Submitted URL: https://sth-community.sans.org/
Effective URL: https://sth-community.sans.org/login
Submission Tags: phishingrod
Submission: On May 28 via api from DE — Scanned from DE

Summary

This website contacted 8 IPs in 2 countries across 6 domains to perform 23 HTTP transactions. The main IP is 35.165.247.157, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is sth-community.sans.org.
TLS certificate: Issued by R3 on March 29th 2024. Valid for: 3 months.
This is the only time sth-community.sans.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 15 35.165.247.157 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 216.58.212.132 15169 (GOOGLE)
1 52.92.148.0 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
23 8
Apex Domain
Subdomains
Transfer
15 sans.org
sth-community.sans.org
283 KB
4 typekit.net
use.typekit.net — Cisco Umbrella Rank: 448
p.typekit.net — Cisco Umbrella Rank: 565
41 KB
2 gstatic.com
www.gstatic.com
fonts.gstatic.com
257 KB
1 amazonaws.com
s3-us-west-2.amazonaws.com
11 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 2
949 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33
2 KB
23 6
Domain Requested by
15 sth-community.sans.org 1 redirects sth-community.sans.org
3 use.typekit.net sth-community.sans.org
1 p.typekit.net
1 fonts.gstatic.com fonts.googleapis.com
1 www.gstatic.com www.google.com
1 s3-us-west-2.amazonaws.com sth-community.sans.org
1 www.google.com sth-community.sans.org
1 fonts.googleapis.com sth-community.sans.org
23 8

This site contains links to these domains. Also see Links.

Domain
community.forumbee.com
forumbee.com
Subject Issuer Validity Valid
sth-community.sans.org
R3
2024-03-29 -
2024-06-27
3 months crt.sh
upload.video.google.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
use.typekit.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-02-01 -
2025-03-03
a year crt.sh
*.google.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2024-05-15 -
2025-05-13
a year crt.sh
*.gstatic.com
WR2
2024-05-06 -
2024-07-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://sth-community.sans.org/login
Frame ID: 1E071B27EB83B57814D7556964D39613
Requests: 23 HTTP requests in this frame

Screenshot

Page Title

Login - SANS Security Awareness Community

Page URL History Show full URLs

  1. https://sth-community.sans.org/ HTTP 302
    https://sth-community.sans.org/login Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

23
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

8
IPs

2
Countries

594 kB
Transfer

1582 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://sth-community.sans.org/ HTTP 302
    https://sth-community.sans.org/login Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

23 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login
sth-community.sans.org/
Redirect Chain
  • https://sth-community.sans.org/
  • https://sth-community.sans.org/login
7 KB
3 KB
Document
General
Full URL
https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
8be96c7239a98d0742edb36de5ca3c324421652b8dd0672acee1293449ce9ad7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate, private
Connection
keep-alive
Content-Encoding
gzip
Content-Language
en
Content-Type
text/html;charset=UTF-8
Date
Tue, 28 May 2024 05:57:42 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=31536000
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Frame-Options
deny
X-Xss-Protection
1; mode=block

