www.cfr.org Open in urlscan Pro
2a02:e980:d2::97  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request compromise-websites-related-uighur-communities Show response www.cfr.org/cyber-operations/	70 KB 17 KB	148ms 124ms	Document text/html	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software nginx / Resource Hash 853543e7897d206860b0224c9982433ce41931b2542a279c50df179f4ff646d0 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers :method GET :authority www.cfr.org :scheme https :path /cyber-operations/compromise-websites-related-uighur-communities pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control max-age=10800, public content-encoding gzip content-language en content-type text/html; charset=UTF-8 etag W/"1615183575" expires Sun, 19 Nov 1978 05:00:00 GMT last-modified Mon, 08 Mar 2021 06:06:15 GMT link <https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities>; rel="canonical" <https://www.cfr.org/node/9608>; rel="shortlink" <https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities>; rel="revision" <//microsites-live-backend.cfr.org>; rel=preconnect; crossorigin <//microsites-live-backend.cfr.org>; rel=dns-prefetch server nginx x-content-type-options nosniff x-dns-prefetch-control on x-drupal-cache HIT x-drupal-dynamic-cache MISS x-frame-options SAMEORIGIN x-generator Drupal 8 (https://www.drupal.org) x-pantheon-styx-hostname styx-fe4-a-6b4c66d56-bxbqx x-styx-req-id 3b334248-8115-11eb-972f-b61cd0dbb203 x-ua-compatible IE=edge date Tue, 09 Mar 2021 21:55:45 GMT x-served-by cache-mdw17355-MDW, cache-hhn4027-HHN x-cache HIT, MISS x-cache-hits 1, 0 x-timer S1615326945.244162,VS0,VE107 vary Accept-Encoding, Cookie, Cookie, Cookie age 5570 accept-ranges bytes via 1.1 varnish, 1.1 varnish set-cookie visid_incap_466780=yDIb2TfpQIGpGRPOPmQko+DuR2AAAAAAQUIPAAAAAAAWFC0bbVgpGHS0XCgMz+O0; expires=Tue, 08 Mar 2022 23:38:33 GMT; HttpOnly; path=/; Domain=.cfr.org nlbi_466780_2148524=A/VpcfEyYBbZLaepDW3k1AAAAAD7LyAr8aAZsh19vvfmZr0t; path=/; Domain=.cfr.org incap_ses_1368_466780=83O+RGOdmAbYYIvO1xz8EuDuR2AAAAAApML+AiPbdAfnCHczD55+FQ==; path=/; Domain=.cfr.org x-cdn Imperva access-control-allow-methods POST, GET, OPTIONS access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token access-control-max-age 1000 access-control-allow-origin * x-iinfo 9-8262484-8262485 NNNN CT(0 4 0) RT(1615326944455 0) q(0 0 0 0) r(1 1) U4
GET H2	200	css_j92tBaStHE_pUH53A8rOdSkHXJXarIt7e7vXtXcJcWA.css microsites-live-backend.cfr.org/cdn/ff/BF5tK64CzKmsfIt0GovEYoHpPFKj6XWvUujOvrkwtGI/1611074918/public/css/	5 KB 2 KB	77ms 36ms	Stylesheet text/css	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/cdn/ff/BF5tK64CzKmsfIt0GovEYoHpPFKj6XWvUujOvrkwtGI/1611074918/public/css/css_j92tBaStHE_pUH53A8rOdSkHXJXarIt7e7vXtXcJcWA.css Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Drupal CDN module (https://www.drupal.org/project/cdn) Resource Hash 8fddad05a4ad1c4fe9507e7703cace7529075c95daac8b7b7bbbd7b577097160 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip x-content-type-options nosniff age 2858414 x-powered-by Drupal CDN module (https://www.drupal.org/project/cdn) x-pantheon-styx-hostname styx-fe4-b-649d688684-mhstp x-cache HIT, HIT content-length 1896 x-ua-compatible IE=edge access-control-allow-origin * last-modified Wed, 20 Jan 1988 04:20:42 GMT server nginx x-timer S1615326945.423729,VS0,VE2 x-frame-options SAMEORIGIN x-served-by cache-mdw17330-MDW, cache-hhn4049-HHN vary Accept-Encoding access-control-allow-methods GET, HEAD content-language en via 1.1 varnish, 1.1 varnish x-generator Drupal 8 (https://www.drupal.org) expires Tue, 20 Jan 2037 04:20:42 GMT cache-control immutable, max-age=290304000, no-transform, public accept-ranges bytes content-type text/css;charset=UTF-8 x-styx-req-id f00041a4-6722-11eb-a0e8-0a5f99c5632f x-cache-hits 1, 1
