Submitted URL: https://t.co/5hpj6FmgS5
Effective URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_so...
Submission: On December 02 via api from US — Scanned from DE

Summary

This website contacted 46 IPs in 5 countries across 36 domains to perform 223 HTTP transactions. The main IP is 92.123.14.222, located in Vienna, Austria and belongs to AKAMAI-AS, US. The main domain is www.trendmicro.com.
TLS certificate: Issued by Entrust Certification Authority - L1M on July 15th 2021. Valid for: a year.
This is the only time www.trendmicro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 104.244.42.197 13414 (TWITTER)
1 1 67.199.248.12 396982 (GOOGLE-PR...)
15 92.123.14.222 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:10:... 13335 (CLOUDFLAR...)
13 184.51.8.191 16625 (AKAMAI-AS)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
6 184.51.8.183 16625 (AKAMAI-AS)
6 34.96.102.137 15169 (GOOGLE)
1 35.201.125.192 15169 (GOOGLE)
1 34.102.193.142 15169 (GOOGLE)
1 27 2600:9000:225... 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.190.5.192 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 34.95.105.148 15169 (GOOGLE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 3 142.250.186.102 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 172.217.18.98 15169 (GOOGLE)
1 143.204.94.161 16509 (AMAZON-02)
1 1 35.201.70.94 15169 (GOOGLE)
2 2 68.67.153.60 29990 (ASN-APPNEX)
3 4 185.33.220.100 29990 (ASN-APPNEX)
2 2600:9000:215... 16509 (AMAZON-02)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 23.202.53.245 16625 (AKAMAI-AS)
2 2.21.140.111 16625 (AKAMAI-AS)
1 104.17.71.206 13335 (CLOUDFLAR...)
1 1 167.172.136.187 14061 (DIGITALOC...)
1 2 206.189.187.108 14061 (DIGITALOC...)
8 104.111.233.140 16625 (AKAMAI-AS)
62 143.204.205.97 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 104.96.148.88 16625 (AKAMAI-AS)
1 192.28.144.124 15224 (OMNITURE)
2 35.158.71.178 16509 (AMAZON-02)
2 161.35.15.77 14061 (DIGITALOC...)
1 35.71.131.137 16509 (AMAZON-02)
1 2 92.123.194.169 20940 (AKAMAI-ASN1)
1 1 2a02:26f0:ef:... 20940 (AKAMAI-ASN1)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
4 34.193.113.164 14618 (AMAZON-AES)
2 3.94.218.138 14618 (AMAZON-AES)
1 143.204.98.9 16509 (AMAZON-02)
223 46
Apex Domain
Subdomains
Transfer
62 driftt.com
js.driftt.com
741 KB
30 bc0a.com
cdn.bc0a.com
ixfd1-api.bc0a.com
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
558 KB
17 trendmicro.com
research.trendmicro.com
www.trendmicro.com
resources.trendmicro.com
392 KB
13 tiqcdn.com
tags.tiqcdn.com
48 KB
8 6sc.co
j.6sc.co
c.6sc.co
b.6sc.co
14 KB
7 addthis.com
s7.addthis.com
m.addthis.com
api-public.addthis.com
218 KB
6 drift.com
metrics.api.drift.com
bootstrap.api.drift.com
433 B
6 google-analytics.com
ssl.google-analytics.com
www.google-analytics.com
39 KB
6 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com
180 KB
5 doubleclick.net
5427711.fls.doubleclick.net
googleads.g.doubleclick.net
3 KB
4 akamaihd.net
trial-eum-clientnsv4-s.akamaihd.net
yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net
1 KB
4 acsbapp.com
acsbapp.com
cdn.acsbapp.com
163 KB
4 adnxs.com
secure.adnxs.com
4 KB
3 google.com
www.google.com
adservice.google.com
1 KB
3 bing.com
bat.bing.com
11 KB
2 6sense.com
epsilon.6sense.com
656 B
2 marketo.net
munchkin.marketo.net
6 KB
2 google.de
www.google.de
612 B
2 ml-api.io
attr.ml-api.io
484 B
2 ml-attr.com
s.ml-attr.com
566 B
2 adsrvr.org
js.adsrvr.org
insight.adsrvr.org
3 KB
2 googleadservices.com
www.googleadservices.com
16 KB
2 googletagmanager.com
www.googletagmanager.com
113 KB
2 b0e8.com
cdn.b0e8.com
a.b0e8.com
22 KB
2 youtube.com
www.youtube.com
49 KB
2 go-mpulse.net
s.go-mpulse.net
c.go-mpulse.net
51 KB
2 cludo.com
customer.cludo.com
57 KB
1 driftcdn.com
embeds.driftcdn.com
10 KB
1 akstat.io
0217991a.akstat.io
204 B
1 mktoresp.com
945-cxd-062.mktoresp.com
311 B
1 acsbap.com
acsbap.com
85 B
1 addthisedge.com
v1.addthisedge.com
1 KB
1 moatads.com
z.moatads.com
1 KB
1 gstatic.com
fonts.gstatic.com
44 KB
1 googleapis.com
fonts.googleapis.com
1 KB
1 t.co
t.co
620 B
223 36
Domain Requested by
62 js.driftt.com tags.tiqcdn.com
js.driftt.com
27 marvel-b1-cdn.bc0a.com 1 redirects www.trendmicro.com
15 www.trendmicro.com t.co
www.trendmicro.com
s.go-mpulse.net
13 tags.tiqcdn.com www.trendmicro.com
tags.tiqcdn.com
6 b.6sc.co www.trendmicro.com
6 dev.visualwebsiteoptimizer.com tags.tiqcdn.com
dev.visualwebsiteoptimizer.com
www.trendmicro.com
s.go-mpulse.net
4 metrics.api.drift.com js.driftt.com
4 www.google-analytics.com tags.tiqcdn.com
www.google-analytics.com
s.go-mpulse.net
4 secure.adnxs.com 3 redirects s.go-mpulse.net
3 api-public.addthis.com s.go-mpulse.net
s7.addthis.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.trendmicro.com
3 5427711.fls.doubleclick.net 1 redirects www.googletagmanager.com
www.trendmicro.com
3 s7.addthis.com www.trendmicro.com
s7.addthis.com
2 bootstrap.api.drift.com js.driftt.com
2 cdn.acsbapp.com acsbap.com
2 epsilon.6sense.com s.go-mpulse.net
2 munchkin.marketo.net tags.tiqcdn.com
munchkin.marketo.net
2 ssl.google-analytics.com tags.tiqcdn.com
www.trendmicro.com
2 acsbapp.com 1 redirects www.trendmicro.com
2 www.google.de www.trendmicro.com
2 www.google.com 1 redirects www.trendmicro.com
2 googleads.g.doubleclick.net 1 redirects www.googleadservices.com
2 attr.ml-api.io www.trendmicro.com
2 s.ml-attr.com 2 redirects
2 www.googleadservices.com www.googletagmanager.com
www.googleadservices.com
2 www.googletagmanager.com tags.tiqcdn.com
2 www.youtube.com www.trendmicro.com
www.youtube.com
2 customer.cludo.com www.trendmicro.com
1 embeds.driftcdn.com js.driftt.com
1 0217991a.akstat.io s.go-mpulse.net
1 eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net
1 trial-eum-clienttons-s.akamaihd.net 1 redirects
1 yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net
1 trial-eum-clientnsv4-s.akamaihd.net 1 redirects
1 insight.adsrvr.org js.adsrvr.org
1 c.6sc.co s.go-mpulse.net
1 945-cxd-062.mktoresp.com munchkin.marketo.net
1 j.6sc.co tags.tiqcdn.com
1 acsbap.com 1 redirects
1 resources.trendmicro.com tags.tiqcdn.com
1 m.addthis.com s7.addthis.com
1 v1.addthisedge.com s7.addthis.com
1 z.moatads.com s7.addthis.com
1 adservice.google.com 5427711.fls.doubleclick.net
1 marvel-processor.bc0a.com 1 redirects
1 js.adsrvr.org www.googletagmanager.com
1 c.go-mpulse.net s.go-mpulse.net
1 a.b0e8.com www.trendmicro.com
1 cdn.b0e8.com t.co
1 fonts.gstatic.com fonts.googleapis.com
1 ixfd1-api.bc0a.com cdn.bc0a.com
1 cdn.bc0a.com tags.tiqcdn.com
1 s.go-mpulse.net www.trendmicro.com
1 fonts.googleapis.com www.trendmicro.com
1 research.trendmicro.com 1 redirects
1 t.co
223 56
Subject Issuer Validity Valid
t.co
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
www.trendmicro.com
Entrust Certification Authority - L1M
2021-07-15 -
2022-08-13
a year crt.sh
upload.video.google.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
*.cludo.com
AlphaSSL CA - SHA256 - G2
2021-04-06 -
2022-05-08
a year crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2021-04-19 -
2022-04-27
a year crt.sh
akstat.io
DigiCert SHA2 Secure Server CA
2021-06-08 -
2022-06-13
a year crt.sh
*.google.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2021-04-25 -
2022-04-27
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2020-06-19 -
2022-07-06
2 years crt.sh
cdn.bc0a.com
GTS CA 1D4
2021-10-25 -
2022-01-23
3 months crt.sh
ixfd-api.bc0a.com
GTS CA 1D4
2021-10-27 -
2022-01-25
3 months crt.sh
marvel-cdn.bc0a.com
Amazon
2021-03-10 -
2022-04-08
a year crt.sh
*.gstatic.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
cdn.b0e8.com
GTS CA 1D4
2021-10-20 -
2022-01-18
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
b0e8.com
GTS CA 1D4
2021-10-25 -
2022-01-23
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2021-09-30 -
2022-03-30
6 months crt.sh
www.googleadservices.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2021-03-18 -
2022-04-19
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
www.google.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
www.google.de
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-01-21 -
2022-01-25
a year crt.sh
resources.trendmicro.com
Cloudflare Inc ECC CA-3
2021-06-24 -
2022-06-23
a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA
2021-03-09 -
2022-03-16
a year crt.sh
drift.com
Amazon
2021-09-08 -
2022-10-07
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
*.googleadservices.com
GTS CA 1C3
2021-11-01 -
2022-01-24
3 months crt.sh
*.mktoresp.com
DigiCert SHA2 Secure Server CA
2020-01-17 -
2022-01-21
2 years crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.6sense.com
Amazon
2021-06-30 -
2022-07-29
a year crt.sh
*.acsbapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2021-09-23 -
2022-10-05
a year crt.sh
*.driftcdn.com
Amazon
2021-03-12 -
2022-04-10
a year crt.sh

This page contains 8 frames:

Primary Page: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Frame ID: 2DF284B23F906E36AFC1A1507BBB42D1
Requests: 145 HTTP requests in this frame

Frame: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Frame ID: CDB0439D351081F8036952AF27F237B5
Requests: 4 HTTP requests in this frame

Frame: https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell
Frame ID: DC6B554D3DB4CFEA6A59286040D90D15
Requests: 2 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 379A11EF3A241AB00497A0530FC0747F
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7A488B65C8A6449F0256FF53841EC185
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Frame ID: C4214D1209D7C90EDF6C4919FD5F5EAD
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Frame ID: 39155F2DC4770D4211445F96F1950A54
Requests: 32 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&upid=803df29&upv=1.1.0
Frame ID: 9478249AA4198A70D79C3DBFC6CDB87E
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Analyzing ProxyShell-related Incidents via Trend Micro Managed XDRFacebookTwitterPrintAddThis

Page URL History Show full URLs

  1. https://t.co/5hpj6FmgS5 Page URL
  2. https://research.trendmicro.com/30re6U1 HTTP 301
    https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-m... Page URL

Page Statistics

223
Requests

85 %
HTTPS

36 %
IPv6

36
Domains

56
Subdomains

46
IPs

5
Countries

2745 kB
Transfer

8626 kB
Size

44
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://t.co/5hpj6FmgS5 Page URL
  2. https://research.trendmicro.com/30re6U1 HTTP 301
    https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 87
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell HTTP 302
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell
Request Chain 92
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Request Chain 117
  • https://acsbap.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/assets/js/acsb.js HTTP 301
  • https://acsbapp.com/apps/app/dist/js/app.js
Request Chain 127
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=WO-oYc_wE4uH7gPSxhk&sscte=1&crd= HTTP 302
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=WO-oYc_wE4uH7gPSxhk&cid=CAQSKQCNIrLMxx1lJBYqZ0rhBzuVJFWvgV5Vd4RO3pGlATAzdE5c-H-1tmyX&random=1495401795&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=WO-oYc_wE4uH7gPSxhk&cid=CAQSKQCNIrLMxx1lJBYqZ0rhBzuVJFWvgV5Vd4RO3pGlATAzdE5c-H-1tmyX&random=1495401795&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Request Chain 142
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID HTTP 302
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Request Chain 195
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pme818pgf HTTP 302
  • https://yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net/eum/results.txt
Request Chain 196
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pme818pgf HTTP 302
  • https://eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net/eum/results.txt

223 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
5hpj6FmgS5
t.co/
272 B
620 B
Document
General
Full URL
https://t.co/5hpj6FmgS5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 02 Dec 2021 16:07:49 GMT
vary
Origin
server
tsa_o
expires
Thu, 02 Dec 2021 16:12:49 GMT
content-type
text/html; charset=utf-8
cache-control
private,max-age=300
content-length
186
content-encoding
gzip
x-xss-protection
0
strict-transport-security
max-age=0
x-response-time
122
x-connection-hash
3da99179e50563224fea39332c717831fe1ea4d2b5caf21fd403569fb5861eff
Primary Request analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
www.trendmicro.com/en_us/research/21/k/
Redirect Chain
  • https://research.trendmicro.com/30re6U1
  • https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
114 KB
23 KB
Document
General
Full URL
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Requested by
Host: t.co
URL: https://t.co/5hpj6FmgS5
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
b2f3541761e551d25978dc767a275234766081fefb02f7831fc39a43a168e31b
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://t.co/5hpj6FmgS5

Response headers

server
nginx
content-type
text/html;charset=utf-8
x-prod-a-01
Yes
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-xss-protection
1;mode=block
x-prod-n-02
Yes
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
content-encoding
gzip
content-length
23352
vary
Accept-Encoding
date
Thu, 02 Dec 2021 16:07:50 GMT

Redirect headers

cache-control
private, max-age=90
content-security-policy
referrer always;
content-type
text/html; charset=utf-8
date
Thu, 02 Dec 2021 16:07:49 GMT
location
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
referrer-policy
unsafe-url
server
nginx
strict-transport-security
max-age=1209600
content-length
285
jquery.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
111 KB
38 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/jquery.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Tue, 04 May 2021 00:44:02 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 02 Dec 2021 16:07:50 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
38507
x-xss-protection
1;mode=block
utils.min.js
www.trendmicro.com/etc.clientlibs/clientlibs/granite/
10 KB
4 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/clientlibs/granite/utils.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Fri, 21 Jun 2019 19:39:05 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 02 Dec 2021 16:07:50 GMT
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
3706
x-xss-protection
1;mode=block
css
fonts.googleapis.com/
13 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cc830f158471cfce3f5d5b6279b9e37d764630e9d6e262e7665a9752bb1f2aa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 16:07:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Thu, 02 Dec 2021 16:07:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 02 Dec 2021 16:07:50 GMT
cludo-search.min.css
customer.cludo.com/css/296/1798/
16 KB
3 KB
Stylesheet
General
Full URL
https://customer.cludo.com/css/296/1798/cludo-search.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 01 Dec 2021 17:07:50 GMT
server
cloudflare
age
28761
etag
W/"0375df8d5e6d71:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
6b75cf7fbb193743-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-lb
2
clientlib-trendresearch.min.css
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
263 KB
37 KB
Stylesheet
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
10a093e78973bdaa53efc972c9fac045870395e160e43a3c9a936f6104c0a9a2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 18 Nov 2021 18:12:51 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:50 GMT
x-frame-options
SAMEORIGIN
content-type
text/css;charset=utf-8
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
37438
x-xss-protection
1;mode=block
utag.sync.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f800e98034c8d8e1e4824ffcf6df7c4cb56854ccaa77eaeeb1eb259c691aa263