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate, private
Connection
keep-alive
Content-Language
en
Content-Length
0
Date
Tue, 28 May 2024 05:57:42 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Location
https://sth-community.sans.org/login
Pragma
no-cache
Server
nginx
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
X-Frame-Options
deny
X-Xss-Protection
1; mode=block
css
fonts.googleapis.com/
11 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,700
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5cccc465f4c8cdcec789a0b28846823f18646206351bc9ff794f1aec7f58f5b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Tue, 28 May 2024 05:57:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 28 May 2024 04:10:34 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 28 May 2024 05:57:42 GMT
gnj8quf.js
use.typekit.net/
16 KB
7 KB
Script
General
Full URL
https://use.typekit.net/gnj8quf.js
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
f09ac3c3108b5c4e7fba6f090f66b25d97624587392896231d254b10e46f76fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Tue, 28 May 2024 05:57:43 GMT
server
nginx
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
6668
ertaiflasnyhivaoz4eannnszvhiklpx.css
sth-community.sans.org/content/csx/
28 KB
7 KB
Stylesheet
General
Full URL
https://sth-community.sans.org/content/csx/ertaiflasnyhivaoz4eannnszvhiklpx.css?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
d627349d976b6889d6a2da8cc4bc911f4fcc67cab7818d37dd40c9af47149051
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:42 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:18 GMT
Server
nginx
ETag
W/"28837-1668729318000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:42 GMT
all.css
sth-community.sans.org/content/fontawesome-pro-5.1.0-web/css/
55 KB
12 KB
Stylesheet
General
Full URL
https://sth-community.sans.org/content/fontawesome-pro-5.1.0-web/css/all.css
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
0a867c996d35277a85a35f5d41e9890bd2f8092ae791362776c0e56f6e494325
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:42 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Wed, 20 Jun 2018 19:48:12 GMT
Server
nginx
ETag
W/"56157-1529524092000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:42 GMT
5cf6sff3mf2v5owr5apjmml6iaergxsq.css
sth-community.sans.org/content/themes/forums/air/csx/
52 KB
9 KB
Stylesheet
General
Full URL
https://sth-community.sans.org/content/themes/forums/air/csx/5cf6sff3mf2v5owr5apjmml6iaergxsq.css?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
66d5dfc672102c0b84d2307b9c720fb7b5334ac2fd5132dd13dedbcc6a221a67
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:22 GMT
Server
nginx
ETag
W/"52783-1668729322000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
f.css
sth-community.sans.org/css/f/
2 KB
1 KB
Stylesheet
General
Full URL
https://sth-community.sans.org/css/f/f.css?res=993699162
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
8567891b932b11034822f4ea0a6f1eb3ad488f628d529b1701bc1c23c91edced
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 01 Jan 1970 00:00:00 GMT
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/css;charset=utf-8
Content-Language
en
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
api.js
www.google.com/recaptcha/
1 KB
949 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?render=explicit
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.212.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f4.1e100.net
Software
GSE /
Resource Hash
4b03ff73b48c813197e1783d5d05339a52b1294f145104c977b9c9af4a4bee6c
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 05:57:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Tue, 28 May 2024 05:57:42 GMT
900.png
s3-us-west-2.amazonaws.com/media.forumbee.com/logos/85dd404f-1a9a-487f-bb57-19d83f1545fa/
10 KB
11 KB
Image
General
Full URL
https://s3-us-west-2.amazonaws.com/media.forumbee.com/logos/85dd404f-1a9a-487f-bb57-19d83f1545fa/900.png
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.92.148.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
864725540481dab6f4e70991ba600c7d64245fc5549deee6da0084c33f4cc89a

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:44 GMT
Last-Modified
Mon, 23 Oct 2017 22:37:48 GMT
Server
AmazonS3
x-amz-request-id
W9ZWEC1K2QXKR42N
ETag
"9b4f00600f68c9c118dd073921c916db"
Content-Type
image/png
Cache-Control
max-age=315360000, public
Accept-Ranges
bytes
Content-Length
10500
x-amz-id-2
zoLKGs6MH2xDPr/cRty/oNlcCfSKYKt9NEqVRGIjQ1JRaQFaYbDEO+a6cCMWdoVC9S+3bhMJbTs=
4r2pul7xz2lh6dcbma5sz7gpwa6xi5eh.js
sth-community.sans.org/content/jsx/
486 KB
116 KB
Script
General
Full URL
https://sth-community.sans.org/content/jsx/4r2pul7xz2lh6dcbma5sz7gpwa6xi5eh.js?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
a4454f508d0610b3ac5233a00e64cc529c7e84fc784eb41d6135865340ccb39f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:34 GMT
Server
nginx
ETag
W/"497170-1668729334000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
c3ej2h4uvrbffueadraj5vqc4xscnw7l.js
sth-community.sans.org/content/jsx/
229 KB
81 KB
Script
General
Full URL
https://sth-community.sans.org/content/jsx/c3ej2h4uvrbffueadraj5vqc4xscnw7l.js?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
0dd7c05cb0f60c72fa56ba0ad83ae3f1b1cb783136441f72cda313802faa4563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:34 GMT
Server
nginx
ETag
W/"234731-1668729334000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
kkwvxr4ibahgrbot2b5sokm2u5i4ow5e.js
sth-community.sans.org/content/jsx/
11 KB
4 KB
Script
General
Full URL
https://sth-community.sans.org/content/jsx/kkwvxr4ibahgrbot2b5sokm2u5i4ow5e.js?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
445b3c4b519e32ebbe88ef4f743e970640480e38a2a52a59d140031adfe21d22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:32 GMT
Server
nginx
ETag
W/"11517-1668729332000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
vuu2suekds6iebjggm3twkff4d6cvlsx.js
sth-community.sans.org/content/jsx/
220 B
611 B
Script
General
Full URL
https://sth-community.sans.org/content/jsx/vuu2suekds6iebjggm3twkff4d6cvlsx.js?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
9658efdf6732f45eebd785779e50d1775ff410fb41da600f0d1bffb281a5f616
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:32 GMT
Server
nginx
ETag
W/"220-1668729332000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
nx3xabcx736xxmr2r3a2j5lnlgfnyahl.js
sth-community.sans.org/content/jsx/
2 KB
1 KB
Script
General
Full URL
https://sth-community.sans.org/content/jsx/nx3xabcx736xxmr2r3a2j5lnlgfnyahl.js?0100527
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
a4097508c465c54143c22b0ea0d72ddb7eb241c1f2b8135352b832057e9ecff5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:43 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Thu, 17 Nov 2022 23:55:32 GMT
Server
nginx
ETag
W/"2109-1668729332000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:43 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/
526 KB
209 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/joHA60MeME-PNviL59xVH9zs/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4689d94dc41ea32f15bc7f216bf276e4cc0dd5125057ecd3d793b4d1daee8a4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Origin
https://sth-community.sans.org
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 27 May 2024 17:41:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
44163
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
213445
x-xss-protection
0
last-modified
Mon, 20 May 2024 04:00:47 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 27 May 2025 17:41:40 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/
47 KB
48 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://fonts.googleapis.com/
Origin
https://sth-community.sans.org
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 24 May 2024 22:45:56 GMT
x-content-type-options
nosniff
age
285107
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 24 May 2025 22:45:56 GMT
l
use.typekit.net/af/27e9f9/000000000000000077359b98/30/
17 KB
17 KB
Font
General
Full URL
https://use.typekit.net/af/27e9f9/000000000000000077359b98/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n3&v=3
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
f50dbe90f4d78d2a924b1f8ba709cac118c1d3cedb5c718c9342e2ff07e48598