GET H2	200	69fdb849-9596-41e2-bfcd-fbef96cc9216.css fast.fonts.net/cssapi/	40 KB 41 KB	56ms 14ms	Stylesheet text/css	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/cssapi/69fdb849-9596-41e2-bfcd-fbef96cc9216.css Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B99) / Resource Hash b982480e5550c9eb095ce609def69d6a31c2a1ecbe4a1d4119b63f2127a118d9 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Wed, 17 Feb 2021 06:09:46 GMT server ECS (amb/6B99) age 1520276 etag "59f5f5953bb1e143a7ff03043e7f7ed8" x-cache HIT content-type text/css; charset=utf-8 access-control-allow-origin * expires Tue, 16 Mar 2021 21:55:45 GMT cache-control max-age=604800 x-amz-request-id 600F0BB4C5BCA0D7 accept-ranges bytes content-length 41467 x-amz-id-2 2LdAmvItI3j0Xl7WE+8l7TRwSOG0IFlm6UriWsGv4z5MbhpeY4iM+3vF3jD2K52EPnSbIrCZdYQ= x-amz-meta-mtime 1580408781
GET H2	200	css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/	870 KB 160 KB	61ms 21ms	Stylesheet text/css	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Drupal CDN module (https://www.drupal.org/project/cdn) Resource Hash 821363be02109486644dd58d8dbfd15b3aee62e83bc6929b6a0284983aeaac45 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip x-content-type-options nosniff age 615268 x-powered-by Drupal CDN module (https://www.drupal.org/project/cdn) x-pantheon-styx-hostname styx-fe4-b-7fbc4c4c64-zxtdc x-cache HIT, HIT content-length 163246 x-ua-compatible IE=edge access-control-allow-origin * last-modified Wed, 20 Jan 1988 04:20:42 GMT server nginx x-timer S1615326945.423723,VS0,VE2 x-frame-options SAMEORIGIN x-served-by cache-mdw17364-MDW, cache-hhn4049-HHN vary Accept-Encoding access-control-allow-methods GET, HEAD content-language en via 1.1 varnish, 1.1 varnish x-generator Drupal 8 (https://www.drupal.org) expires Tue, 20 Jan 2037 04:20:42 GMT cache-control immutable, max-age=290304000, no-transform, public accept-ranges bytes content-type text/css;charset=UTF-8 x-styx-req-id aab40969-7b89-11eb-860b-461c860d1d20 x-cache-hits 1, 1
GET H2	200	js_JvjVZf22lVrqBDpom2woUqDL0kH_iOH-F9GakV8hJvE.js Show response microsites-live-backend.cfr.org/cdn/ff/yWEaVMice48tQ5ahv8LtbLQvlXE00ZKIGJJNlnV5Brg/1611074819/public/js/	843 B 1 KB	60ms 20ms	Script application/javascript	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/cdn/ff/yWEaVMice48tQ5ahv8LtbLQvlXE00ZKIGJJNlnV5Brg/1611074819/public/js/js_JvjVZf22lVrqBDpom2woUqDL0kH_iOH-F9GakV8hJvE.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Drupal CDN module (https://www.drupal.org/project/cdn) Resource Hash 26f8d565fdb6955aea043a689b6c2852a0cbd241ff88e1fe17d19a915f2126f1 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip x-content-type-options nosniff age 2858414 x-powered-by Drupal CDN module (https://www.drupal.org/project/cdn) x-pantheon-styx-hostname styx-fe4-a-695744c5c6-wzlfh x-cache HIT, HIT content-length 513 x-ua-compatible IE=edge access-control-allow-origin * last-modified Wed, 20 Jan 1988 04:20:42 GMT server nginx x-timer S1615326945.423696,VS0,VE1 x-frame-options SAMEORIGIN x-served-by cache-mdw17354-MDW, cache-hhn4049-HHN vary Accept-Encoding access-control-allow-methods GET, HEAD content-language en via 1.1 varnish, 1.1 varnish x-generator Drupal 8 (https://www.drupal.org) expires Tue, 20 Jan 2037 04:20:42 GMT cache-control immutable, max-age=290304000, no-transform, public accept-ranges bytes content-type application/javascript x-styx-req-id f0012792-6722-11eb-ad43-d2fb8bff6f1f x-cache-hits 1, 1