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:50 GMT
content-encoding
gzip
last-modified
Wed, 01 Dec 2021 16:58:30 GMT
server
AkamaiNetStorage
etag
"50a8c3843a908f3ad6ffd915ad25793b:1638377910.171622"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
966
expires
Thu, 02 Dec 2021 16:12:50 GMT
logo-desktop.png
www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
0
0

project-2030-nav-banner.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/global/navigation/
0
0

search-script.js
customer.cludo.com/scripts/bundles/
289 KB
54 KB
Script
General
Full URL
https://customer.cludo.com/scripts/bundles/search-script.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::ac43:1b98 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db627e3f7737a82b02d8d4945c834c40a9388f8db5c94025f57fb1a99db62253

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 01 Dec 2021 00:10:18 GMT
server
cloudflare
age
58
etag
W/"05189d247e6d71:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=300
cf-ray
6b75cf7fbb1b3743-MXP
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-lb
4
TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
s.go-mpulse.net/boomerang/ Frame CDB0
205 KB
49 KB
Script
General
Full URL
https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:50 GMT
content-encoding
br
last-modified
Mon, 20 Sep 2021 13:03:11 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=604800
timing-allow-origin
*
content-length
50393
share-more.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
648 B
912 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/share-more.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=460
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
648
x-xss-protection
1;mode=block
expires
Thu, 02 Dec 2021 16:15:32 GMT
printer.svg
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/
409 B
673 B
Image
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/img/printer.svg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
image/svg+xml
cache-control
max-age=552
x-content-type-options
nosniff
x-prod-n-01
Yes
content-length
409
x-xss-protection
1;mode=block
expires
Thu, 02 Dec 2021 16:17:04 GMT
proxyshell-xdr-1.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-2.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-3-b.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-4-a.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-4-b.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-5.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-6.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-7.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-7-b.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-7-c.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-8.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-9.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-10.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-11.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-12-a.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-12-b.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-13-a.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-13-b.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-14.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-15.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-16.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-17.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-18.JPG
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

proxyshell-xdr-19.jpg
www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
0
0

sly.min.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
18 KB
7 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/sly.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
x-prod-n-01
Yes
content-length
7185
x-xss-protection
1;mode=block
last-modified
Thu, 02 Dec 2021 12:51:14 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:51 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript
vary
Accept-Encoding
cache-control
max-age=1503
etag
"48de-5d2293ee41166"
accept-ranges
bytes
x-content-type-options
nosniff
expires
Thu, 02 Dec 2021 16:32:54 GMT
jwplayer.js
www.trendmicro.com/content/dam/trendmicro/global/core-library/
81 KB
26 KB
Script
General
Full URL
https://www.trendmicro.com/content/dam/trendmicro/global/core-library/jwplayer.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
content-length
26353
x-xss-protection
1;mode=block
last-modified
Thu, 02 Dec 2021 12:52:50 GMT
server
nginx
x-frame-options
SAMEORIGIN
date
Thu, 02 Dec 2021 16:07:51 GMT
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=1674
etag
"1457a-5d22944a6e6bd"
x-prod-n-02
Yes
accept-ranges
bytes
x-content-type-options
nosniff
expires
Thu, 02 Dec 2021 16:35:45 GMT
iframe_api
www.youtube.com/
980 B
1 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
da00ef9657c42042dccf096ce357b5062c144bf65eece9b2f823be34c0d3d824
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
ESF
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
report-to
{"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]}
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"
expires
Thu, 02 Dec 2021 16:07:51 GMT
clientlib-trendresearch.min.js
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/
390 KB
115 KB
Script
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
8335336c1d70b1722df3b07b921471092c56120ea02781181d6bd75b6dc0ffa3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 21 Oct 2021 17:11:28 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:51 GMT
x-frame-options
SAMEORIGIN
content-type
application/javascript;charset=utf-8
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
117653
x-xss-protection
1;mode=block
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Thu, 02 Dec 2021 16:07:51 GMT
x-host
s7.addthis.com
content-length
116382
j.php
dev.visualwebsiteoptimizer.com/
7 KB
3 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&f=1&r=0.9122234779389737
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
7964c33dac5701ee3dc265c4b79fa45f10f13258a80986ea61c17c8460195f00

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin
*
date
Thu, 02 Dec 2021 16:07:50 GMT
via
1.1 google
server
gfra1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
autopilot_sdk.js
cdn.bc0a.com/autopilot/f00000000017219/
45 KB
16 KB
Script
General
Full URL
https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.201.125.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.125.201.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
16a82f9d8888d0159e73c5cb69d6aa12c00d1e43280afd005b394c8cef670908

Request headers

Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

x-goog-meta-marvel_enabled
true
content-encoding
gzip
age
3571
x-guploader-uploadid
ADPycdvykPbOEiGAXAPhts-vlW4ZfGC19JqKWDVblY5cxE8HMQHmjj58X-LsDOy9i2at1R07U8rWSygxIgVOCKlWN9o
x-goog-meta-sdk_canonical_host
x-goog-meta-sdk_whitelist
x-goog-stored-content-encoding
gzip
x-goog-meta-publishingdate
2021-09-15 23:32:39
x-goog-meta-sdk_canonical_protocol
etag
"f457036f35e0577554f93d8a52c1cfb9"
vary
Accept-Encoding
x-goog-generation
1631748759512601
content-language
en
access-control-allow-origin
*
x-goog-meta-custom
true
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-meta-spa
false
expires
Thu, 02 Dec 2021 16:08:20 GMT
x-goog-meta-sdk_version
1.5.1
date
Thu, 02 Dec 2021 15:08:20 GMT
x-goog-meta-sdk_account_id
f00000000017219
x-goog-meta-sdk_request_parameters_case_sensitive
false
x-goog-meta-marvel_config_consistency_custom
{"data-url":"dataservice.tmok.tm/tc.png","data-customerid":"f00000000017219"}
x-goog-storage-class
MULTI_REGIONAL
x-goog-meta-marvel_customer_id
x-goog-metageneration
3
alt-svc
clear
content-length
15470
x-goog-meta-content_only
false
x-goog-meta-sdk_log_level
2
last-modified
Wed, 15 Sep 2021 23:32:39 GMT
server
UploadServer
x-goog-hash
crc32c=Jb2FaA==, md5=9FcDbzXgV3VU+T2KUsHPuQ==
x-goog-stored-content-length
15470
accept-ranges
bytes
content-type
application/javascript
x-goog-meta-marvel_test_mode
false
x-goog-meta-disable_debug_elements
false
01048301070
ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/
6 KB
1 KB
XHR
General
Full URL
https://ixfd1-api.bc0a.com/api/ixf/1.0.0/get_capsule/f00000000017219/01048301070?client=js_sdk&client_version=1.5.1&orig_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&base_url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html&user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F96.0.4664.45%20Safari%2F537.36
Requested by
Host: cdn.bc0a.com
URL: https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.193.142 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
142.193.102.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-be-pop
BRU-1-302
date
Thu, 02 Dec 2021 16:07:46 GMT
content-encoding
br
server
bws/1.0
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via
1.1 google
utag.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
122 KB
27 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1a6d635ba5c654806a0d313b7139671f0b548c621566d0821e1d514de02fd5d1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
last-modified
Wed, 01 Dec 2021 16:58:30 GMT
server
AkamaiNetStorage
etag
"6eae265fa414c630aac06d6faafb97e6:1638377910.597116"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
content-length
27600
expires
Thu, 02 Dec 2021 16:12:51 GMT
logo-desktop.png
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/
5 KB
6 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
.uO9R1UDQbX.a.ec1EBzTChqhFVbU71g
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"52561d918e54912574b9ed5bb5993edb"
age
47737
x-cache
Hit from cloudfront
x-amz-request-id
KG65VJEHAZ4SM1N4
x-amz-id-2
q8C0FvKMtb50lNESfo4+FGL5uoWeTGWj46WCm5yfgUlCKBUcZ2mmKUGQa/RYZDyRUlJks8m/PqY=
accept-ranges
bytes
last-modified
Wed, 14 Jul 2021 16:32:28 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 02:52:15 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
5310
x-amz-cf-id
CiJagyUSc--RsxYEc7leNqJHINCgvWvwkboMmA_FjxG4BbpvawCoSA==
project-2030-nav-banner.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/navigation/
6 KB
7 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/global/navigation/project-2030-nav-banner.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c1e7cad13c931a7983055f5d464d4a63b91f8557c97cd8645892394ce124316a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
EKA09Hnr_6hSndB_Qa1BwZixxAXf04th
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"97d11a5c76cad9f77398f1a2a8ebc885"
age
46339
x-cache
Hit from cloudfront
x-amz-request-id
584DNPGFZJATRGBA
x-amz-id-2
L6y8Z6hPVufZ9pPIH8D+d5twXs/y0R40xi7Tb5+PM3gGpWea3cxn97s2pC6FVqTOw9wq0lgEw80=
accept-ranges
bytes
last-modified
Thu, 04 Nov 2021 04:15:48 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 03:15:33 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
6458
x-amz-cf-id
svbm-YcGmfacr_DqQAZFUL3RG8f5vjqC5haEtvClkFE7eRJPt-9lyg==
icomoon.ttf
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/
24 KB
14 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/icomoon.ttf
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
5551a75c064d136e9a4c7362cc7df65b712451ed176532dcdf42dda4fd31814a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
content-encoding
gzip
x-prod-a-01
Yes
last-modified
Thu, 29 Jul 2021 17:10:17 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-ttf
cache-control
public, max-age=248
x-content-type-options
nosniff
x-prod-n-02
Yes
vary
Accept-Encoding
content-length
14192
x-xss-protection
1;mode=block
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/
44 KB
44 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 26 Nov 2021 13:52:02 GMT
x-content-type-options
nosniff
age
526549
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44656
x-xss-protection
0
last-modified
Thu, 28 Oct 2021 00:30:43 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Sat, 26 Nov 2022 13:52:02 GMT
proxyshell-xdr-1.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
34 KB
35 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-1.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3166f2afad5a93b28c8279e01efba0a7a52134a7bd32c33f17a3bd6f909c77af

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
cQo92Lby6p82RK7LwqeBaAcN78QRubUc
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"b9a0101e65b44b4369351130bae6d3cd"
age
31023
x-cache
Hit from cloudfront
x-amz-request-id
07KQE033QZ71H1GZ
x-amz-id-2
4KIbP/laprxVxKar18dJF7vlLvKG5V54qFdMiZH6g36u2+9h6bban352iMr08JxU8zn/uvMPjdw=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:25 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:49 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
35126
x-amz-cf-id
pf9mJm1YxZYsRadSwcsJanrzLt8aw7I3CBUNAf7Pb0RhgxTKE9l0LQ==
proxyshell-xdr-2.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
33 KB
34 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-2.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cd62dbd19af2c21731383cb00355a1de74247224a7df74154792f2ba336e412b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 07:30:51 GMT
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
age
31021
x-cache
Hit from cloudfront
x-amz-request-id
C2ZK3F4FV5BSPN96
x-amz-id-2
fb3NToaRLVf8nlb4bDntmHprKQGi8xanWs29Wi81iXKv7SoaiYZGPTPA4jS2I8NCQCsaxLbZT5w=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:25 GMT
server
AmazonS3
etag
"e760b2c1aa50340fb2ad659e5e169f9a"
x-amz-version-id
isdU4hzHs1Vj7uSNWDjsKCZ8.PCKemi.
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
34264
content-type
image/webp
x-amz-cf-id
bnUxNlK10Z9xVqBD2YU9YN0pF7fHECqljFThONySpZAQhprqlz3o3Q==
proxyshell-xdr-3-b.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
4 KB
5 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-3-b.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4e00181505e8a1efde1c9b3d9e49e966c64eb830b3fe0f7a8b113e9d8c9d8bea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
hj82h8JVrXiZrQxT0L24nOtR3S5YbFY2
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"853fddbce76c7bc4991a122827bdbe04"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
3MGE8X0GXP2DFP7Z
x-amz-id-2
tIuIviCn4PJm1hCLo8CKcXES43QwgN1T79EFHbe8GlUDrzunQT1L/3X2eV8REw391B14QAyUUZ4=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:26 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
4264
x-amz-cf-id
jai-Uy9gTEXDQhlqXmrf8n_Ty8MUJd92WiiXx1Q7PU0k0WB2aJrCmg==
proxyshell-xdr-4-a.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
6 KB
7 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-4-a.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1741d89133e0524732a863e38fdbacce2ca8fd77eb3bffb0275de3d946ff5524

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
l5XUhsnzjWpBgLqLLphIyL1m9XbYP8KZ
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"7b9e938eb1c72e5e1e1b1bae89429118"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
BF56DBSZ5747EJKY
x-amz-id-2
O17eXLZXs62z8q3DV7K+yMSi9oqw9WpUWymN9WV5kh+avNHVUYgGGAab7ii4soUWSdeUCUzHgcU=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:28 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
6310
x-amz-cf-id
MCfkwY_bvAZLd5oAXhJLWgkHb7accEjFVObP_J0zUye8Fjp8Qqcz2w==
proxyshell-xdr-4-b.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
8 KB
8 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-4-b.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
50d3a335e5589e6fa53f86edee68f3914dc9403beee9d8e1aaf8b085e686447f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
2Mx4DMwBNwue7.YbEA7F7VD04vceBfBJ
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"6d6733461507085a90e36bb8f79e8bc1"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
BF53WTG97JQRSSHT
x-amz-id-2
0hiFWtSEabkSwtTAxt+qV9QNo1jbnP4hBvPNc2cewziwLMp+M+bEV58GebB8jXAf+oOwQlKz5N4=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:26 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
7964
x-amz-cf-id
8SjaDBANuzW87Hte4O6kiBFwsOMrn9u74-IL1puLfIabw07LY7unMA==
proxyshell-xdr-5.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
15 KB
15 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-5.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4ca89be81af6e10da3c132c1154e1fb98dabd27bb35715c1ba2378ebf998119d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
Tt9z7.K0HtwrCVvT7mOwFK_RTTUlK1i6
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"aa4d444dc2d26a1ab4eff62055bba6d4"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
BF57Y2GWFJ5JHB26
x-amz-id-2
IeoaUi4P21NXWD5pz+9wrKApa4Olb2WwOr8ZpE1lV3SpGfhWOGMNOvExvb7nqrO5gY/9t+4/HNA=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:29 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
15056
x-amz-cf-id
bInQV3o7S-UfO4WyI63a6Qnxpg4FrV3FioB4_6iMVMxxMGUcbGKZyA==
proxyshell-xdr-6.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
3 KB
3 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-6.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4dddf08e6f56bf5b28ece6ba36e94f9a398b5549f36e67a74c9562e27bbf9402

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
rJv9rVpIjNlxIFsoUGx97hQkyNZPRjEc
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"3199e2ff5dfe0afc8d80804485e4aa48"
age
31021
x-cache
Hit from cloudfront
x-amz-request-id
07KS384X69YZEX7Y
x-amz-id-2
D2KhClXytE6gvhM0j/j1zJmWYvaf3iN5PpqaA1KifRULhrPHaqFHKfzFmPNrb26tADPNc9jfCMg=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:27 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:51 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
2844
x-amz-cf-id
ST7KPG9XkffKYHTOEyoiu8GT5Us50bukcra5Tp0nfdYBnFMoTZKfxQ==
proxyshell-xdr-7.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
3 KB
3 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cba25a298b3e668425865beb284073266936c68dd7619af2ef58ce6e197ff529

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
hpY4NwWzo7WjbgGOkAxDjP6B478LTogU
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"32dd814f264714509f40f49331a0b79c"
age
31021
x-cache
Hit from cloudfront
x-amz-request-id
PTKW86CR1NQPM846
x-amz-id-2
rhO7OJ2ljZokFvjadamLoC2Fs2XATZlNfLzEcQ75pm0cjIgGN/tyizmsBhXOUkASdBh0c6qnTlg=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:28 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:51 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
2810
x-amz-cf-id
Fj5mSMeTxt5WSqCYYpDN4UTubQOaKBwLuBzYOyI4QmOARU3vsb0LFw==
proxyshell-xdr-7-b.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
17 KB
17 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7-b.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5263bc478046d08c3e54893ee6d5f9f463bb7eea4adc895ef7f72e0d6f211685