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Origin
https://sth-community.sans.org
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 05:57:44 GMT
server
nginx
etag
"a7fd2f141eaa16b082b30693a996c3a717ae70b5"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
17652
localize
sth-community.sans.org/
4 KB
2 KB
XHR
General
Full URL
https://sth-community.sans.org/localize
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/content/jsx/4r2pul7xz2lh6dcbma5sz7gpwa6xi5eh.js?0100527
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
2f71e6bb4ae85132d7ad184ce4eaa6928cc47d7caab584be378b92c7e5900831
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept
application/json, text/javascript, */*; q=0.01
Referer
https://sth-community.sans.org/login
X-Requested-With
XMLHttpRequest
X-CSRFToken
undefined
sec-ch-ua-platform
"Win32"

Response headers

Pragma
no-cache
Date
Tue, 28 May 2024 05:57:44 GMT
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html;charset=utf-8
X-Frame-Options
deny
Content-Language
en
Cache-Control
no-store, no-cache, must-revalidate, private
Connection
keep-alive
X-Xss-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
tz.js
sth-community.sans.org/content/js/fw/tz/
27 KB
11 KB
Script
General
Full URL
https://sth-community.sans.org/content/js/fw/tz/tz.js
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
40b4a7842b68d92d10a22bc08141ba45c2ce366a9302a3f28b516b1de4d4f27d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:44 GMT
Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
Last-Modified
Sun, 24 Jul 2022 20:50:40 GMT
Server
nginx
ETag
W/"27344-1658695840000"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=31622400
Connection
keep-alive
Expires
Thu, 29 May 2025 05:57:44 GMT
l
use.typekit.net/af/9c0b69/000000000000000077359b90/30/
16 KB
17 KB
Font
General
Full URL
https://use.typekit.net/af/9c0b69/000000000000000077359b90/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:1484 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
28c4f405f05390622e94b3cec982a8b28ffddcd6db79edc2fc22088b38ed2e09

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Origin
https://sth-community.sans.org
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 05:57:44 GMT
server
nginx
etag
"04ebd81e92e1091a9503458800e3b1f8c1329e7e"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
16812
p.gif
p.typekit.net/
35 B
206 B
Image
General
Full URL
https://p.typekit.net/p.gif?s=1&k=gnj8quf&ht=tk&h=sth-community.sans.org&f=7027.7029&a=14976&js=1.21.0&app=typekit&e=js&_=1716875864340
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 05:57:44 GMT
last-modified
Fri, 28 Jul 2023 12:40:18 GMT
server
nginx
etag
"64c3b732-23"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
35
favicon.ico
sth-community.sans.org/
34 KB
35 KB
Other
General
Full URL
https://sth-community.sans.org/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
28a4ab333eb4de75150526e7edc2c2d2f761ce3515cc39a5c34bb6ea294c8296
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 05:57:44 GMT
Strict-Transport-Security
max-age=31536000
Last-Modified
Wed, 07 Sep 2016 18:04:00 GMT
Server
nginx
ETag
W/"35114-1473271440000"
Content-Type
image/x-icon
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35114
set
sth-community.sans.org/z/
0
790 B
XHR
General
Full URL
https://sth-community.sans.org/z/set
Requested by
Host: sth-community.sans.org
URL: https://sth-community.sans.org/content/js/fw/tz/tz.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.165.247.157 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-165-247-157.us-west-2.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://sth-community.sans.org/login
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryhJj45EjVjooQUBYa