GET H2	200	chartbeat_mab.js Show response static.chartbeat.com/js/	22 KB 10 KB	46ms 16ms	Script application/x-javascript	2600:9000:2127:9a00:18:1fcd:34e:d2a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.chartbeat.com/js/chartbeat_mab.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2127:9a00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash bdbb3b88367e0dc7f2af34b3bb701fe2523c8653a48cdfd8aaf67c2d1e18b76d Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 19:33:39 GMT content-encoding gzip last-modified Wed, 02 Dec 2020 01:43:44 GMT server nginx age 8526 etag W/"5fc6f150-5976" vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript via 1.1 4b7022ec3e11edfdd972039992f837df.cloudfront.net (CloudFront) cache-control max-age=86400 x-amz-cf-pop PRG50-C1 x-amz-cf-id fDEtrvlsCyWZxMc7KwhRRdJEMKTYJ9MWgpWZXwILS5ZgiUwBhVrAtQ== expires Wed, 10 Mar 2021 19:33:39 GMT
GET H2	200	cfr-logo.svg www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/	5 KB 3 KB	28ms 23ms	Image image/svg+xml	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/cfr-logo.svg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 441e4e3fe5729e0accb9821c52fe1bad58dd4f340b690dd2e2f92e4a56dc9349 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip last-modified Wed, 03 Mar 2021 19:12:30 GMT x-cdn Imperva etag "79e26730" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/svg+xml access-control-allow-origin * x-iinfo 9-8262496-8261566 2VNN RT(1615326944765 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 2430
GET H2	200	cfr-monogram.svg www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/	1 KB 927 B	28ms 23ms	Image image/svg+xml	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/cfr-monogram.svg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash c27689acf09443c53ff547643bd6485954e4220e6bb04de4698ba05ad2fece7b Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip last-modified Thu, 25 Feb 2021 14:26:35 GMT x-cdn Imperva etag "c9ef83ff" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/svg+xml access-control-allow-origin * x-iinfo 9-8262497-8254929 2VNN RT(1615326944767 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 806
GET H2	200	cfr-monogram-white.svg www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/	1 KB 929 B	28ms 23ms	Image image/svg+xml	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/cfr-monogram-white.svg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 6260ec37635d4bf6de6c5a19ee5afd3ddac9807858accda9fe27fb102b0306a3 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip last-modified Thu, 18 Feb 2021 19:31:40 GMT x-cdn Imperva etag "95d04fcd" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/svg+xml access-control-allow-origin * x-iinfo 9-8262498-8248744 2VNN RT(1615326944769 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 808
GET H2	200	cfr-logo-grey.svg www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/	5 KB 3 KB	28ms 24ms	Image image/svg+xml	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/templates/icons/assets/cfr-logo-grey.svg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 88c718b918764a88fb43e244368d824167eca1b7d4b5586f428d2c654f5db084 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip last-modified Sun, 07 Feb 2021 18:50:11 GMT x-cdn Imperva etag "c3d73af8" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/svg+xml access-control-allow-origin * x-iinfo 9-8262499-8256744 2VNN RT(1615326944770 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 2431
GET H2	200	fb.png www.cfr.org/themes/custom/cfr_interactives/images/	313 B 409 B	33ms 28ms	Image image/png	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/images/fb.png Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 6eb170171994f9824de59fb7e296f8ee70d1aa9bafa102d5743d7df1d44fa712 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Wed, 10 Feb 2021 22:11:07 GMT x-cdn Imperva etag "7fa028b4" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/png access-control-allow-origin * x-iinfo 9-8262500-8258169 2VNN RT(1615326944771 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 313