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
NgZePI25LlzR9bf2gPxpyEKE8cYSQqOr
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"b996ab40aa9245bc37a598c958e55a65"
age
31020
x-cache
Hit from cloudfront
x-amz-request-id
PTKWCXHW67DP6J38
x-amz-id-2
KFGwcoh9Xjj+QXF2tj/Genxn001KONlPT5h8bqy0frFiQv5q78zBfSQOn7S36i+nr0rHcPlLrk4=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:29 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:52 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
16976
x-amz-cf-id
2kuzB5L6lV7dhJtyAHF-Q-kQg4PnCpyOM1EPC8FCiGzI8ucrONbumA==
proxyshell-xdr-7-c.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
4 KB
4 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7-c.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
53a6452ff116e04cbbcb2168889a61c9bf0cbb9b723be8532204759a0e1f5ada

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
GLX7l7fSCPPjFNI5pDs3Fx7Q00IRpRRL
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"c03f90b59008830031ea299de15da99d"
age
31020
x-cache
Hit from cloudfront
x-amz-request-id
PTKSQV5437SHCABT
x-amz-id-2
ttbA9/uk9EieO/T586aBlQYsuPtCWdZemO302zG6phvAZuXi7lhvtgVKp9fRvwRpT30/QAGAwLw=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:25 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:52 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
3624
x-amz-cf-id
8pGAl8UKPBy6i4pg1d9we0Dgjxw5SnqABLYMoxCf1ETkaIvt0zyT4g==
proxyshell-xdr-8.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
36 KB
37 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-8.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5bcda23b798e081e8b43502c8a53a63e0433720a971d2318386ab6f767f09b93

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
tH2GUaGE6jDx7qIuFg_ZzA6fYlATad8D
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"675e403d8f32138cc2169f9811531af5"
age
31020
x-cache
Hit from cloudfront
x-amz-request-id
HTZ0KTPEKXT8XFTB
x-amz-id-2
LJmCM1ZO9Egv461NmNusQEVgamiPzxrg392CFDTst1UjF89+sSEaWNH34toYGxNH32YrznpwC9A=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:31 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:52 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
37272
x-amz-cf-id
EdQzCbVrzSzZllCm5Xc5_he7_8ZPzwVob0yUB6L4aWxhuLvsr6uPFw==
proxyshell-xdr-9.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
3 KB
4 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-9.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cad0d01c32d43b3eab5ed2857a6ef8473052d7eebb8988f819d847dd278fafeb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
qkJJTuDN1UQxiA3e9KFXYlNWV.v49Z.p
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"c30fd15d0939289a8310563bb1ca7495"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
BF57V2S4P1KNAPS5
x-amz-id-2
I4NFbGilFbsuw4UFqT8XLqd/ifcITCXIrzmPv/mLj0v2tBNtv1TtmSv4kGbnhS2kqymkOoH6K2Q=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:27 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
3342
x-amz-cf-id
pHXpiOAlaRZnCfopIFudp03eefW8ummjGxs7ltMOaEtD3jd8agwWvg==
proxyshell-xdr-10.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
94 KB
95 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-10.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
24829271d6317b4fe646497995d91d5beec2ec75d6bae317de7d8df97478175a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
i5mXtgcAtVENYyH.6oXZM4yKWzeQmcKa
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"8f3753cb23ab48f552a493f52675de80"
age
16852
x-cache
Hit from cloudfront
x-amz-request-id
BF52VVAT4QD4J23R
x-amz-id-2
q7CAAb5OlMgX+rq5kYr0boo1lwtVAN4Ez86CVADwjp+LYHGX8aUrnJiTxoQzTLbj60mndPDkg3c=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:32 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:00 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
96398
x-amz-cf-id
PqjkqUPAL1eNgRfWnHHa7Gs9zKiG_Z2f6LONrWdFDWqfqeSJcaVhVg==
proxyshell-xdr-11.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
15 KB
15 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-11.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
80e677fe95c173f4a4e548dd9062fecfa6c385fcbf92e1312a511b380d4b3ffd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
SheC.aEFfR516H8QjF.IQux1Tmoz.A5w
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"e0925854dc6bc4f6d140c976d20fc9e0"
age
16851
x-cache
Hit from cloudfront
x-amz-request-id
BF52W3SBCP2WGH0N
x-amz-id-2
6LkBTTPhoZBYyyhY6wf2WhAU+Zlf35EbroZCHt5jd3t28M+Ry9uN1AIKSttLQENiCFKfjA67xCw=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:26 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:01 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
15144
x-amz-cf-id
kncDJhVqGyAoA2QcSnmc20wkMgxSWVV_6EHbRb5_TqLFvDq7GuNaqA==
proxyshell-xdr-12-a.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
16 KB
16 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-12-a.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
afc1c112b7b360b5439f1936af3b465775405a64641acd6ef01017d708dcaef7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
cvJ_seMfy9x3pKvoAIHyolkNG0IuMvLC
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"2c7810c0a145e0b3008a60fa7b40071e"
age
31019
x-cache
Hit from cloudfront
x-amz-request-id
HTZAVRDXC3CCZA8X
x-amz-id-2
0jHkAtwoAhsrDhlr0bnRZDCYwDR+/GN+WDDPqBwkm7ze4qFc364nAjYblJuxbC84vuFJ97QD32A=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:28 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:53 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
16160
x-amz-cf-id
wje0-a5i6SkfJfOc7WRy1QbwxzStHoPxfLP0jeu4-sOWHulgaW_mww==
proxyshell-xdr-12-b.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
15 KB
16 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-12-b.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
59bf6d1492dc7f58093c5d56a0dc05f2113267f49ab22cb3b9ffa8848e5d258a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
mPCWGHVf_kNmrOE_.9ID77GyH7fi5paF
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"fb4a109309cbf0c1a89eb57cc53d2e40"
age
31019
x-cache
Hit from cloudfront
x-amz-request-id
HTZFVYZC6KDRNYZS
x-amz-id-2
gQd4Vp6P7DQ2t33QOX0xhyrxwznjnpVcriRlP5YnAdPTGzqOrpOymv426VwDqXlfAKVazVY5Apk=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:34 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:53 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
15862
x-amz-cf-id
LZX8mGUxzyjAT9aoU6eGIcOqsMHaApXGVBguYQkBD8YU-QA4_uNV7Q==
proxyshell-xdr-13-a.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
23 KB
23 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-13-a.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2f7236edbed46e5b69ca4626c65d075f7c1b4d2cf9c25bfdafa0db5c346ddbb9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
MJqgSQudEVf3mL4d51z_ZjUIsNtfHHzY
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"78e1d4e9544022398822cddb1df307ba"
age
16851
x-cache
Hit from cloudfront
x-amz-request-id
BF59C9QYMZF0EPJ1
x-amz-id-2
qYCay3xNzcDuFLGnCzt6gg555ZqgF78foS2/dPicBjaix4YWFzwPM+KmUujvk5J7AtCrVITL1zc=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:30 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:01 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
23234
x-amz-cf-id
Ca8XsLLABzZHFzpyU1fXftrjKzwCTllfDHet8sn7rQcjVpvIQGpGhQ==
proxyshell-xdr-13-b.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
28 KB
29 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-13-b.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d6b3c983ebf9b00bd8fc6c02750dbc213485b34e497d275d18fda2aad1ed1ddf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
tgorDyG.owAU9H2OfN8xfZXbrfosC6yU
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"763a663b41030b24bf29fbf1a7de6b9b"
age
31018
x-cache
Hit from cloudfront
x-amz-request-id
Q2C3WJB9NCFQTQDV
x-amz-id-2
BrjafqMA+Hsj9P/Q8mbPKbSWxSlCUYagxIYyX/hPL2GINW14XTKcdXaY8J2gP9UPdliTmHIBBrM=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:28 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:53 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
28674
x-amz-cf-id
lA7plMf9dWR1c7NvwUaM-O-WqSCYRYRM4BC4lEpM5YDok-WZm1J46w==
proxyshell-xdr-14.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
26 KB
27 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-14.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
edff8d9080b6da6eb56bf6db1b7bd85ea45abce8f198215a71cde5df6d6f61ff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 07:30:54 GMT
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
age
31018
x-cache
Hit from cloudfront
x-amz-request-id
HHMJ5JCBBQBHG5VY
x-amz-id-2
/zwY3Wn8tIkep6Gq2aCsFDh0ss3tkkII35hbz0XH4mwLWbN79vZj7EunpgQlnyU7EbXJikW2WHs=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:33 GMT
server
AmazonS3
etag
"9f334479513273f415f216d307e1e435"
x-amz-version-id
FqtCwKmssOz_bq9W3XfZvQEsoPDU7fDn
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
26792
content-type
image/webp
x-amz-cf-id
vgCBlALPDeuLI8CAA6WaxIr1EFJBM36fV9RQApYQzJSsWrv1rzZxPw==
proxyshell-xdr-15.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
59 KB
60 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-15.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a8c507e4785f2c0f6bb2fff53603e6d768e85f1e7514278d2f7a72ca7ab3ec6d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
QGRbbK6XMQAxWirFPK6ioecdpl5sb7S2
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"42868b0ee6d4086190b46b5e0e5df29c"
age
16851
x-cache
Hit from cloudfront
x-amz-request-id
BF5C62DDBDN1MFXR
x-amz-id-2
2Rr5hO+JtPv197br6m9a/10pUSKYa/AvTnV6cv+f0WNoCV/aZ1LslTN04u9XXLhz/X1gXIeRPG4=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:34 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:01 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
60602
x-amz-cf-id
s6YmvwnI2nimLDf6RQpO8C4WGF0uN2IBZWiSDGtDvVD7Z18iAPlRpA==
proxyshell-xdr-16.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
3 KB
3 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-16.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1ce17fb3a120c3c46404643788d7934940c71dac562fcf023aa5f084321b52a1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
ngGlyx.Lc9T.KhXNddgNQez7fbi1onZM
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"02f6839ab0b483346672622f7a6223c1"
age
16851
x-cache
Hit from cloudfront
x-amz-request-id
BF52H1XYQEFX5KSV
x-amz-id-2
GIKxFFZYXh10tTVPea8eRvWttJ6Khqok320TmFoaOMbtmDPcOVHMSIiRMsjFtVysfOLOhdsbwgw=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:30 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 11:27:01 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
2670
x-amz-cf-id
mWWFt33-5ixMf97CXpsxZugEKqQcZ5WROCt9vkJlXejZZ2PzdEkmjA==
proxyshell-xdr-17.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
9 KB
9 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-17.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5d607290850b98abf46050b72c7e12879f277d66e1141dfcf2128c1fec193103

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
1dAmXD.RAE1_x2JFYQvSsKgFJNzh16xx
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"c7d522eb5f19f223f475061968d75751"
age
31017
x-cache
Hit from cloudfront
x-amz-request-id
Q2C49NYRHJKZD44H
x-amz-id-2
ZYz7010ThoeTJuu0gylng9nJDvh9SfmDGRO5aIBg8hIndeuCuGA+wCWWcx0ZNjQUf+t8Hnwn8ys=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:29 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:55 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
8730
x-amz-cf-id
Vk1p5xfS8LtouV97qEJhslS_jNFwi1dcMvXGYjoK6YO3JdF0FA3qTA==
proxyshell-xdr-18.JPG
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
11 KB
11 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-18.JPG
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3b4418c8aaf8b19d137f23682f72d4f197bee8b2d002d8d00a8208fa63d772b5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
UOPFZ7zEmR9s9pjohJWJKsR5NvukR954
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"041b9aff555ca7498340649b57f202d9"
age
31017
x-cache
Hit from cloudfront
x-amz-request-id
GD3FEP9V5BTYQXVQ
x-amz-id-2
9hmmDtYu/1zufxvoBUFxh/HLa6wAj9nxktUBz4LN2yI8XINt7w8aqzZh4KNNob9OhcL5kvfpPbw=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:27 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:55 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
11240
x-amz-cf-id
Y7hN6I8ZOCY0FYIxC2OjgI0QGrxdp2Ov74yxfAyYYrxA1zVUVxKy-A==
proxyshell-xdr-19.jpg
marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/
50 KB
51 KB
Image
General
Full URL
https://marvel-b1-cdn.bc0a.com/f00000000017219/www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-19.jpg
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2250:8600:0:f267:a5c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2fb38b1a6ed4e3ff8631fb24b9c246142637dcc4675645b2a145df94f57ce466

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
Mue6FyKTIsxVYDNX0Skd5NmGmrrqlEMi
via
1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
etag
"374629e2a7bff634c793f8f55b191769"
age
31017
x-cache
Hit from cloudfront
x-amz-request-id
HTZAJHJCKEDFS9TG
x-amz-id-2
v3qEDZIVnPaNWjT/JDqkUeZEKox+WouSCa6W8MPaRV7PPedNXmGvnugSva+vhJUdZB8e69fxowk=
accept-ranges
bytes
last-modified
Wed, 17 Nov 2021 12:44:33 GMT
server
AmazonS3
date
Thu, 02 Dec 2021 07:30:55 GMT
content-type
image/webp
access-control-allow-origin
*
cache-control
max-age=31536000
x-amz-cf-pop
FRA60-P2
content-length
51482
x-amz-cf-id
66V9qSCrG4yNJJra1OzFlm2FXG5vEmIjx1MnOk90FsLxk6YF_e5b6Q==
422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/
72 KB
72 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/interstate/422ea8eb-ab70-4ffb-9bf3-5a841254edba-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=984
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
73259
x-xss-protection
1;mode=block
dade3edf-02a3-4844-947e-95175f24faef-3.woff
www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/
37 KB
38 KB
Font
General
Full URL
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch/resources/fonts/InterstateExtraLight/dade3edf-02a3-4844-947e-95175f24faef-3.woff
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Referer
https://www.trendmicro.com/etc.clientlibs/trendresearch/clientlibs/clientlib-trendresearch.min.css
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
last-modified
Thu, 23 Apr 2020 17:32:22 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
application/x-font-woff
cache-control
public, max-age=772
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
38313
x-xss-protection
1;mode=block
conv_v3.js
cdn.b0e8.com/
67 KB
22 KB
Script
General
Full URL
https://cdn.b0e8.com/conv_v3.js
Requested by
Host: t.co
URL: https://t.co/5hpj6FmgS5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.5.192 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
192.5.190.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 15:50:50 GMT
content-encoding
gzip
age
1021
x-guploader-uploadid
ADPycdu66pFus2Mix1lk447afEVLykAtk6F71tbPDeOGbEeYczFoIW4exFog3_elPjYOStbf2FdqcPhH1Nxjk1Bve3gKvsepOw
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
21570
last-modified
Fri, 07 Aug 2020 06:51:36 GMT
server
UploadServer
etag
"befb3eb28cd6dd99609966faf9c239e0"
vary
Accept-Encoding
x-goog-hash
crc32c=kqf0jw==, md5=vvs+sozW3ZlgmWb6+cI54A==
content-language
en
access-control-allow-origin
*
x-goog-generation
1596783096708452
access-control-expose-headers
Content-Type
cache-control
public, max-age=3600
x-goog-stored-content-length
21570
accept-ranges
bytes
content-type
application/javascript
expires
Thu, 02 Dec 2021 16:50:50 GMT
tag-6b261345996594f475fd42a23775d520.js
dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/
164 KB
46 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-6b261345996594f475fd42a23775d520.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&f=1&r=0.9122234779389737
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
b64e912319727e895ca1311e467c874471bc4d624a17bba4deffa99813df4bdf

Request headers

Referer
https://www.trendmicro.com/
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
br
last-modified
Wed, 01 Dec 2021 11:27:13 GMT
server
gfra1
etag
"61a75c11-b936"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
47414
via
1.1 google
tag-f01744e4c773bf44296fc14d02a06ee8.js
dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/
97 KB
25 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/web/djIkYTo0LjA6bm9qcXVlcnksdHI6Ny4w/tag-f01744e4c773bf44296fc14d02a06ee8.js
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=215154&u=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&f=1&r=0.9122234779389737
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
6e6e7cd29eee10c166eedd729797d9fc65762807a670b77835cf0e831ea02c02

Request headers

Referer
https://www.trendmicro.com/
Origin
https://www.trendmicro.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:50 GMT
content-encoding
br
last-modified
Wed, 01 Dec 2021 11:27:13 GMT
server
gfra1
etag
"61a75c11-6410"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25616
via
1.1 google
v.gif
dev.visualwebsiteoptimizer.com/
35 B
214 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=215154&d=trendmicro.com&u=DDF3195BC008195016AD302E369DAFAB7&h=9fc00fb3a4901e64f116701293061ed3&t=false&r=0.5327698147368995
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv3c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:50 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv3c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
utag.69.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.69.js?utv=ut4.48.202006041752
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e687349ef50927f263497a200ed021ebaa6d13850a8b9a0a19de3d2260729d69