Response headers

Pragma
no-cache
Date
Tue, 28 May 2024 05:57:44 GMT
Strict-Transport-Security
max-age=31536000
X-Content-Type-Options
nosniff
Server
nginx
X-Frame-Options
deny
Content-Type
text/html;charset=utf-8
Content-Language
en
Cache-Control
no-store, no-cache, must-revalidate, private
Connection
keep-alive
Content-Length
0
X-Xss-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

47 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Typekit object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| pagestate function| Intercom function| throttle function| debounce function| throttle2 function| blockEvent function| HtmlEncode function| $ function| jQuery function| Class function| moment function| autosize boolean| isHD function| codePrint object| blockEventMap function| Retina function| RetinaImage object| angular object| angularRootApp function| bootAngularElement function| custom function| makeValidateLookupOptions function| Frm function| Req function| Max function| Reg function| Val object| fLogin object| btnLogin object| btnClose object| frm boolean| busy object| inputs boolean| render object| re object| el function| showWait function| hideWait object| tz object| recaptcha object| platform object| jstz

3 Cookies

Domain/Path Name / Value
sth-community.sans.org/ Name: sid9
Value: 34y39vbwzyljowkixc6pd3z5zq3flggdkt44rqm6
sth-community.sans.org/ Name: csrf
Value: jgr2ksj752i800oj83cuqd3phc
sth-community.sans.org/ Name: cli9
Value: OWMwMWE4MDA4OWJlZmNmMmE3ZmYxNDAzY2UzODdiYzdhYTA5NDEyYjZmNTg2ZGVmYTdlYTQ4ZDM0Nzc0ZDBhZCxmQT09

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
p.typekit.net
s3-us-west-2.amazonaws.com
sth-community.sans.org
use.typekit.net
www.google.com
www.gstatic.com
216.58.212.132
2a00:1450:4001:808::200a
2a00:1450:4001:810::2003
2a00:1450:4001:812::2003
2a02:26f0:3500:16::215:1484
2a02:26f0:3500:16::215:148b
35.165.247.157
52.92.148.0
0a867c996d35277a85a35f5d41e9890bd2f8092ae791362776c0e56f6e494325
0dd7c05cb0f60c72fa56ba0ad83ae3f1b1cb783136441f72cda313802faa4563
28a4ab333eb4de75150526e7edc2c2d2f761ce3515cc39a5c34bb6ea294c8296
28c4f405f05390622e94b3cec982a8b28ffddcd6db79edc2fc22088b38ed2e09
2f71e6bb4ae85132d7ad184ce4eaa6928cc47d7caab584be378b92c7e5900831
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
40b4a7842b68d92d10a22bc08141ba45c2ce366a9302a3f28b516b1de4d4f27d
445b3c4b519e32ebbe88ef4f743e970640480e38a2a52a59d140031adfe21d22
4689d94dc41ea32f15bc7f216bf276e4cc0dd5125057ecd3d793b4d1daee8a4f
4b03ff73b48c813197e1783d5d05339a52b1294f145104c977b9c9af4a4bee6c
5cccc465f4c8cdcec789a0b28846823f18646206351bc9ff794f1aec7f58f5b0
66d5dfc672102c0b84d2307b9c720fb7b5334ac2fd5132dd13dedbcc6a221a67
8567891b932b11034822f4ea0a6f1eb3ad488f628d529b1701bc1c23c91edced
864725540481dab6f4e70991ba600c7d64245fc5549deee6da0084c33f4cc89a
8be96c7239a98d0742edb36de5ca3c324421652b8dd0672acee1293449ce9ad7
9658efdf6732f45eebd785779e50d1775ff410fb41da600f0d1bffb281a5f616
9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39
a4097508c465c54143c22b0ea0d72ddb7eb241c1f2b8135352b832057e9ecff5
a4454f508d0610b3ac5233a00e64cc529c7e84fc784eb41d6135865340ccb39f
d627349d976b6889d6a2da8cc4bc911f4fcc67cab7818d37dd40c9af47149051
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f09ac3c3108b5c4e7fba6f090f66b25d97624587392896231d254b10e46f76fb
f50dbe90f4d78d2a924b1f8ba709cac118c1d3cedb5c718c9342e2ff07e48598