GET H2	200	tw.png www.cfr.org/themes/custom/cfr_interactives/images/	487 B 614 B	28ms 24ms	Image image/png	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/images/tw.png Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 9d518d0930d046d81f1e61d3196152828d2b53253d53e4053fcbc666e9d2a662 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Wed, 10 Feb 2021 22:11:07 GMT x-cdn Imperva etag "f281d12d" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/png access-control-allow-origin * x-iinfo 9-8262501-8258166 2VNN RT(1615326944772 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 487
GET H2	200	linkedin.png www.cfr.org/themes/custom/cfr_interactives/images/	419 B 539 B	48ms 43ms	Image image/png	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/images/linkedin.png Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 8994eeca3d94c189acbd0fc0809b2f4977ab61e30b555901f130d667c9a7a658 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Wed, 10 Feb 2021 18:22:58 GMT x-cdn Imperva etag "4c33a4f4" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/png access-control-allow-origin * x-iinfo 9-8262502-8248744 2VNN RT(1615326944773 0) q(0 0 0 -1) r(1 1) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 419
GET H2	200	email.png www.cfr.org/themes/custom/cfr_interactives/images/	685 B 805 B	42ms 38ms	Image image/png	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_interactives/images/email.png Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash f5bb7ce513bab726fe547de88114100a0c31ec34e3afc0f22e566d6e39ce6fe2 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Fri, 19 Feb 2021 14:21:05 GMT x-cdn Imperva etag "e7437925" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/png access-control-allow-origin * x-iinfo 9-8262503-8254929 2VNN RT(1615326944774 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 685
GET H2	200	js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Show response microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/	476 KB 124 KB	15ms 15ms	Script application/javascript	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Drupal CDN module (https://www.drupal.org/project/cdn) Resource Hash cc2d849cfc8d04f9fe136717910d850254b9d931ad7837c62fb907d398e36c8d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip x-content-type-options nosniff age 2290579 x-powered-by Drupal CDN module (https://www.drupal.org/project/cdn) x-pantheon-styx-hostname styx-fe4-a-695744c5c6-8zj97 x-cache HIT, HIT content-length 126734 x-ua-compatible IE=edge access-control-allow-origin * last-modified Wed, 20 Jan 1988 04:20:42 GMT server nginx x-timer S1615326945.456101,VS0,VE1 x-frame-options SAMEORIGIN x-served-by cache-mdw17332-MDW, cache-hhn4049-HHN vary Accept-Encoding access-control-allow-methods GET, HEAD content-language en via 1.1 varnish, 1.1 varnish x-generator Drupal 8 (https://www.drupal.org) expires Tue, 20 Jan 2037 04:20:42 GMT cache-control immutable, max-age=290304000, no-transform, public accept-ranges bytes content-type application/javascript x-styx-req-id 078cb9a5-6c4d-11eb-af88-fabb18204ca8 x-cache-hits 1, 1
GET H2	200	ygq0fud.js Show response use.typekit.net/	17 KB 7 KB	179ms 147ms	Script text/javascript	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/ygq0fud.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash da0a6523691acdfc80d193620914898496e096b11734ded47fbdd5aeff35defd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip server nginx date Tue, 09 Mar 2021 21:55:45 GMT vary Accept-Encoding content-type text/javascript;charset=utf-8 access-control-allow-origin * cache-control public, max-age=600, stale-while-revalidate=604800 timing-allow-origin * content-length 6781