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:14 GMT
server
AkamaiNetStorage
etag
"5a5fb4e9111a2b14d5b5876eb2258fd7:1632240614.594178"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1005
expires
Fri, 17 Dec 2021 16:07:51 GMT
www-widgetapi.js
www.youtube.com/s/player/eea703f3/www-widgetapi.vflset/
147 KB
48 KB
Script
General
Full URL
https://www.youtube.com/s/player/eea703f3/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2a499c62bd4a1555dc2be24483a7de1cb92605c2dee544ce0435a7add53b52c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 12:54:15 GMT
content-encoding
br
x-content-type-options
nosniff
age
11616
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
49040
x-xss-protection
0
last-modified
Wed, 01 Dec 2021 01:17:35 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Fri, 02 Dec 2022 12:54:15 GMT
gtm.js
www.googletagmanager.com/
324 KB
72 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b63c2ebcfbd64a62865ef42db3918fcc5d3445a649b585655ffc77ffcfef2688
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
73332
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 02 Dec 2021 16:07:51 GMT
brightedge3.php
a.b0e8.com/
35 B
226 B
Image
General
Full URL
https://a.b0e8.com/brightedge3.php?id=f00000000017219&p_id=P46RL8R462P4RAA46A6JR8LRAAAAAAAAAH&bf=9a146a6dd5b92bb6e2686efa069789be&url=https%3A//www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A//t.co/&bn=1&bv=3.43&title=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&metadesc=In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.&metakeywords=cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities&s_id=P46RL8R462P4R6L26P6JR8LRAAAAAAAAAH
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.95.105.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
148.105.95.34.bc.googleusercontent.com
Software
bws/1.0 /
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-be-pop
BRU-1-301
date
Thu, 02 Dec 2021 16:07:45 GMT
via
1.1 google
last-modified
Wed, 23 Jun 2021 22:46:15 GMT
server
bws/1.0
etag
"60d3b9b7-23"
content-type
image/gif
access-control-allow-origin
*
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
settings.js
dev.visualwebsiteoptimizer.com/
1 MB
92 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/settings.js?a=215154&settings_type=1&vn=7.0&r=0.5007082426566822&exc=69|95
Requested by
Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/web/djIkdGU6Ny4wOmFzeW5jJWdxdWVyeQ==/tag-6b261345996594f475fd42a23775d520.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
8299331e0959f53cb0d0ff4d00704219b3e087c9f544dad28d5441621fc0d43c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
via
1.1 google
server
gfra1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
config.json
c.go-mpulse.net/api/ Frame CDB0
2 KB
1 KB
XHR
General
Full URL
https://c.go-mpulse.net/api/config.json?key=TU3LW-WPX5W-YK52N-GNWRK-Z5B9X&d=www.trendmicro.com&t=5461538&v=1.720.0&if=&sl=0&si=d21e93d8-4f8f-4eec-8b2d-f9b0cac8f79e-r3hwt1&plugins=ConfigOverride,Continuity,PageParams,IFrameDelay,AutoXHR,SPA,History,Angular,Backbone,Ember,RT,CrossDomain,BW,PaintTiming,NavigationTiming,ResourceTiming,Memory,CACHE_RELOAD,Errors,TPAnalytics,UserTiming,Akamai,Early,EventTiming,LOGN&acao=
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:1b8::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
449f4003c0338b98db25d4783c328ba6d34a88d4111e525364fba5290f593527

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:51 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/json
Access-Control-Allow-Origin
*
Cache-Control
private, max-age=300, stale-while-revalidate=60, stale-if-error=120
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
1021
worker-70faafffa0475802f5ee03ca5ff74179.js
dev.visualwebsiteoptimizer.com/analysis/
47 KB
13 KB
XHR
General
Full URL
https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gfra1 /
Resource Hash
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
br
last-modified
Wed, 01 Dec 2021 11:27:12 GMT
server
gfra1
etag
"61a75c10-351f"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13599
via
1.1 google
activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-...
5427711.fls.doubleclick.net/ Frame DC6B
Redirect Chain
  • https://5427711.fls.doubleclick.net/activityi;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshel...
  • https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresea...
692 B
477 B
Document
General
Full URL
https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f6.1e100.net
Software
cafe /
Resource Hash
1e882e60f7e48e1e15a85bfcb8dd1c43878958a7272f42c2f6bb05c08a537c70
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
about:blank

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 02 Dec 2021 16:07:51 GMT
expires
Thu, 02 Dec 2021 16:07:51 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
452
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
date
Thu, 02 Dec 2021 16:07:51 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
bat.js
bat.bing.com/
36 KB
11 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
last-modified
Sat, 13 Nov 2021 03:55:41 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: FADAD068A239455AA3325162D8E90C41 Ref B: FRAEDGE1413 Ref C: 2021-12-02T16:07:51Z
etag
"80dc6f5342d8d71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
10442
conversion_async.js
www.googleadservices.com/pagead/
37 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14328
x-xss-protection
0
server
cafe
etag
12503521247758841375
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 02 Dec 2021 16:07:51 GMT
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXGNM2&l=dataLayer
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.94.161 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-94-161.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 00:11:21 GMT
Content-Encoding
gzip
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
Age
57391
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
Connection
keep-alive
Transfer-Encoding
chunked
X-Amz-Cf-Pop
FRA50-C1
X-Amz-Cf-Id
KuxAhPALRJNAfhXl2tQSo5AyEBH7Zs2V8rqiqFg4WrKhQZy4UMyuPA==
activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-inci...
5427711.fls.doubleclick.net/
0
0
Image
General
Full URL
https://5427711.fls.doubleclick.net/activityi;register_conversion=1;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell?
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.102 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f6.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

/
attr.ml-api.io/
Redirect Chain
  • https://marvel-b1-cdn.bc0a.com/f00000000017219/s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://marvel-processor.bc0a.com/snowcloud/v1/api/loadUrl?customer=f00000000017219&url=https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.trendmicro.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
0
242 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Server
2600:9000:2156:c600:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
apigw-requestid
JupV7i97oAMEVhA=
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
dITTN6KJW8dp81eXINfPCi7miqelStZYcgsVhQxIUPg8YJvauN17Wg==

Redirect headers

Pragma
no-cache
Date
Thu, 02 Dec 2021 16:07:52 GMT
X-Proxy-Origin
193.27.14.44; 193.27.14.44; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
3821c7b2-36e4-4a31-98d0-e9e5c49d037b
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/929919117/?random=1638461271666&cv=9&fst=1638461271666&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1e0f88cfb3b527231df0650deb92e01a7739867b433ebe96f20eb48302476d1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1136
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
26044208.js
bat.bing.com/p/action/
0
93 B
Script
General
Full URL
https://bat.bing.com/p/action/26044208.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 02 Dec 2021 16:07:51 GMT
cache-control
private,max-age=1800
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 0D822320E8304D4EB28EE404DE2AABE4 Ref B: FRAEDGE1413 Ref C: 2021-12-02T16:07:51Z
x-cache
CONFIG_NOCACHE
/
www.google.com/pagead/1p-user-list/929919117/
42 B
548 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/929919117/?random=1638461271666&cv=9&fst=1638460800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&async=1&fmt=3&is_vtc=1&random=2839320464&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/929919117/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/929919117/?random=1638461271666&cv=9&fst=1638460800000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wgba1&sendb=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&async=1&fmt=3&is_vtc=1&random=2839320464&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=*;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-m...
adservice.google.com/ddm/fls/z/ Frame DC6B
42 B
494 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=*;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell
Requested by
Host: 5427711.fls.doubleclick.net
URL: https://5427711.fls.doubleclick.net/activityi;dc_pre=CIj3zvC_xfQCFYsUGwod7xsAtA;src=5427711;type=remar0;cat=allsi0;ord=1;num=6430624434122;gtm=2wgba1;auiddc=427786736.1638461272;u1=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html;ps=1;~oref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://5427711.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-202-53-245.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:51 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
4D83723B208EB349
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=46722
accept-ranges
bytes
content-length
948
x-amz-id-2
RKO0UPSzRPtdJrcmGm2+aJZQnUMGch3iz2sN06deCvMfZQSDtkRjT1Cr0Ig8K9AN68BKb509XP8=
dict.en_us.json
www.trendmicro.com/libs/cq/i18n/
13 KB
14 KB
XHR
General
Full URL
https://www.trendmicro.com/libs/cq/i18n/dict.en_us.json
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-prod-a-01
Yes
server
nginx
etag
"def5866d2a6bd1b5e1123ce5b1a6217e"
x-frame-options
SAMEORIGIN
content-type
application/json;charset=utf-8
cache-control
public, max-age=586
date
Thu, 02 Dec 2021 16:07:52 GMT
x-content-type-options
nosniff
x-prod-n-02
Yes
content-length
13552
x-xss-protection
1;mode=block
utag.138.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.138.js?utv=ut4.48.202010201643
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
62e37140e90c20b8021e84f22588bff6f0789e2ac60bd107b21017d0acd41b51

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"fe1348f92b91321140f39aae7ca068de:1632240611.865646"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1008
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.81.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
24 KB
6 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.81.js?utv=ut4.48.202106161605
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7004945db892cd6f93ded26d3f944f0b15355d1363a6bc0b9fa906d2e34cb4ea

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:18 GMT
server
AkamaiNetStorage
etag
"c790e21a570649215b7deaeae97139c8:1632240618.345665"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
5882
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.29.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b8a34dec51d1542d219b92e8425cae1fcd3f55c26f8d9cb67d2a9e7c2e79543d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"df2edd1ac891eacf5b6ba635cc9a59eb:1632240611.664523"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1706
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.18.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.18.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8f37c9815fbb866d0417ebe23f74ccbf507ea03f969260f576cfd4bbd9da2a28

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:12 GMT
server
AkamaiNetStorage
etag
"c184aaf7bc67f12bab7821647c2a3235:1632240612.296587"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1024
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.9.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.9.js?utv=ut4.48.201510262117
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e348f721442e051780e0a89843aaad43dbe518d051cad5ce5b6816397a8fc773

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:21 GMT
server
AkamaiNetStorage
etag
"aa9516dc0bc8d1f409640e8bce32c4d4:1632240621.08215"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1392
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.75.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
3 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.75.js?utv=ut4.48.201608171750
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3ee9ec06bbfa8bb6e040e6edc9718c1905b557f3e9e988398b70d378096d02f8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:17 GMT
server
AkamaiNetStorage
etag
"d30dc4298bf51cb89a8006ff7c576208:1632240617.067512"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1454
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.124.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.124.js?utv=ut4.48.202009171637
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c67a98460c2dbd3d301997c6b0cda7919f33d554f8b084f14f3759012299e148

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:14 GMT
server
AkamaiNetStorage
etag
"6f7b1fa653e43c64c2821de2bfefb8d6:1632240614.821376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1216
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.145.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
4 KB
2 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.145.js?utv=ut4.48.202108241956
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
f795b85773aeeb4d69eb8d36e82f9106344b4a5edf011f9cb22eb4d4e146f3e1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:15 GMT
server
AkamaiNetStorage
etag
"d1220ca3cd0299455402f6faf7c5e8e8:1632240615.012675"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1778
expires
Fri, 17 Dec 2021 16:07:52 GMT
utag.151.js
tags.tiqcdn.com/utag/trendmicro/nabucms/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.48.202109071517
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
bd701a68dddee2555a381f41190b0b2137d435b7e8a79af86d520425633c7f46

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
last-modified
Tue, 21 Sep 2021 16:10:11 GMT
server
AkamaiNetStorage
etag
"a75cf0ef4ef7b4ebf26c805084a1ccc2:1632240611.460542"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
1067
expires
Fri, 17 Dec 2021 16:07:52 GMT
analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.disruptor.html
www.trendmicro.com/en_us/research/21/k/
0
418 B
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.disruptor.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-prod-n-02
Yes
x-prod-a-01
Yes
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
x-xss-protection
1;mode=block
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
x-content-type-options
nosniff
analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.notifications.html
www.trendmicro.com/en_us/research/21/k/
0
418 B
XHR
General
Full URL
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.notifications.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.123.14.222 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-14-222.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1;mode=block

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
X-Requested-With
XMLHttpRequest
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-prod-n-02
Yes
x-prod-a-01
Yes
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
x-frame-options
SAMEORIGIN
content-type
text/html; charset=UTF-8
x-xss-protection
1;mode=block
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' http: https: data: blob: wss: mediastream: android-webview-video-poster: ms-appx-web: gsa: endlesspic: ms-browser-extension chrome-extension asset * ; frame-ancestors 'self' https://*.trendmicro.com ; report-uri https://trendmicro.com/csp-report/violation.php
x-content-type-options
nosniff
_ate.track.config_resp
v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/
5 KB
1 KB
Script
General
Full URL
https://v1.addthisedge.com/live/boost/ra-57bc9d0c3028a052/_ate.track.config_resp
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-140-111.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
etag
1901189993--gzip
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public, max-age=32, s-maxage=86400
content-disposition
attachment; filename=1.txt
content-length
1129
300lo.json
m.addthis.com/live/red_lojson/
89 B
249 B
Script
General
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=61a8ef57ac9203b7&bkl=0&bl=1&pdt=1418&sid=61a8ef57ac9203b7&pub=ra-57bc9d0c3028a052&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.trendmicro.com&dr=t.co&fp=en_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=4&gen=100&chr=UTF-8&mk=cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities&colc=1638461272189&jsl=33&uvs=61a8ef575629477e000&skipb=1&callback=addthis.cbs.jsonp__42151885974389190
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-21-140-111.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
80f191f5515dde7719a0643eea1cbbb3b07a306679a3c565afb5bae17a826104

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
89
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 379A
0
0

sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 7A48
71 KB
26 KB
Document
General
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/

Response headers

server
nginx/1.15.8
content-type
text/html
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
etag
W/"5f971164-11adc"
timing-allow-origin
*
cache-control
public, max-age=86313600
p3p
CP="NON ADM OUR DEV IND COM STA"
strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
content-length
26421
date
Thu, 02 Dec 2021 16:07:52 GMT
vary
Accept-Encoding
x-host
s7.addthis.com
0
bat.bing.com/action/
0
172 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=26044208&tm=gtm002&Ver=2&mid=f2863e37-1d82-47b3-967d-a4849204d674&sid=009b8040538a11ecbe97497e15b05300&vid=009b9dd0538a11ec9b554921bcc98469&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&kw=cyber%20threats,research,exploits%20%26%20vulnerabilities&p=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&r=https%3A%2F%2Ft.co%2F&lt=2704&evt=pageLoad&msclkid=N&sv=1&rn=803784
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B954456561D24DC59DEA8A66080427A0 Ref B: FRAEDGE1413 Ref C: 2021-12-02T16:07:52Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
revenuepulse-lib-v3.js
resources.trendmicro.com/rs/945-CXD-062/images/
2 KB
1 KB
Script
General
Full URL
https://resources.trendmicro.com/rs/945-CXD-062/images/revenuepulse-lib-v3.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
19
content-length
695
last-modified
Sat, 23 Oct 2021 01:38:30 GMT
server
cloudflare
etag
"2e1231-6f3-5cefb2f592455"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=60
accept-ranges
bytes
cf-ray
6b75cf8a8ccd54ca-MAN
expires
Thu, 02 Dec 2021 16:08:52 GMT
app.js
acsbapp.com/apps/app/dist/js/
Redirect Chain
  • https://acsbap.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/assets/js/acsb.js
  • https://acsbapp.com/apps/app/dist/js/app.js
424 KB
138 KB
Script
General
Full URL
https://acsbapp.com/apps/app/dist/js/app.js
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Server
206.189.187.108 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn103.acsbapp.com
Software
/
Resource Hash
7c312ff2093c1ce527c7879bb568b88a1fc306c6fdb1cbb5e690ff487344c267

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:53 GMT
content-encoding
br
last-modified
Sat, 27 Nov 2021 20:09:31 GMT
etag
"69e25-61a2907b-1ae31cbe631b39ed;br"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
141115
expires
Fri, 03 Dec 2021 16:07:53 GMT

