa714390a3a713e8fb38fca4264581341744
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e0d7247f9a18889ae8a68fd56edaa202264826e284c725ce09964a71d1ee663e
e36ce51df6d05a63225d449ba07b002ef1c2cd73b946e21e27456b251449712b
e47442c7c2965e8f0bc4b6fac7647f64bf93d1e468f88adf18cdd651713b5fae
e70d87cc646b752a84f80c2035242c4617184c6de87de95aa178c8d3161e9c97
e84d80292bc4853823a35693f016d26ceeeac38e04aee5d286d933b8973b7d7c
e8eda05fa3bffe9499012fd70f4e296d97d91026b0db3682b2d12be64f005f81
e8eed6c8b6895d63f1a7f0c5917e211e516bcb45cb5cf9726eeb01ca36cca539
e9c370ea9070b144ed45ff5f35c9206112dd1091326ff898f414ef8c12ec85c0
e9f39654eac26623ffbf7e6da9953393cd48b8b6e94d41b1a1cc28a6f4c005da
ea3c802e8d4cf12efe24d09a58f7aebbd24cb0a1aa717dfb16e4b567410261c4
eb103692879e6e072fd50706cdd5adf9af26e46f008e824dc6833a55ceacc641
ee5e1d4fe48e41d970d2517df8e4eec977f66a74c6dfceb8895e022bea26e619
eee66297afe4bfd363c9e7b27978892a34adffde1664ef7509335aff8aa31cc0
f0a4b5cd397df6ad5f6061cbc201cd98c9c808119b643f09a4a2e19d7327394a
f0e37a51f2ce749817083d5705f9da5d198563ede193b737cbf3446796cb1514
f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112
f5f3898fe99aab483801a9f4149fc85c0d9e6281aba989b8b085fce8db09710d
f77e613ee5f3e6d5249fe3ac28450cae2fffef6fdf5ca832117cb88089f87beb
f8f105a0a91843bdeac95e6aff14d7753ca2aaff00c942cf1bcb1da1025cff4c
f90d159c7a961f8d49cf0197de9f4a31f91310b5cd03edc042f82beae766c88b
fa242f524a71571952cc44ed52cca22fae9718a281a24a8bd9029b959fbf1261
faae6fc0aa94cc5bde5076647c817a23206096a1cbeda10d1c6f3d89d6163ed1
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.crowdstrike.com Open in urlscan Pro 2606:4700::6810:b576 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

151 Requests

100 %HTTPS

79 %IPv6

14 Domains

21 Subdomains

19 IPs

4 Countries

9653 kBTransfer

14515 kBSize

13 Cookies

15 Outgoing links

Redirected requests

151 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.crowdstrike.com Open in urlscan Pro
2606:4700::6810:b576 Public Scan

Screenshot
Live screenshot

Full Image

151
Requests

100 %
HTTPS

79 %
IPv6

14
Domains

21
Subdomains

19
IPs

4
Countries

9653 kB
Transfer

14515 kB
Size

13
Cookies

151 HTTP transactions
0 data transactions