GET H2	200	js_DxAyCc9e86yCtGxtKhuc5_76pHoLwDYTL9pei6Z2eS8.js Show response microsites-live-backend.cfr.org/cdn/ff/cvcT1YbusQnlHqjn9W9x0cnA4OynYfxRSFzD-m6fW8M/1611074859/public/js/	685 KB 159 KB	16ms 15ms	Script application/javascript	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/cdn/ff/cvcT1YbusQnlHqjn9W9x0cnA4OynYfxRSFzD-m6fW8M/1611074859/public/js/js_DxAyCc9e86yCtGxtKhuc5_76pHoLwDYTL9pei6Z2eS8.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Drupal CDN module (https://www.drupal.org/project/cdn) Resource Hash 0f103209cf5ef3ac82b46c6d2a1b9ce7fefaa47a0bc036132fda5e8ba676792f Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip x-content-type-options nosniff age 2858413 x-powered-by Drupal CDN module (https://www.drupal.org/project/cdn) x-pantheon-styx-hostname styx-fe4-a-695744c5c6-wzlfh x-cache HIT, HIT content-length 162195 x-ua-compatible IE=edge access-control-allow-origin * last-modified Wed, 20 Jan 1988 04:20:42 GMT server nginx x-timer S1615326946.531533,VS0,VE2 x-frame-options SAMEORIGIN x-served-by cache-mdw17321-MDW, cache-hhn4049-HHN vary Accept-Encoding access-control-allow-methods GET, HEAD content-language en via 1.1 varnish, 1.1 varnish x-generator Drupal 8 (https://www.drupal.org) expires Tue, 20 Jan 2037 04:20:42 GMT cache-control immutable, max-age=290304000, no-transform, public accept-ranges bytes content-type application/javascript x-styx-req-id f001dbe3-6722-11eb-ad43-d2fb8bff6f1f x-cache-hits 1, 1
GET H2	200	_Incapsula_Resource Show response www.cfr.org/	134 KB 19 KB	26ms 22ms	Script application/javascript	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://www.cfr.org/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=2089494531 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash af0bedccfbdd6314a15752538481fe85a9feec96062474653038eaaac8eef21c Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-encoding gzip cache-control no-cache, no-store x-robots-tag noindex content-length 19571 content-type application/javascript
GET H2	200	1.css fast.fonts.net/t/	0 116 B	13ms 12ms	Stylesheet text/css	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/t/1.css?apiType=css&projectid=69fdb849-9596-41e2-bfcd-fbef96cc9216 Requested by Host: fast.fonts.net URL: https://fast.fonts.net/cssapi/69fdb849-9596-41e2-bfcd-fbef96cc9216.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BB9) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://fast.fonts.net/cssapi/69fdb849-9596-41e2-bfcd-fbef96cc9216.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Wed, 21 Feb 2018 12:55:22 GMT server ECS (amb/6BB9) age 645111 etag "616070693" x-cache HIT content-type text/css access-control-allow-origin * cache-control no-cache accept-ranges bytes content-length 0 expires Tue, 09 Mar 2021 21:55:44 GMT
GET H2	200	320b78 hello.myfonts.net/count/	0 302 B	34ms 17ms	Stylesheet text/css	2606:4700::6811:f449 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://hello.myfonts.net/count/320b78 Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6811:f449 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://microsites-live-backend.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT server cloudflare age 1 expect-ct null vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control max-age=604800 accept-ranges bytes cf-ray 62d78ca14d48073e-FRA content-length 0 cf-request-id 08ba9638cd0000073e7f263000000001 expires Wed, 09 Mar 2022 21:55:45 GMT
GET H2	200	font-awesome.min.css stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/	30 KB 7 KB	36ms 20ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://microsites-live-backend.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 632, 718 age 16142 cdn-cachedat 2021-03-09 18:12:43 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 08ba9638cd000032330aad8000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:55 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 0b970f9b84daae34674f10e93ee1655b cf-ray 62d78ca14d903233-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	gtm.js Show response www.googletagmanager.com/	232 KB 59 KB	74ms 50ms	Script application/javascript	2a00:1450:4001:809::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-KFS3NQ Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 38f546439d072a1f45ef3c9ac1621435ec67f310818ed04f7188dbc9f1c04ea1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60320 x-xss-protection 0 last-modified Tue, 09 Mar 2021 21:00:48 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 09 Mar 2021 21:55:45 GMT