Redirect headers

location
https://acsbapp.com/apps/app/dist/js/app.js
date
Thu, 02 Dec 2021 16:07:52 GMT
content-length
707
content-type
text/html
6si.min.js
j.6sc.co/
27 KB
9 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:52 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
8575
Pragma
no-cache
Last-Modified
Thu, 07 Oct 2021 17:17:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615f2bb7-6a5f"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Thu, 02 Dec 2021 16:07:52 GMT
sv2uuh4gw3ms.js
js.driftt.com/include/1638461400000/
218 KB
62 KB
Script
General
Full URL
https://js.driftt.com/include/1638461400000/sv2uuh4gw3ms.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.151.js?utv=ut4.48.202109071517
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7d0ea6fbfa59d8849589c61830741581253e00cc485d7e4d4d32f4cde293832b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

x-amz-version-id
_QJ8dU5J3YQ1O70lTZnRjt6qsQRmFQ1v
content-encoding
gzip
etag
W/"0e68079d1916000d71a12cdce6e9a1cb"
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:28:45 GMT
server
nginx
date
Thu, 02 Dec 2021 16:07:52 GMT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
h40LKZGc5FRM6G-HOvClpKKSU_TSSIQ3n3lq_or9Q3LjWfvjFMcSwQ==
gtm.js
www.googletagmanager.com/
106 KB
41 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MT6DHL8&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
55bf883d78b3c617205e5e002e43bfa5055c0075e7ca68db49ddf7fe90cd6b55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41725
x-xss-protection
0
last-modified
Thu, 02 Dec 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 02 Dec 2021 16:07:52 GMT
ga.js
ssl.google-analytics.com/
45 KB
17 KB
Script
General
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.29.js?utv=ut4.48.201510262117
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
3922
date
Thu, 02 Dec 2021 15:02:30 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Thu, 02 Dec 2021 17:02:30 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
1969
date
Thu, 02 Dec 2021 15:35:03 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Thu, 02 Dec 2021 17:35:03 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.148.88 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-148-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:52 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
202 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=trendmicro/nabucms/202112011658&cb=1638461272288
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.51.8.191 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-191.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Thu, 02 Dec 2021 16:17:52 GMT
/
www.googleadservices.com/pagead/conversion/1015287688/
2 KB
1 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/1015287688/?random=1638461272290&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s42-in-f2.1e100.net
Software
cafe /
Resource Hash
6dd1b30ae3272ce7dccb6f12f6e0a839a7cb79fb5bda20efb321d68feaf866b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1249
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
layers.fa6cd1947ce26e890d3d.js
s7.addthis.com/static/
263 KB
76 KB
Script
General
Full URL
https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-41cf5"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=86313600
date
Thu, 02 Dec 2021 16:07:52 GMT
x-host
s7.addthis.com
timing-allow-origin
*
content-length
77617
/
www.google.de/pagead/1p-conversion/1015287688/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTy...
  • https://www.google.com/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1...
  • https://www.google.de/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=16...
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=WO-oYc_wE4uH7gPSxhk&cid=CAQSKQCNIrLMxx1lJBYqZ0rhBzuVJFWvgV5Vd4RO3pGlATAzdE5c-H-1tmyX&random=1495401795&resp=GooglemKTybQhCsO&ipr=y&prhg=0
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H3
Server
2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-conversion/1015287688/?random=1975178738&cv=9&fst=1638461272290&num=1&value=0&label=0w45CIDC7AYQiJ-Q5AM&bg=ffffff&hl=en&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&ref=https%3A%2F%2Ft.co%2F&tiba=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&hn=www.googleadservices.com&async=1&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&is_vtc=1&ocp_id=WO-oYc_wE4uH7gPSxhk&cid=CAQSKQCNIrLMxx1lJBYqZ0rhBzuVJFWvgV5Vd4RO3pGlATAzdE5c-H-1tmyX&random=1495401795&resp=GooglemKTybQhCsO&ipr=y&prhg=0
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
__utm.gif
ssl.google-analytics.com/r/
35 B
54 B
Image
General
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1921419566&utmhn=www.trendmicro.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&utmhid=378004922&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&utmht=1638461272352&utmac=UA-29051577-12&utmcc=__utma%3D44797537.653634450.1638461272.1638461272.1638461272.1%3B%2B__utmz%3D44797537.1638461272.1.1.utmcsr%3Dtrendmicroresearch%7Cutmccn%3D1121_Proxyshell%7Cutmcmd%3Dsmk%3B&utmjid=1938656158&utmredir=1&utmu=qhAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
ec.js
www.google-analytics.com/plugins/ua/
3 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/ec.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 15:32:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2136
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1306
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 02 Dec 2021 16:32:16 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
884 B
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 15:11:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3389
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
859
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 02 Dec 2021 16:11:23 GMT
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.96.148.88 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-148-88.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:52 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Sat, 12 Mar 2022 16:07:52 GMT
shares-post.json
api-public.addthis.com/url/serviceapi/
2 B
323 B
XHR
General
Full URL
https://api-public.addthis.com/url/serviceapi/shares-post.json?services=sFbt&url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-type
text/plain

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
surrogate-key
sFbt=https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
last-modified
Thu, 02 Dec 2021 16:00:00 GMT
server
nginx/1.15.8
date
Thu, 02 Dec 2021 16:07:52 GMT
content-type
application/json
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-transform, max-age=0, s-maxage=14400
access-control-allow-credentials
true
content-length
2
shares.json
api-public.addthis.com/url/
34 B
348 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html&callback=_ate.cbs.rcb_5div0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
ca46e382a89f5c61738120ec3d05af9bfafbbb1f0a15d344413cfdefe4e157a7
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
last-modified
Thu, 02 Dec 2021 16:07:52 GMT
server
nginx/1.15.8
date
Thu, 02 Dec 2021 16:07:52 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
54
shares.json
api-public.addthis.com/url/
34 B
348 B
Script
General
Full URL
https://api-public.addthis.com/url/shares.json?url=http%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html&callback=_ate.cbs.rcb_f9kn0
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.51.8.183 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-51-8-183.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
5d4bcd856c53d2f61e7ad40f7049ce89d8f7fae19cc344777cb86bc5c73d31ca
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
surrogate-key
www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
last-modified
Thu, 02 Dec 2021 16:07:52 GMT
server
nginx/1.15.8
date
Thu, 02 Dec 2021 16:07:52 GMT
vary
Accept-Encoding
content-type
application/json
cache-control
no-transform, must-revalidate, max-age=0, s-maxage=3600
content-length
54
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=378004922&t=pageview&cu=&_s=1&dl=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_utma=44797537.653634450.1638461272.1638461272.1638461272.1&_utmz=44797537.1638461272.1.1.utmcsr%3Dtrendmicroresearch%7Cutmccn%3D1121_Proxyshell%7Cutmcmd%3Dsmk&_utmht=1638461272516&_u=aSBCCAIrBAAAAC~&cid=653634450.1638461272&tid=UA-44592531-1&_gid=1776182122.1638461272&_slc=1&cd15=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&cd2=Mohamed%20Fahmy%7CThreat%20Intelligence%20Analyst%2CAbdelrhman%20Sharshar%7CThreat%20Intelligence%20Analyst%2CSherif%20Magdy%7CThreat%20Intelligence%20Analyst%2CRyan%20Maglaque%7CThreats%20Analyst&cd3=2021-11-17&z=1861272513
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:52 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.trendmicro.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
945-cxd-062.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://945-cxd-062.mktoresp.com/webevents/visitWebPage?_mchNc=1638461272521&_mchCn=&_mchId=945-CXD-062&_mchTk=_mch-trendmicro.com-1638461272520-32020&_mchHo=www.trendmicro.com&_mchPo=&_mchRu=%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Ft.co%2F&_mchQp=utm_source%3Dtrendmicroresearch__-__utm_medium%3Dsmk__-__utm_campaign%3D1121_Proxyshell
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Thu, 02 Dec 2021 16:07:53 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
69be31fc-5d06-4fe1-b869-ee28fcd68804
getuidj
secure.adnxs.com/
29 B
863 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
3434e49cf1adb48b366367d0588d9f5dc7bc5046a2cd01cec3da394505b6b4c0
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 02 Dec 2021 16:07:52 GMT
X-Proxy-Origin
193.27.14.44; 193.27.14.44; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
a4437e63-f002-45cc-91d6-8bee1439b49f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.trendmicro.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
29
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
374 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
271b648df0f374086de48cc3faed55c25f3f31b37151e1cf3dd25729668261fc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:53 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.trendmicro.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=null&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A52%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:53 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/
828 B
656 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.71.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-71-178.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
2f19845cf43e230d17e25cd573d7b23c12511241bde91c2844e16ea8be462d8c

Request headers

Authorization
Token f0978075a275d14104571cd0b3e9919c9748869b
Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
content-length
469
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.71.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-71-178.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization
Origin
https://www.trendmicro.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 02 Dec 2021 16:07:52 GMT
server
nginx
access-control-allow-origin
https://www.trendmicro.com
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
OPTIONS,GET
access-control-allow-headers
authorization
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.trendmicro.com%26pId%3d%24UID
  • https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
0
242 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Requested by
Host: www.trendmicro.com
URL: https://www.trendmicro.com/en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html?utm_source=trendmicroresearch&utm_medium=smk&utm_campaign=1121_Proxyshell
Protocol
H2
Server
2600:9000:2156:c600:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:53 GMT
via
1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
apigw-requestid
JupWAipRoAMEVeA=
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
caXcYZ7k6tQS1b6ngDadp9zNTvYmSX_Hl2FnwQCv8cFVaGhwr1LMHA==

Redirect headers

Pragma
no-cache
Date
Thu, 02 Dec 2021 16:07:53 GMT
X-Proxy-Origin
193.27.14.44; 193.27.14.44; 399.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid
d2150585-0aeb-4737-999c-f0e23516b540
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=www.trendmicro.com&pId=5319264918302201021
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
config.json
cdn.acsbapp.com/cache/app/trendmicro.com/
136 B
323 B
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/trendmicro.com/config.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
161.35.15.77 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn101.acsbapp.com
Software
/
Resource Hash
4374dd962af674855e017ef5cc5f3e40cd1bd23991a4bce1fea0257de71e63d8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:53 GMT
last-modified
Thu, 02 Dec 2021 09:11:02 GMT
etag
"88-61a88da6-ed5dbbee097d712e;;;"
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
136
expires
Fri, 03 Dec 2021 16:07:53 GMT
en.build.json
cdn.acsbapp.com/cache/app/
232 KB
25 KB
Fetch
General
Full URL
https://cdn.acsbapp.com/cache/app/en.build.json
Requested by
Host: acsbap.com
URL: https://acsbap.com/apps/app/assets/js/acsb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
161.35.15.77 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
cdn101.acsbapp.com
Software
/
Resource Hash
9ca36915a0c58b2ea2b91956fe0d42a8425af95447e3028df471474c20430c9a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:53 GMT
content-encoding
br
last-modified
Sat, 27 Nov 2021 20:10:03 GMT
etag
"3a13f-61a2909b-a7ab856e621aecde;br"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=432000 public
accept-ranges
bytes
access-control-allow-headers
*
content-length
25263
expires
Fri, 03 Dec 2021 16:07:53 GMT
core
js.driftt.com/ Frame C421
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1638461400000/sv2uuh4gw3ms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c7434033dbdeb0511af562cd6cd291126b19b54269c9e73e1cdde61d844cc09f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Wed, 01 Dec 2021 17:28:24 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
VonE6OIwSznjnG.y9UceJXaC8K5R13tW
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Thu, 02 Dec 2021 16:07:53 GMT
cache-control
no-cache
etag
W/"fdb219cd33c5e4a61c207931772b374a"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
RR6WAuJAvQxSuzO83QbSnpVTqpt304qQ8bj8kxLgflge33ESyaB4nA==
chat
js.driftt.com/core/ Frame 3915
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1638461400000/sv2uuh4gw3ms.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c7434033dbdeb0511af562cd6cd291126b19b54269c9e73e1cdde61d844cc09f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Wed, 01 Dec 2021 17:28:24 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
VonE6OIwSznjnG.y9UceJXaC8K5R13tW
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Thu, 02 Dec 2021 16:07:53 GMT
cache-control
no-cache
etag
W/"fdb219cd33c5e4a61c207931772b374a"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
wWX1QIb8wlgyvVYuLNclKGLm9dQ-YIyaETymsPszrBmEEAibSAvdHQ==
up
insight.adsrvr.org/track/ Frame 9478
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=g2lzvow&ref=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&upid=803df29&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/