GET H2	200	320B78_3_0.woff2 microsites-live-backend.cfr.org/interactive/themes/custom/cfr_interactives/assets/fonts/larsseit/	42 KB 42 KB	54ms 26ms	Font font/woff2	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/interactive/themes/custom/cfr_interactives/assets/fonts/larsseit/320B78_3_0.woff2 Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 4dad1738d16a4a903c1e60e47a7bc561699983e53859269575bc4074d738ba86 Request headers Origin https://www.cfr.org Referer https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT via 1.1 varnish, 1.1 varnish age 1446111 x-pantheon-styx-hostname styx-fe4-a-695744c5c6-fzqrp x-cache HIT, HIT content-length 42748 x-served-by cache-mdw17360-MDW, cache-fra19129-FRA last-modified Sat, 20 Feb 2021 16:35:42 GMT server nginx x-timer S1615326946.602352,VS0,VE2 etag "60313a5e-a6fc" content-type font/woff2 access-control-allow-origin * expires Tue, 22 Feb 2022 04:13:54 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id 36088f3c-73fb-11eb-af57-f22b7822ecaa x-cache-hits 1, 1
GET H2	200	320B78_1_0.woff2 microsites-live-backend.cfr.org/interactive/themes/custom/cfr_interactives/assets/fonts/larsseit/	42 KB 42 KB	41ms 14ms	Font font/woff2	2620:12a:8000::4 FASTLY
General Check archive.org Show headers Download Go to Full URL https://microsites-live-backend.cfr.org/interactive/themes/custom/cfr_interactives/assets/fonts/larsseit/320B78_1_0.woff2 Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:12a:8000::4 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash bd8f8bea0609488a4902819881e728bec9ce24da7b4ddc409f6e9439bea6b205 Request headers Origin https://www.cfr.org Referer https://microsites-live-backend.cfr.org/cdn/ff/lLf1KztZZOnbCftRge7vMhas7SHZe7x1ZZBRnnjm-sc/1611074844/public/css/css_ghNjvgIQlIZkTdWNjb_RWzruYug7xpKbagKEmDrqrEU.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT via 1.1 varnish, 1.1 varnish age 1165830 x-pantheon-styx-hostname styx-fe4-a-695744c5c6-8zj97 x-cache HIT, HIT content-length 42904 x-served-by cache-mdw17371-MDW, cache-fra19129-FRA last-modified Tue, 23 Feb 2021 20:02:13 GMT server nginx x-timer S1615326946.602339,VS0,VE2 etag "60355f45-a798" content-type font/woff2 access-control-allow-origin * expires Fri, 25 Feb 2022 10:05:15 GMT cache-control max-age=31622400 accept-ranges bytes x-styx-req-id ca72013b-7687-11eb-a963-fabb18204ca8 x-cache-hits 1, 1
GET H2	200	8b6420fe-9ace-4e4c-87a7-33443a3cb299.woff2 fast.fonts.net/dv2/14/	54 KB 54 KB	52ms 13ms	Font application/octet-stream	2606:2800:234:660:118e:28f:1d8a:2522 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://fast.fonts.net/dv2/14/8b6420fe-9ace-4e4c-87a7-33443a3cb299.woff2?d44f19a684109620e484167ca290e818d9c1120d6d0fea3d498fda0806f1e5eae97c96851e3f4384ff35ca4cfffa38c19a656128e0e2395e9e78c9e9c493fe4ccab829002d6d00c976ad63585b912a52d51da549cd071660d3261ab779a9cbcb3562db307bb363cb3ad0d44bacfcc9da8ab0a43826e97d225c7a63b26337aa2f1a97401c9867888356c8b381240ad815d8ede6416d5872768bcec0d086e32e9547d5ce747430bfda2132820d7132855394660cda7a43bf961780ab77601a42a8d05a65c788b3d4a323a0d1bd15f0723c39b84264558f5e11f265a999ccfa8a640254dbb8329ea09548676820bc6005f0fe85067349192ed693aba568cc959c&projectId=69fdb849-9596-41e2-bfcd-fbef96cc9216 Requested by Host: fast.fonts.net URL: https://fast.fonts.net/cssapi/69fdb849-9596-41e2-bfcd-fbef96cc9216.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:660:118e:28f:1d8a:2522 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BAE) / Resource Hash 533d4bc4adee3856a32a9fb3551504a67d39cdfae04ae16510229c5af6e69ac3 Request headers Origin https://www.cfr.org Referer https://fast.fonts.net/cssapi/69fdb849-9596-41e2-bfcd-fbef96cc9216.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Sat, 14 Nov 2020 04:52:26 GMT server ECS (amb/6BAE) age 49596 etag "e6e00338332336a89212db660bdfb15a" x-cache HIT content-type application/octet-stream access-control-allow-origin * expires Tue, 16 Mar 2021 21:55:45 GMT cache-control max-age=604800 x-amz-request-id 4P9TJQ7QS50DV6BH accept-ranges bytes content-length 55372 x-amz-id-2 vcA+TStSNsGcJrjCiUphZIAIOHwbAGnZZNCsc+55r/GqppiN5pt1IfhYMDPbY65QTzXqPpW+iFA= x-amz-meta-mtime 1425319654
GET H2	200	fontawesome-webfont.woff2 stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/	75 KB 76 KB	35ms 21ms	Font font/woff2	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: stackpath.bootstrapcdn.com URL: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Origin https://www.cfr.org Referer https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT x-content-type-options nosniff cf-cache-status EXPIRED cdn-edgestorageid 632, 617 access-control-allow-origin * cdn-cachedat 2021-03-09 20:25:31 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 77160 cf-request-id 08ba96393200004e74b30c8000000001 timing-allow-origin * last-modified Mon, 25 Jan 2021 22:04:55 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type font/woff2 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid a5c12ad22859f8232c88d2782fcafd4b accept-ranges bytes cf-ray 62d78ca1e8664e74-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	amplitude-7.1.0-min.gz.js Show response cdn.amplitude.com/libs/	60 KB 20 KB	121ms 45ms	Script application/javascript	13.224.194.151 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.amplitude.com/libs/amplitude-7.1.0-min.gz.js Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.194.151 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-151.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash a9a2e998ee0fd7c858904e6a1ece449c07dea8477a51aa735b7ef1187742a102 Request headers Origin https://www.cfr.org Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 21 Jan 2021 17:07:58 GMT content-encoding gzip vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method age 4078067 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 19526 access-control-allow-origin * last-modified Mon, 29 Jun 2020 06:18:29 GMT server AmazonS3 etag "8d78d87e6eadfbd4df24e750b9c398ae" access-control-max-age 3000 access-control-allow-methods GET, HEAD x-amz-version-id 9zlZ7fCv5jRdo6qeyQG2EZMqwYjFbDWy via 1.1 b6d1611761652d7a383651f2bf480596.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop FRA2-C1 accept-ranges bytes content-type application/javascript x-amz-cf-id veqfW4e2brEmmQhGSzUFOYUGKsA7wEiUgi36LQ8l8wtGE3-doc2WxA==
GET H2	200	iframe_api Show response www.youtube.com/	810 B 1 KB	43ms 22ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a88cc7da1973bf847e3740685fc737b04d4bb5b5ab78c8158ac66adc3cd56391 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding br x-content-type-options nosniff server ESF x-frame-options SAMEORIGIN p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info." cache-control private, max-age=0 cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000 content-type text/javascript; charset=utf-8 alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 expires Tue, 09 Mar 2021 21:55:45 GMT
GET H2	200	/ Show response mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/	209 B 482 B	125ms 107ms	XHR application/json	2a04:4e42:1b::714 FASTLY