Response headers

date
Thu, 02 Dec 2021 16:07:53 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=64bb1002fb57000058efa861eb020000a23a5500&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:53 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
runtime~main.f0932c45.js
js.driftt.com/core/assets/js/ Frame C421
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
eeb4ababae90e3b181584f2c785eb14735094388d4b7e5dc5f6b54bc5e819f8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 17:28:23 GMT
content-encoding
gzip
age
81570
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:12:18 GMT
server
nginx
etag
W/"b9163af8c4d5098a94fde60118a063e4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
D37q.KyNA5tDxmbbj6VteVOps71iYi4o
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XYqm2acJmwwTrj8jN2r1030b8VBZJQm0OueFfkW5F-rdgqW9Fphp5A==
4.a93e53d9.chunk.js
js.driftt.com/core/assets/js/ Frame C421
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
content-encoding
gzip
age
10182936
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 06 Aug 2021 18:47:25 GMT
server
nginx
etag
W/"fce0b3daf28dfa888be2818f43b06ef0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
S6yeG5EMP0ldIXYiJyQ655uRZRAbHfXOw3rhL0cQaOA6ET6qqX9rpg==
main~493df0b3.580db5ef.chunk.js
js.driftt.com/core/assets/js/ Frame C421
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 06:03:57 GMT
content-encoding
gzip
age
3319436
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:07:00 GMT
server
nginx
etag
W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FqFCC9Ln0DlhRJHgE8nACoe2A6X4I1_9HXLaZsSdIKwb0M0UpNaZEQ==
runtime~main.f0932c45.js
js.driftt.com/core/assets/js/ Frame 3915
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
eeb4ababae90e3b181584f2c785eb14735094388d4b7e5dc5f6b54bc5e819f8d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 17:28:23 GMT
content-encoding
gzip
age
81570
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:12:18 GMT
server
nginx
etag
W/"b9163af8c4d5098a94fde60118a063e4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
D37q.KyNA5tDxmbbj6VteVOps71iYi4o
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
5wz_bXfuLiyhwFzpPichOLR1Rwr-P6dQQWl3wpb2hyg6ZElYze3bjg==
4.a93e53d9.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
content-encoding
gzip
age
10182936
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 06 Aug 2021 18:47:25 GMT
server
nginx
etag
W/"fce0b3daf28dfa888be2818f43b06ef0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
i7TlKofgFFO6Aps5-gqBI3XxYU0q75afE-6tjZ9h4q65quCQwmZjvw==
main~493df0b3.580db5ef.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 06:03:57 GMT
content-encoding
gzip
age
3319436
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:07:00 GMT
server
nginx
etag
W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
DPxrldw5A2EMIq9lGqMOBuesHssLxKTLZyhAO-NdoHVHmxt85rk6Mw==
42.3b1c2441.chunk.js
js.driftt.com/core/assets/js/ Frame C421
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
2725975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:08 GMT
server
nginx
etag
W/"62fe06940598a98760a9eae46800ff59"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YJrAiG6vamuy8HfsI82akfoJ47BHD9qcxExmTJ6oG88Pj4LXcyMTYA==
17.cce21c2a.chunk.js
js.driftt.com/core/assets/js/ Frame C421
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
2725975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"565bf690dc82ce7e1f45c9647d892490"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
JplynRk_-oFBKV3tz9VloKaiizsG9zltooqTHKIvgKQDF0PEn3qplg==
35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame C421
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:08:30 GMT
content-encoding
gzip
age
2671163
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:57 GMT
server
nginx
etag
W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KfofLwvG14tKBpk6tXvFAfICf2R3Oaes
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RB5PDq_5nvAt1OhLvSGLuaxrUUxtfXaSjWEAyeBZigiGoywrSRtJ5A==
15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame C421
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 06:18:05 GMT
content-encoding
gzip
age
7552188
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:32 GMT
server
nginx
etag
W/"db60664de2c8d54d23e359c94e68f6ce"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
g5_r9PRy6KVcOMLAOtv4w6ZInCUxr94zzX6kw_HHO3e8aGrJar6lvQ==
19.5937a5b2.chunk.js
js.driftt.com/core/assets/js/ Frame C421
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"08aceb94bd26b0e431ca437d628e3c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
5uZ9QpX465cH8fHSnHMD_RwvKViluL4NF3r5CiziLch3wcnqg2Qlew==
32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame C421
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
juigjv2.842khaDjrzqiMoucoadLCjYk
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fYuX2rANgMOLD-xiXps9890XPbAgJqfKBIMqXJrqLqtePfE5yjJH2Q==
23.a53d721f.chunk.js
js.driftt.com/core/assets/js/ Frame C421
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8P07cElTKzzatCQBMuaLbbzDn74Jxjfl
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rjidygWGJJ0q2xZuRf9LMNsD9rJlrqH2NTQFM8Yypa6KI5yb0Y4aCA==
10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame C421
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:47:44 GMT
content-encoding
gzip
age
5340008
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 01 Oct 2021 18:06:47 GMT
server
nginx
etag
W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WTba57-_P0zlTr_I_jGSCuU9KMWA906fHGpJRE-iBWEA_k43R2qGvQ==
9.cea5327f.chunk.js
js.driftt.com/core/assets/js/ Frame C421
24 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:01:38 GMT
content-encoding
gzip
age
176775
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:12 GMT
server
nginx
etag
W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
PosyTfxpyo3QHgn-eXBVgA1SfIhijTu8YwONO0X7TpC6WFauFVHIZA==
13.c2156fc2.chunk.js
js.driftt.com/core/assets/js/ Frame C421
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"b94404e76324bd4454531b2e0a54f7bb"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
omU8MJDblUIhBwCM81QA4JZxHML9ySL0z-hLFWEYpr7dPvKq7e5yJw==
40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame C421
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:59 GMT
server
nginx
etag
W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
dEJFPXKyjB7sPVFDBALOngXXMN7dpU4Lz9NhyPkNQ-zvGCuW0jRmVw==
33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame C421
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 07:05:25 GMT
content-encoding
gzip
age
7549348
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:33 GMT
server
nginx
etag
W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
x9xPxe0FOgEjzVEWwoqmEw_u_0f8UbkY
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
x7jxJSmsWFZtet41UQpmToWLVQwH-6XtqzyE_xF74s4_sd9iyqrmPA==
25.b7a0bf53.chunk.js
js.driftt.com/core/assets/js/ Frame C421
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"808f7c7829001881a39cef6846a36ce0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
yIkl1W0nD7d2F7WiiaIbq.RDzzmuQuR1
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Akel-Fhp2jksaulKwInOECTuK44HwhovHXx0w9FN3kxWx_jYbv8smg==
16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame C421
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 04 Nov 2021 16:58:47 GMT
content-encoding
gzip
age
2416146
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 03 Nov 2021 13:47:23 GMT
server
nginx
etag
W/"b451093ecfaa012f364641010ed13346"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
AT7EnTrFxqPKS59EvnPv9--O4TAVgtvVbaf0UAqRIAShndF1sajhWw==
7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame C421
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/7.30af169a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 01:16:59 GMT
content-encoding
gzip
age
1781454
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 10 Nov 2021 18:26:23 GMT
server
nginx
etag
W/"bd798c00af88b7523deb5a8065993250"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Iacw2dmack9oGTZS3tnYG65bP0cXGt2v
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FD5cS8_TBYDpgJz7U01r56Xx_aqkFT3AXrAmnomz0csK4pdFEI89xQ==
7.ba44d36f.chunk.js
js.driftt.com/core/assets/js/ Frame C421
69 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/7.ba44d36f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
11d27d2ac15ed29e2769deb82c83901b218fba3535541af03b5e4e389a14b715
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:20 GMT
server
nginx
etag
W/"be9c30db45280cd93a65c217b5f439d1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
.bsbrqRGd3KbBlvAQn091Ie3Hjs81RG5
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ctbcPEHMU_kPSxK9U5661wX9enl_oPEHRAVQDbzJZ6fvJ1rzSdlg0g==
14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame C421
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
age
10182935
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Fri, 06 Aug 2021 18:47:22 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
t48qU1Po2Ry8jYpdcYJp4tzBm9byIn60TyvOpFqXAdd3FNRaWswJ1w==
14.dad5b9c7.chunk.js
js.driftt.com/core/assets/js/ Frame C421
73 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.dad5b9c7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
8d4842ea3131afb2c889435d7fa4da85c6692f42ad83a1b0087a47ed10c399fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:18 GMT
server
nginx
etag
W/"1ceab3facf2a332b3ff8f53bb8ae0178"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
NmuWzskZM7ZSDx59o.Nk.l7aO3PE2L6w
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hqRFNuTvBlhERRmJkB9n_QP0zA9D4EAKgB_mTduQccmsnT8ARvEeEg==
20.59e51040.chunk.js
js.driftt.com/core/assets/js/ Frame C421
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.59e51040.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1e5e3f29206ca046d131a9ea9db973a5a116a5f14c156db28e3a885381c40498
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"7902a4b6b2d44a9ebba2447498122c80"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
EmTbJrdDKKXIAo2Rwx2ftAT657NYabgu
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
khr5-qWJDqAyAomIBebXMN1Im-nY1LjbE2VhG2ItaqPl0Z9JasnCZw==
12.67f55360.chunk.js
js.driftt.com/core/assets/js/ Frame C421
41 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.67f55360.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cec2350ff5cf85f9c1abe6f5a85dc83a3c1e329ba8dac6530d833e6547d0f116
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 17:28:23 GMT
content-encoding
gzip
age
81570
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:12:15 GMT
server
nginx
etag
W/"a6943c85d275ad88f83d3560d9403e1f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
d.yofCZqDpov1o7tZz27H21iuzd0uwme
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Fgg2MHK-sUTRjjZgHMqWgEcxpL1nBqFDvD3ZQp3BTTekQhLlURtorg==
42.3b1c2441.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
2725975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:08 GMT
server
nginx
etag
W/"62fe06940598a98760a9eae46800ff59"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YggLW0S79vokLuikLL8CkSuudPWPLlORlM18H1ssmx1vkPXdp8DBVg==
17.cce21c2a.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
2725975
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"565bf690dc82ce7e1f45c9647d892490"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
piCJgPLKPbRqSef4jgjPtkpCIqK_3CVgi25mWjqRXZg4CHBOzvHUvw==
35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:08:30 GMT
content-encoding
gzip
age
2671163
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:57 GMT
server
nginx
etag
W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KfofLwvG14tKBpk6tXvFAfICf2R3Oaes
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
sMoiBcTjJTE9Mvod3sFsscuyyfukMgY3h_sEqkD_Q0NwfqTC_GgJ-w==
15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 06:18:05 GMT
content-encoding
gzip
age
7552188
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:32 GMT
server
nginx
etag
W/"db60664de2c8d54d23e359c94e68f6ce"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gCBwWDbTkojbl2BHDNpUFOl4YCTU7GRouzveTjl0fD4YSSwxhsr9PQ==
19.5937a5b2.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"08aceb94bd26b0e431ca437d628e3c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
l2qWh3YM1eASjg9b2SyeE0Z9-CluxHJm7QO84sSzc-AAThLeg6ivvg==
32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
juigjv2.842khaDjrzqiMoucoadLCjYk
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
smX6N4CEqAErk6tCHcCuQesPnu4ptGtoG380olO5eXH1G4aVTyd9uQ==
23.a53d721f.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8P07cElTKzzatCQBMuaLbbzDn74Jxjfl
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mPcd2Arhh7zS7ivBEcx5775VqR_ItL81X2tdxioqXhhzvwayrhutKA==
10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:47:44 GMT
content-encoding
gzip
age
5340008
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 01 Oct 2021 18:06:47 GMT
server
nginx
etag
W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
d06oObQ4jUbgyTwFaeX7cPMNHrtof1oM67RZryXs7CPo0y0s-XH9kw==
9.cea5327f.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
24 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:01:38 GMT
content-encoding
gzip
age
176775
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:12 GMT
server
nginx
etag
W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EIEcXWLkhZoRFxIDwhsG0xnzRaQ1Ozaya9jb9QDBStIgOy9oZwTKpw==
13.c2156fc2.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"b94404e76324bd4454531b2e0a54f7bb"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
H38z2iidGMiOgTeg0Hm0efM78JP5XbTjCPFe4ANLLIyH9DLkxIY_GA==
40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:59 GMT
server
nginx
etag
W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
QWyxmjQjdaZ487dtJJivMTOY5iB4lBOWhSUx4cRP9HD6rBeXPqi4rA==
33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 07:05:25 GMT
content-encoding
gzip
age
7549348
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:33 GMT
server
nginx
etag
W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
x9xPxe0FOgEjzVEWwoqmEw_u_0f8UbkY
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
uGjqFAkiHG6LOeJK4pnma5E36zEqCZMMap-Lq80fqcIX8NdXa2hnhQ==
25.b7a0bf53.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725969
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"808f7c7829001881a39cef6846a36ce0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
yIkl1W0nD7d2F7WiiaIbq.RDzzmuQuR1
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
b3A6DIISjy9yLqSKaMhVpcJ9RcKNv-GqD-Zq6DH4fPUsvj9wdM1PfA==
16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 04 Nov 2021 16:58:47 GMT
content-encoding
gzip
age
2416146
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 03 Nov 2021 13:47:23 GMT
server
nginx
etag
W/"b451093ecfaa012f364641010ed13346"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
CS3ZkVhU0MchrtOpbDGe061aqthhXJej9bVoHuDep7_Z-iTheuCaBw==
7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/7.30af169a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 01:16:59 GMT
content-encoding
gzip
age
1781454
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 10 Nov 2021 18:26:23 GMT
server
nginx
etag
W/"bd798c00af88b7523deb5a8065993250"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Iacw2dmack9oGTZS3tnYG65bP0cXGt2v
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Dm6TSRh6asQarJdy7GMDEMb8baiYnzlKRoJPNldN2B2ATQ1zJhpYNg==
7.ba44d36f.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
69 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/7.ba44d36f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
11d27d2ac15ed29e2769deb82c83901b218fba3535541af03b5e4e389a14b715
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:20 GMT
server
nginx
etag
W/"be9c30db45280cd93a65c217b5f439d1"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
.bsbrqRGd3KbBlvAQn091Ie3Hjs81RG5
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
UriEzjLRIzAd9hJrZzI-AgrAWdV6gLmMNaPm6t9EQzQ9NnxrvwbDug==
14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
age
10182935
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Fri, 06 Aug 2021 18:47:22 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
IoX8A2YNV67oSJSxfRWc-UaYJtdUiZJEwgA01Uxm9AAVd2SQtzGLDg==
14.dad5b9c7.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
73 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.dad5b9c7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
8d4842ea3131afb2c889435d7fa4da85c6692f42ad83a1b0087a47ed10c399fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:18 GMT
server
nginx
etag
W/"1ceab3facf2a332b3ff8f53bb8ae0178"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
NmuWzskZM7ZSDx59o.Nk.l7aO3PE2L6w
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xK2XzOqysb12M0FtbcZ6VuR_OAURXZirAepFtJ5NOEFrvNrgftwSpA==
20.59e51040.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.59e51040.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1e5e3f29206ca046d131a9ea9db973a5a116a5f14c156db28e3a885381c40498
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848840
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"7902a4b6b2d44a9ebba2447498122c80"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
EmTbJrdDKKXIAo2Rwx2ftAT657NYabgu
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
-svaG8zXA_Njd7JFX_RVkz4CTqTw2_Ga0itiMAH6LS5Ut59y-Izt9g==
12.67f55360.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
41 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.67f55360.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cec2350ff5cf85f9c1abe6f5a85dc83a3c1e329ba8dac6530d833e6547d0f116
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 17:28:23 GMT
content-encoding
gzip
age
81570
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:12:15 GMT
server
nginx
etag
W/"a6943c85d275ad88f83d3560d9403e1f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
d.yofCZqDpov1o7tZz27H21iuzd0uwme
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ajURBRd8PpAQZF1SbmOWOPcuTmKPU5HYBQCwal2gyOXYF5bpfGvhdw==
results.txt
yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net/eum/ Frame CDB0
Redirect Chain
  • https://trial-eum-clientnsv4-s.akamaihd.net/eum/getdns.txt?c=pme818pgf
  • https://yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Server
92.123.194.169 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a92-123-194-169.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:54 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net/eum/results.txt
Date
Thu, 02 Dec 2021 16:07:54 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
results.txt
eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net/eum/ Frame CDB0
Redirect Chain
  • https://trial-eum-clienttons-s.akamaihd.net/eum/getdns.txt?c=pme818pgf
  • https://eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net/eum/results.txt
8 B
312 B
XHR
General
Full URL
https://eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net/eum/results.txt
Protocol
HTTP/1.1
Server
2a02:26f0:6c00::210:ba13 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:54 GMT
Last-Modified
Wed, 08 May 2013 07:51:12 GMT
Server
AkamaiNetStorage
ETag
"402e7a087747cb56c718bde84651f96a:1367999472"
Content-Type
text/plain
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8

Redirect headers

Location
https://eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net/eum/results.txt
Date
Thu, 02 Dec 2021 16:07:54 GMT
Server
AkamaiGHost
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
0
22.e10510b6.chunk.js
js.driftt.com/core/assets/js/ Frame C421
42 KB
12 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.e10510b6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 29 Oct 2021 01:43:16 GMT
content-encoding
gzip
age
2989478
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 28 Oct 2021 18:04:34 GMT
server
nginx
etag
W/"a99459752bee496e4af7c45277fd9c26"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
S1N3wFsiK5kFlJ2Tv_rix_6QECdsZhE7
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
L95suO5z3cY0sB5l1C-1c5zpD6V65hMqIeveQpCQwqay4KN3w8f3dQ==
24.49c6961c.chunk.css
js.driftt.com/core/assets/css/ Frame C421
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/24.49c6961c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 07:58:46 GMT
content-encoding
gzip
age
3917348
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 15 Oct 2021 18:19:47 GMT
server
nginx
etag
W/"f80cd64e339375567091159cb077b941"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
t3wd1L70.jr_F45fRiZ9jDIt4M2lflSx
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xnZdjPLo-cmLESRsCtM_6_cJaBa08IzHsyq5i3B_i5_faB2CvF5buw==
24.3632c295.chunk.js
js.driftt.com/core/assets/js/ Frame C421
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.3632c295.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9b9cb5ed20b53ea6b4ea1ff2355f4503a2b3a0811b5eea90a46d87932d45a077
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848841
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"9cc1c16b32b5203ded0936e43a26c2b5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
aJ.POfjp1rnB8zITMt9sDj2VJw6PHXza
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XaxdE7iYZzFRYLfFJeJFG4jYDdhHv1jfdb3B0d2VoRBq8g1CIqSrvg==
18.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame C421
365 B
1006 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/18.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 27 Sep 2021 18:05:58 GMT
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
age
5695316
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Mon, 27 Sep 2021 17:53:27 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2nl84_Ynkb7J4eflOi4MBL9RG1iL8udX
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3m81aI1grcDO6jFhf2bPAuttcUBY1th8HC7Kktcy5AXKpta67rPwsA==
18.c447861e.chunk.js
js.driftt.com/core/assets/js/ Frame C421
84 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.c447861e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4193c906068e59efea49bf877ce6259a7befce4828660f7a37b12ec3a84c1ecb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=sv2uuh4gw3ms&region=US&forceShow=false&skipCampaigns=false&sessionId=953a25dc-33da-45cc-bbcc-2c3bf014369c&sessionStarted=1638461273.73&campaignRefreshToken=017ff166-a15b-4d7a-a182-b7050f58d356&hideController=false&pageLoadStartTime=1638461270887&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 22 Nov 2021 20:20:33 GMT
content-encoding
gzip
age
848841
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"3b88d372f3f4b68e7db793505ae832ff"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Bqtp7eTmaldDqB3daSJ_RyU8KrAlWdFv
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lPer_2YjDuPbNLzZ6OBdFmNPTcFH1KsEIS9TgXySBIj--hqVvx8Sqg==
30.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/30.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 12 Nov 2021 01:16:59 GMT
content-encoding
gzip
age
1781455
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 10 Nov 2021 18:26:23 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
rKGmc_vdYv4BKfza.gXAGrzMb7vmynVi
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
AbGppCDx9MdGRuvsA448fv8-lZDslFQwiL66kSVz6PMr_oPHy1DmAw==
30.025287d0.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/30.025287d0.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f5642eea8890a1123d9a49ae8efd66755a53d6b44301249f5d9b27b21acab85d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Fri, 05 Nov 2021 14:52:26 GMT
content-encoding
gzip
age
2337328
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 05 Nov 2021 14:12:32 GMT
server
nginx
etag
W/"f592b825cca98e86b19c3c23a7bc0d4f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
a6HLBQKMhG_EVQxQQ4E8g0hI6_AoNhGH
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y3x1325JMGMkC1CjqVQVSIka4miO0DXhDtYU-o23P7D22X0U_A57iQ==
1.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
2725970
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:04 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
K9l0WdnhS0.sb1iJQdTJni3xfVGcn633
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zcLkCsFc-1w3f8fpyoyIT67OMp5U8hrKGHDG3RQwpxBm4fMh1etfUQ==
1.187c50a5.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
54 KB
16 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.187c50a5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:22 GMT
content-encoding
gzip
age
3305672
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:57 GMT
server
nginx
etag
W/"eeccccb655ee3b6bcb8b1a9b1da4fd30"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
T4NYA9GFrw0AOH7iks5Owut4YT_Q7yUg
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
sl0XJU2gw1iex3KjFort3DExIrHLhp4JcUp4mP3LZwPy0EI4exih5Q==
0.3c34c777.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
44 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/0.3c34c777.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
6c166626718a3f6b92a1e3b0d9c726c0c21e0f3ca92221066ab4a0a8d174a38e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 17:54:49 GMT
content-encoding
gzip
age
166385
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 30 Nov 2021 17:20:07 GMT
server
nginx
etag
W/"4a5aaafc0741834f0fd8c10d76bdcd18"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
mDo2e7nWXBuK1cbyE.Q6x8h8HG66HcZW
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rPtzuyxlrflouK-NgaZcqmPkQyNSSKEjnW_G-8aWKFS6dwH2tj23lQ==
0.6b970cb5.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
70 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.6b970cb5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fe71be4ae557bbfef21b7981c8f7816e7f17dc060562cc046027ea49ce76be1f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 01 Dec 2021 17:28:23 GMT
content-encoding
gzip
age
81571
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 01 Dec 2021 17:12:15 GMT
server
nginx
etag
W/"3268e349594f9e9f4bd312ec87805867"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
NbFMOJ5QbKiQhk.P3Zq.upDisXBA.Lll
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rso-gDvo2GBF8EJez-krMD2CBIEuPp6onUIzJaLku2tC1m-3G6LbqA==
29.a4eacd1c.chunk.css
js.driftt.com/core/assets/css/ Frame 3915
11 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/29.a4eacd1c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 20:12:40 GMT
content-encoding
gzip
age
1281314
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 17 Nov 2021 19:25:04 GMT
server
nginx
etag
W/"5fcabdf983fd5bbf7cb199063137d146"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
k82F8FaNpkIB_WK109g86MbRHlA8U_6q
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_0c1FUArKd_lG56Xh7rmwV24GPTiTCmyDjxxVP4fqtz76cou8HOlxQ==
29.73b9ccf9.chunk.js
js.driftt.com/core/assets/js/ Frame 3915
11 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/29.73b9ccf9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f0932c45.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.205.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-205-97.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
61c5e0ee01b43350fc63d6540019ca4a1a2fec438e09e225b715a442a63115f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1638461270887
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 18 Nov 2021 14:19:35 GMT
content-encoding
gzip
age
1216099
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 17 Nov 2021 21:01:38 GMT
server
nginx
etag
W/"08a72aad434f11567a747fd67be2d3fb"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
qicBCcKgTenss1sMR3kJQz8teIQSYJPA
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
UvoVY6T1Cf6SpovLtaDIKvaKkguKKhkD21PkOUaedpYC2kyv31fDhQ==
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 02 Dec 2021 16:07:54 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drifta251fb74ac586205c8346da5bb5
content-length
13
x-envoy-upstream-service-time
0
server
istio-envoy
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame C421
25 B
123 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 02 Dec 2021 16:07:54 GMT
server
istio-envoy
requestid
4cb37973b55fd54d
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
34
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame C421
126 B
222 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f39cf37ffc0dd32545437f3f3910bedc1a5708a76b3512972cfb7ceac2058616
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 02 Dec 2021 16:07:54 GMT
server
istio-envoy
requestid
cc511cd07c42a876
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
3
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
126
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 02 Dec 2021 16:07:54 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
driftc09df774736a4e3334504f929be
content-length
13
x-envoy-upstream-service-time
0
server
istio-envoy
/
0217991a.akstat.io/
0
204 B
Ping
General
Full URL
https://0217991a.akstat.io/
Requested by
Host: s.go-mpulse.net
URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
2a02:26f0:6c00:287::11a6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.trendmicro.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Thu, 02 Dec 2021 16:07:54 GMT
content-type
image/gif
access-control-allow-origin
https://www.trendmicro.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
timing-allow-origin
*
x-xss-protection
0
expires
Thu, 02 Dec 2021 16:07:54 GMT
sv2uuh4gw3ms.json
embeds.driftcdn.com/embeds/ Frame C421
63 KB
10 KB
XHR
General
Full URL
https://embeds.driftcdn.com/embeds/sv2uuh4gw3ms.json
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-9.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
30f206922873917b670c073b8c33e38e32e9988a9a6d617b83be861bda5dc12c

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date
Thu, 02 Dec 2021 16:07:54 GMT
content-encoding
gzip
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Thu, 02 Dec 2021 15:23:01 GMT
server
AmazonS3
etag
W/"cf68dccb87efa620c3e873d871ac52d1"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/json; charset=UTF-8
via
1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
cache-control
public, max-age=30
x-amz-cf-id
lXei3PX7ZZq71eYmG0y2n5_iOHxC8JrGkD4b9JDmFK3dPEDfza--wQ==
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=64bb1002fb57000058efa861eb020000a23a5500&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A53%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:55 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=64bb1002fb57000058efa861eb020000a23a5500&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A54%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:56 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame C421
25 B
88 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 02 Dec 2021 16:07:56 GMT
server
istio-envoy
requestid
544b74180c6bf186
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
15
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Thu, 02 Dec 2021 16:07:56 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
driftf2f243648e897fb394e32372cb3
content-length
13
x-envoy-upstream-service-time
0
server
istio-envoy
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=64bb1002fb57000058efa861eb020000a23a5500&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A55%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:56 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=810eb8f4ed8abcee5cd1e233263d8d3f&svisitor=64bb1002fb57000058efa861eb020000a23a5500&session=bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2002%20Dec%202021%2016%3A07%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225008%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20blog%20entry%2C%20we%20will%20take%20a%20look%20at%20the%20ProxyShell%20vulnerabilities%20that%20were%20being%20exploited%20in%20these%20events%2C%20and%20dive%20deeper%20into%20the%20notable%20post-exploitation%20routines%20that%20were%20used%20in%20four%20separate%20incidents%20involving%20these%20web%20shell%20attacks.%22%2C%22keywords%22%3A%22cyber%20threats%2Cresearch%2Cexploits%20%26%20vulnerabilities%22%2C%22title%22%3A%22Analyzing%20ProxyShell-related%20Incidents%20via%20Trend%20Micro%20Managed%20XDR%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.trendmicro.com%2Fen_us%2Fresearch%2F21%2Fk%2Fanalyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html%3Futm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell&pageViewId=5ca56b79-4c00-4880-8c27-ae3b7c2eb530&an_uid=5319264918302201021
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.trendmicro.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date
Thu, 02 Dec 2021 16:07:57 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/global/navigation/project-2030-nav-banner.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-1.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-2.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-3-b.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-4-a.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-4-b.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-5.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-6.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7-b.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-7-c.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-8.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-9.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-10.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-11.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-12-a.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-12-b.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-13-a.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-13-b.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-14.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-15.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-16.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-17.jpg
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-18.JPG
Domain
www.trendmicro.com
URL
https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-xdr/proxyshell-xdr-19.jpg
Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

310 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| BOOMR number| BOOMR_lstart function| $ function| jQuery object| matched object| browser object| Granite object| BOOMR_mq object| maxy_pathnames number| settings_timer number| _vwo_settings_timer object| _vwo_code object| BEJSSDKObserver function| jsElementReady object| BEJSSDK object| BEIXF object| utag_data object| base64 function| Cludo object| CludoSearch string| cludo_language number| _vwo_acc_id object| vwoCode object| _vwo_style string| _vwo_css string| _vwo_cookieDomain string| _vwo_uuid number| _vwo_library_timer string| _vis_opt_file string| _vis_opt_lib undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| VWO object| vwo_iehack_queue object| _vwo_exp_ids object| _vwo_exp object| _vwo_pa string| _vwo_worker_cb number| _vwo_clicks object| utag_err boolean| utag_condload string| pathString object| path undefined| anchorsArr undefined| anchor undefined| href number| len undefined| linkName function| id object| mileStones object| ytapi object| scriptref undefined| playerCheckInterval object| utag object| _gaq object| pageTracker function| setMileStones function| _tealium_old_error boolean| __tealium_twc_switch object| teal object| utag_cfg_ovrd undefined| iframe_container string| iframe_url object| players function| onYouTubeIframeAPIReady object| start function| onPlayerReady function| onPlayerStateChange object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady function| initializeFPJSLibrary function| detectIE object| _bright3 function| beLinkBlockCallback boolean| ie_version undefined| style undefined| select object| scriptTag string| org_id object| betrack object| showLogs string| domain object| domainPath object| timeout string| sessionTmeout boolean| bf_e_org object| bf_e_org_list number| bf_i object| bf object| goal object| goalvalue number| maximum_custom_variables number| maximum_custom_metrics object| customdimension_value object| custommetric_value number| maximum_conversions object| conversion_count_value object| conversion_value_value boolean| disableTrack object| deferCallback object| useCustomLinkBlockStyles object| showLinkBlock object| JSON3 function| isSameSiteNoneCompatible function| shouldSendSameSiteNone number| c_begin function| Fingerprint2 object| dataLayer function| vwo_$ string| _vwo_server_url object| _vis_opt_queue object| _vis_opt_check_segment object| _vwo_evq function| _vwo_ev boolean| DISABLE_NATIVE_CONSTANTS object| _vwo_t object| _vwo_editorOperationTracker function| _vwo_handleMutations object| _vwo_api_section_callback object| _vis_opt_comb_name function| _vwo_s object| _vwo_campaignData function| _vis_opt_top_initialize function| _vis_opt_bottom_initialize function| _vis_opt_goal_conversion function| _vis_opt_revenue_conversion function| _vis_opt_pause function| _vis_opt_readCookie function| _vis_opt_createCookie function| _vis_opt_element_loaded function| _vis_opt_GA_track function| _vis_opt_register_conversion function| _vis_opt_get_campaign_xPath number| _vis_opt_experiment_id boolean| _vwo_settings_timed_out object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportGELProtoQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions string| cookie_str number| s_expire string| cookie_set_string number| c_end number| BOOMR_configt object| _bmrEvents object| __nls number| ___vwo object| google_tag_manager object| google_tag_data object| _vwo_geo function| Sly function| webpackJsonpjwplayer function| jwplayer function| UET function| UET_init function| UET_push function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| ueto_6c294cb348 object| uetq function| ttd_dom_ready function| TTDUniversalPixelApi function| hasClass function| addClass function| removeClass function| closest function| debounce function| getStringDifference function| dropDecimal function| getPriceWithCommas function| allArrayElementsEqual function| isMobileDevice function| isLandscapeMode function| isIE function| isIE10orOlder function| superscriptSpecialSymbols function| matchSectionHeights object| TrendResearch object| articleFolioObject object| disruptorPanel object| folioMessage number| globalBodyScroll function| toggleFilterListNav function| hideSearchBar function| setFocus object| searchButton object| utilityAlerts object| filterListObject object| accordion function| getCheckedCheckboxesFor function| bindDocumentClickEvent function| matchJWHeight object| overview function| jumpScroll object| promotionalContent object| savedArticles object| alertsCookie function| isArticleComponentEmpty object| favoritedArticlesCookie function| Hammer function| Sifter object| MicroPlugin function| Selectize function| UAParser object| Handlebars object| researchUtilityMenu object| bsModal function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis string| addthis_pub function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto object| CludoSearchInstances object| $navSticky undefined| targetAttribute object| addthis_share object| addthis_config boolean| __@@##MUH object| _6si function| drift undefined| driftt string| GoogleAnalyticsObject function| ga object| oattr object| _gat object| gaGlobal object| gaplugins object| gaData function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| _atw string| addthis_exclude boolean| addthis_use_personalization string| addthis_options_default string| addthis_options_rank string| addthis_options object| __callbacks object| MunchkinTracker object| 3eiXJRXgVuLsYGH9303q object| regeneratorRuntime object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked number| c_start boolean| _storagePopulated function| _0x47ef function| _createForOfIteratorHelper function| _unsupportedIterableToArray function| _arrayLikeToArray function| _0x29f6 object| AJS object| AccessiBe object| acsb object| acsbJS object| EJSEventListeners object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id number| BOOMR_onload object| whichUl function| EJSCustomEvent

44 Cookies

Domain/Path Name / Value
.t.co/ Name: muc
Value: 3a31e796-d73d-4a16-adc1-92ee67c71a22
.t.co/ Name: muc_ads
Value: 3a31e796-d73d-4a16-adc1-92ee67c71a22
.research.trendmicro.com/ Name: _bit
Value: lb2g7N-ecb0b93b984f3d5697-00C
www.trendmicro.com/ Name: trendMicroVisitorContextIsBusiness
Value: true
.youtube.com/ Name: YSC
Value: rbh8cUlMSl4
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: 7lQtz7zTihc
.trendmicro.com/ Name: _vwo_uuid_v2
Value: DDF3195BC008195016AD302E369DAFAB7|9fc00fb3a4901e64f116701293061ed3
.trendmicro.com/ Name: utag_main
Value: v_id:017d7be6ec8e00189ea6be580e4a0307200be06a00b08$_sn:1$_se:1$_ss:1$_st:1638463071183$ses_id:1638461271183%3Bexp-session$_pn:1%3Bexp-session
.trendmicro.com/ Name: _c1Ref
Value: /en_us/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html
.trendmicro.com/ Name: _vis_opt_s
Value: 1%7C
.trendmicro.com/ Name: _vis_opt_test_cookie
Value: 1
.trendmicro.com/ Name: _vwo_uuid
Value: DDF3195BC008195016AD302E369DAFAB7
.trendmicro.com/ Name: _vwo_sn
Value: 0%3A1
.trendmicro.com/ Name: BE_CLA3
Value: p_id%3DP46RL8R462P4RAA46A6JR8LRAAAAAAAAAH%26bf%3D9a146a6dd5b92bb6e2686efa069789be%26bn%3D1%26bv%3D3.43%26s_expire%3D1638547671463%26s_id%3DP46RL8R462P4R6L26P6JR8LRAAAAAAAAAH
.trendmicro.com/ Name: _vwo_ds
Value: 3%3At_0%2Ca_0%3A0%241638461270%3A61.67634655%3A%3A%3A95_0%2C69_0%3A0
.trendmicro.com/ Name: _gcl_au
Value: 1.1.427786736.1638461272
.bing.com/ Name: MUID
Value: 0237D5A091CD6A042ED6C4A190A66B02
.doubleclick.net/ Name: IDE
Value: AHWqTUn7ko_PifkQWZuTvMi_SKahmQOVa_o7quJrJw877VHbFPtSOlCxWltj_blWqEY
www.trendmicro.com/ Name: __atuvc
Value: 1%7C48
www.trendmicro.com/ Name: __atuvs
Value: 61a8ef575629477e000
www.trendmicro.com/ Name: __atssc
Value: twitter%3B1
.trendmicro.com/ Name: _uetsid
Value: 009b8040538a11ecbe97497e15b05300
.trendmicro.com/ Name: _uetvid
Value: 009b9dd0538a11ec9b554921bcc98469
.addthis.com/ Name: uvc
Value: 1%7C48
.addthis.com/ Name: ssc
Value: twitter%3B1
.trendmicro.com/ Name: __utma
Value: 44797537.653634450.1638461272.1638461272.1638461272.1
.trendmicro.com/ Name: __utmc
Value: 44797537
.trendmicro.com/ Name: __utmz
Value: 44797537.1638461272.1.1.utmcsr=trendmicroresearch|utmccn=1121_Proxyshell|utmcmd=smk
.trendmicro.com/ Name: __utmt
Value: 1
.trendmicro.com/ Name: __utmb
Value: 44797537.1.10.1638461272
.trendmicro.com/ Name: _ga
Value: GA1.2.653634450.1638461272
.trendmicro.com/ Name: _gid
Value: GA1.2.1776182122.1638461272
.addthis.com/ Name: loc
Value: MDAwMDBFVURFTkkyMzMyMTg4MjAwMTAwMDBDSA==
.trendmicro.com/ Name: _mkto_trk
Value: id:945-CXD-062&token:_mch-trendmicro.com-1638461272520-32020
.adnxs.com/ Name: uuid2
Value: 5319264918302201021
.resources.trendmicro.com/ Name: __cf_bm
Value: Yh8pEL4PZKgXK1v6FHRRSJHIryVfzfxsKt0QgImQa_k-1638461272-0-AS0G3ZaXZBkAhGaQWFqyLOkYr1ocb91YlnNYHx7sTG4DprUmJYttP0p9CNAg81xwGwm3R1vcY/8aqBhQVp/muvo=
.trendmicro.com/ Name: querystring
Value: utm_source%3Dtrendmicroresearch%26utm_medium%3Dsmk%26utm_campaign%3D1121_Proxyshell
.6sc.co/ Name: 6suuid
Value: 64bb1002fb57000058efa861eb020000a23a5500
www.trendmicro.com/ Name: _an_uid
Value: 5319264918302201021
www.trendmicro.com/ Name: _gd_visitor
Value: 4f57d707-8681-45ac-8c09-f50123a91c83
www.trendmicro.com/ Name: _gd_session
Value: bda2f4c3-8a2e-432c-8cdf-706c4cfb6eb5
www.trendmicro.com/ Name: _gd_svisitor
Value: 64bb1002fb57000058efa861eb020000a23a5500
www.trendmicro.com/ Name: drift_campaign_refresh
Value: 017ff166-a15b-4d7a-a182-b7050f58d356
.trendmicro.com/ Name: RT
Value: "z=1&dm=trendmicro.com&si=35c405c8-aa2c-49cd-80fd-2ccceb654fc2&ss=kwp5japc&sl=1&tt=3a3&bcn=%2F%2F0217991a.akstat.io%2F&ld=3aa"

3 Console Messages

Source Level URL
Text
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://tags.tiqcdn.com/utag/trendmicro/nabucms/prod/utag.sync.js(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.bc0a.com/autopilot/f00000000017219/autopilot_sdk.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
deprecation warning URL: https://s.go-mpulse.net/boomerang/TU3LW-WPX5W-YK52N-GNWRK-Z5B9X(Line 9)
Message:
Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user's experience. For more help, check https://xhr.spec.whatwg.org/.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=0
X-Xss-Protection 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0217991a.akstat.io
5427711.fls.doubleclick.net
945-cxd-062.mktoresp.com
a.b0e8.com
acsbap.com
acsbapp.com
adservice.google.com
api-public.addthis.com
attr.ml-api.io
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.go-mpulse.net
cdn.acsbapp.com
cdn.b0e8.com
cdn.bc0a.com
customer.cludo.com
dev.visualwebsiteoptimizer.com
eaaqvsaaeabqgkqce3yab3yaabq2r322-pme818-932888c30-clienttons-s.akamaihd.net
embeds.driftcdn.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
insight.adsrvr.org
ixfd1-api.bc0a.com
j.6sc.co
js.adsrvr.org
js.driftt.com
m.addthis.com
marvel-b1-cdn.bc0a.com
marvel-processor.bc0a.com
metrics.api.drift.com
munchkin.marketo.net
research.trendmicro.com
resources.trendmicro.com
s.go-mpulse.net
s.ml-attr.com
s7.addthis.com
secure.adnxs.com
ssl.google-analytics.com
t.co
tags.tiqcdn.com
trial-eum-clientnsv4-s.akamaihd.net
trial-eum-clienttons-s.akamaihd.net
v1.addthisedge.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.trendmicro.com
www.youtube.com
yenq4lc4ppbksyni55na-pme818-b9efff402-clientnsv4-s.akamaihd.net
z.moatads.com
s7.addthis.com
www.trendmicro.com
104.111.233.140
104.17.71.206
104.244.42.197
104.96.148.88
142.250.186.102
143.204.205.97
143.204.94.161
143.204.98.9
161.35.15.77
167.172.136.187
172.217.18.98
184.51.8.183
184.51.8.191
185.33.220.100
192.28.144.124
2.21.140.111
206.189.187.108
23.202.53.245
2600:9000:2156:c600:12:3734:2a40:93a1
2600:9000:2250:8600:0:f267:a5c0:93a1
2606:4700:10::ac43:1b98
2620:1ec:c11::200
2a00:1450:4001:801::2002
2a00:1450:4001:802::2008
2a00:1450:4001:808::2003
2a00:1450:4001:808::2004
2a00:1450:4001:808::200a
2a00:1450:4001:80f::200e
2a00:1450:4001:811::2008
2a00:1450:4001:811::200e
2a00:1450:4001:827::2002
2a00:1450:4001:831::2003
2a02:26f0:6c00:1b8::11a6
2a02:26f0:6c00:287::11a6
2a02:26f0:6c00::210:ba13
2a02:26f0:ef::5c7b:c244
3.94.218.138
34.102.193.142
34.193.113.164
34.95.105.148
34.96.102.137
35.158.71.178
35.190.5.192
35.201.125.192
35.201.70.94
35.71.131.137
67.199.248.12
68.67.153.60
92.123.14.222
92.123.194.169
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
058ed961bfe422af7bfc65865f4c08531ec8ace995f8a1ec560a46581cb7712c
09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4
10a093e78973bdaa53efc972c9fac045870395e160e43a3c9a936f6104c0a9a2
11d27d2ac15ed29e2769deb82c83901b218fba3535541af03b5e4e389a14b715
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
16a82f9d8888d0159e73c5cb69d6aa12c00d1e43280afd005b394c8cef670908
1741d89133e0524732a863e38fdbacce2ca8fd77eb3bffb0275de3d946ff5524
179eb991060face02477e0406b1a413ac50ec26fe9f397e07e4ee95f7e6a5298
1a6d635ba5c654806a0d313b7139671f0b548c621566d0821e1d514de02fd5d1
1b154bfaea92a935726ed4a450101dc646a86588cfa0f066cae2050130124569
1b973667ceb759e49f2982721f36e4d20a2f8b5dce8c47ccf3039d6ab748143e
1ce17fb3a120c3c46404643788d7934940c71dac562fcf023aa5f084321b52a1
1e0f88cfb3b527231df0650deb92e01a7739867b433ebe96f20eb48302476d1c
1e5e3f29206ca046d131a9ea9db973a5a116a5f14c156db28e3a885381c40498
1e882e60f7e48e1e15a85bfcb8dd1c43878958a7272f42c2f6bb05c08a537c70
24829271d6317b4fe646497995d91d5beec2ec75d6bae317de7d8df97478175a
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
271b648df0f374086de48cc3faed55c25f3f31b37151e1cf3dd25729668261fc
2a499c62bd4a1555dc2be24483a7de1cb92605c2dee544ce0435a7add53b52c4
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
2f19845cf43e230d17e25cd573d7b23c12511241bde91c2844e16ea8be462d8c
2f7236edbed46e5b69ca4626c65d075f7c1b4d2cf9c25bfdafa0db5c346ddbb9
2fb38b1a6ed4e3ff8631fb24b9c246142637dcc4675645b2a145df94f57ce466
30f206922873917b670c073b8c33e38e32e9988a9a6d617b83be861bda5dc12c
3166f2afad5a93b28c8279e01efba0a7a52134a7bd32c33f17a3bd6f909c77af
3434e49cf1adb48b366367d0588d9f5dc7bc5046a2cd01cec3da394505b6b4c0
3b4418c8aaf8b19d137f23682f72d4f197bee8b2d002d8d00a8208fa63d772b5
3dc5d7f667c6a793c6a56b96afffa81664350fdb10c7544112ea9057e563dc6f
3ee9ec06bbfa8bb6e040e6edc9718c1905b557f3e9e988398b70d378096d02f8
4193c906068e59efea49bf877ce6259a7befce4828660f7a37b12ec3a84c1ecb
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
4374dd962af674855e017ef5cc5f3e40cd1bd23991a4bce1fea0257de71e63d8
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
449f4003c0338b98db25d4783c328ba6d34a88d4111e525364fba5290f593527
4a3779d547c50c9bfe22c5d6f0d9075f0a3c2536a32554a87204112d2bd5841d
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4ca89be81af6e10da3c132c1154e1fb98dabd27bb35715c1ba2378ebf998119d
4d84fe5c22e0f46797860a0082fcef2abe7f9c7d1f83d8c1e1a548663219aa96
4dddf08e6f56bf5b28ece6ba36e94f9a398b5549f36e67a74c9562e27bbf9402
4e00181505e8a1efde1c9b3d9e49e966c64eb830b3fe0f7a8b113e9d8c9d8bea
50d3a335e5589e6fa53f86edee68f3914dc9403beee9d8e1aaf8b085e686447f
5263bc478046d08c3e54893ee6d5f9f463bb7eea4adc895ef7f72e0d6f211685
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
53a6452ff116e04cbbcb2168889a61c9bf0cbb9b723be8532204759a0e1f5ada
54b8c08ed2e64a537c5d8ec6efc880484e1b753a49da11b584103a62a5debf1f
5551a75c064d136e9a4c7362cc7df65b712451ed176532dcdf42dda4fd31814a
55bf883d78b3c617205e5e002e43bfa5055c0075e7ca68db49ddf7fe90cd6b55
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
59bf6d1492dc7f58093c5d56a0dc05f2113267f49ab22cb3b9ffa8848e5d258a
5bcda23b798e081e8b43502c8a53a63e0433720a971d2318386ab6f767f09b93
5d4bcd856c53d2f61e7ad40f7049ce89d8f7fae19cc344777cb86bc5c73d31ca
5d607290850b98abf46050b72c7e12879f277d66e1141dfcf2128c1fec193103
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df
61c5e0ee01b43350fc63d6540019ca4a1a2fec438e09e225b715a442a63115f3
62e37140e90c20b8021e84f22588bff6f0789e2ac60bd107b21017d0acd41b51
662efaf46c617ddbcb8ff4a2a8f64cffd3d93630f1003f8e66511f369b87730f
676e66eeb5e721df2e68029d518067cece19d56d7e0b4a1c9a2e3c449a232bca
6c166626718a3f6b92a1e3b0d9c726c0c21e0f3ca92221066ab4a0a8d174a38e
6dd1b30ae3272ce7dccb6f12f6e0a839a7cb79fb5bda20efb321d68feaf866b2
6e6e7cd29eee10c166eedd729797d9fc65762807a670b77835cf0e831ea02c02
7004945db892cd6f93ded26d3f944f0b15355d1363a6bc0b9fa906d2e34cb4ea
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
7964c33dac5701ee3dc265c4b79fa45f10f13258a80986ea61c17c8460195f00
799cb15a25ed2fa78bdba496d1afbc68f033a3a5dd9ead12f4eaac4e0a93236d
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7c312ff2093c1ce527c7879bb568b88a1fc306c6fdb1cbb5e690ff487344c267
7d0ea6fbfa59d8849589c61830741581253e00cc485d7e4d4d32f4cde293832b
80e677fe95c173f4a4e548dd9062fecfa6c385fcbf92e1312a511b380d4b3ffd
80f191f5515dde7719a0643eea1cbbb3b07a306679a3c565afb5bae17a826104
8299331e0959f53cb0d0ff4d00704219b3e087c9f544dad28d5441621fc0d43c
8335336c1d70b1722df3b07b921471092c56120ea02781181d6bd75b6dc0ffa3
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
8d4842ea3131afb2c889435d7fa4da85c6692f42ad83a1b0087a47ed10c399fc
8f37c9815fbb866d0417ebe23f74ccbf507ea03f969260f576cfd4bbd9da2a28
9223e6eb171099c0a8d26458e61a9219ebacc0107853337cac5a69dd821d819b
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9b9cb5ed20b53ea6b4ea1ff2355f4503a2b3a0811b5eea90a46d87932d45a077
9ca36915a0c58b2ea2b91956fe0d42a8425af95447e3028df471474c20430c9a
9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4
a8c507e4785f2c0f6bb2fff53603e6d768e85f1e7514278d2f7a72ca7ab3ec6d
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
afc1c112b7b360b5439f1936af3b465775405a64641acd6ef01017d708dcaef7
afdd29778a35ecf1638fc1c8bee1d4f7843d437d01b5db08cdf364da6b0edeaf
b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd
b2f3541761e551d25978dc767a275234766081fefb02f7831fc39a43a168e31b
b63c2ebcfbd64a62865ef42db3918fcc5d3445a649b585655ffc77ffcfef2688
b64e912319727e895ca1311e467c874471bc4d624a17bba4deffa99813df4bdf
b8a34dec51d1542d219b92e8425cae1fcd3f55c26f8d9cb67d2a9e7c2e79543d
bd701a68dddee2555a381f41190b0b2137d435b7e8a79af86d520425633c7f46
c1e7cad13c931a7983055f5d464d4a63b91f8557c97cd8645892394ce124316a
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
c67a98460c2dbd3d301997c6b0cda7919f33d554f8b084f14f3759012299e148
c7434033dbdeb0511af562cd6cd291126b19b54269c9e73e1cdde61d844cc09f
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
ca46e382a89f5c61738120ec3d05af9bfafbbb1f0a15d344413cfdefe4e157a7
cad0d01c32d43b3eab5ed2857a6ef8473052d7eebb8988f819d847dd278fafeb
cba25a298b3e668425865beb284073266936c68dd7619af2ef58ce6e197ff529
cc830f158471cfce3f5d5b6279b9e37d764630e9d6e262e7665a9752bb1f2aa2
cd62dbd19af2c21731383cb00355a1de74247224a7df74154792f2ba336e412b
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
cec2350ff5cf85f9c1abe6f5a85dc83a3c1e329ba8dac6530d833e6547d0f116
d5f14381258973e1a93167d8b3486ae1b2665ea072feb622e1ec0a446facc400
d6b3c983ebf9b00bd8fc6c02750dbc213485b34e497d275d18fda2aad1ed1ddf
d8366292b6413e815888abbc34c7800df0b1d8101bff22e1f3ca1f34170a73b3
da00ef9657c42042dccf096ce357b5062c144bf65eece9b2f823be34c0d3d824
db627e3f7737a82b02d8d4945c834c40a9388f8db5c94025f57fb1a99db62253
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15
e348f721442e051780e0a89843aaad43dbe518d051cad5ce5b6816397a8fc773
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e687349ef50927f263497a200ed021ebaa6d13850a8b9a0a19de3d2260729d69
e8dc09e4ddc3c326ef6341498e7e8e70af3a848713429b909be53c947b43da10
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
edff8d9080b6da6eb56bf6db1b7bd85ea45abce8f198215a71cde5df6d6f61ff
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
eeb4ababae90e3b181584f2c785eb14735094388d4b7e5dc5f6b54bc5e819f8d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efbc707369cbd580ebffa0ed1817ed1b96f03619eb1493f8e631735abc8e76a9
f39cf37ffc0dd32545437f3f3910bedc1a5708a76b3512972cfb7ceac2058616
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f5642eea8890a1123d9a49ae8efd66755a53d6b44301249f5d9b27b21acab85d
f64a06f7949a0dabe65e7683ade627d29301122d68a4bc3239b161ec00697e66
f795b85773aeeb4d69eb8d36e82f9106344b4a5edf011f9cb22eb4d4e146f3e1
f800e98034c8d8e1e4824ffcf6df7c4cb56854ccaa77eaeeb1eb259c691aa263
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
fe71be4ae557bbfef21b7981c8f7816e7f17dc060562cc046027ea49ce76be1f