General Check archive.org Show headers Download Go to Full URL https://mab.chartbeat.com/mab_strategy/headline_testing/get_strategy/?host=cfr.org&domain=cfr.org&path=%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities Requested by Host: static.chartbeat.com URL: https://static.chartbeat.com/js/chartbeat_mab.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::714 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9ae3e8c41357bccee24fbff05ac3fa2c115fbafbd7dd7d2efbc4144aaa57419a Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT content-encoding gzip age 0 vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding x-cache MISS content-type application/json access-control-allow-origin * expires Sun, 07 Mar 2021 21:55:45 GMT cache-control no-store, no-cache, must-revalidate, max-age=0, s-maxage=0 x-cache-hits 0 accept-ranges bytes x-timer S1615326946.777777,VS0,VE100 content-length 160 via 1.1 varnish (Varnish/6.0), 1.1 varnish x-served-by cache-hhn4064-HHN
GET H2	200	l use.typekit.net/af/502632/00000000000000000001748f/27/	22 KB 22 KB	49ms 18ms	Font application/font-woff2	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/502632/00000000000000000001748f/27/l?subset_id=1&fvd=n4&v=3 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 209a6e9978dfeada3826439432d205375a10ab926eae0f800e4a66f3a1dfe6d0 Request headers Origin https://www.cfr.org Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT server nginx etag "67de382613545a8d856bebf617df6207953bcca8" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 22772
GET H2	200	l use.typekit.net/af/0098d0/000000000000000000017490/27/	22 KB 23 KB	54ms 24ms	Font application/font-woff2	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/0098d0/000000000000000000017490/27/l?subset_id=1&fvd=i4&v=3 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 958f0c067ee98f119b5981cfd76808a2433776ba97571285a6287ca68db7e5fd Request headers Origin https://www.cfr.org Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT server nginx etag "99c1499906537400d974e50dabcd06ae06fb74f1" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 22984
GET H2	200	l use.typekit.net/af/fb58b1/000000000000000000017493/27/	22 KB 22 KB	83ms 53ms	Font application/font-woff2	2a02:26f0:6c00::210:ba0a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/fb58b1/000000000000000000017493/27/l?subset_id=1&fvd=n7&v=3 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00::210:ba0a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash ffefa09ea6b53383fa497595de039404cb2c5681b9a29a1f7a13d7f21621ccb7 Request headers Origin https://www.cfr.org Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT server nginx etag "6204cf9074abc4f1d2b021fa96f9ebb9dd0570df" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 timing-allow-origin * content-length 22720
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	3 KB 3 KB	25ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/cvcT1YbusQnlHqjn9W9x0cnA4OynYfxRSFzD-m6fW8M/1611074859/public/js/js_DxAyCc9e86yCtGxtKhuc5_76pHoLwDYTL9pei6Z2eS8.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 45036b82d97aa3b27706ed987b0f49d12f756f856f691856c0238fd02d990085 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 4iOseO9RM2C3R/Qka6wo/g== cross-origin-resource-policy cross-origin expires Tue, 09 Mar 2021 22:12:03 GMT alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 1779 x-fb-rlafr 0 x-fb-debug 1bsukQHEjA1GvhZbpnytdgqMgZgvGeGawl1MwaMeNMiL1Grc6t+jKunkNiKR/eKxOjvtZBUHXGd7IWPFkO7AGQ== x-fb-trip-id 917726464 x-fb-content-md5 e60379b3c189fea04daf361cc6df19e9 cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Tue, 09 Mar 2021 21:55:45 GMT x-frame-options DENY report-to {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public,max-age=1200,stale-while-revalidate=3600 origin-trial AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ== etag "ae07f34bd23a10e5d3df15097e30ae8a" timing-allow-origin * cross-origin-opener-policy-report-only same-origin-allow-popups;report-to="coop_report" access-control-expose-headers X-FB-Content-MD5
GET H2	200	cfr-wrapper Show response www.cfr.org/site-api/	122 KB 20 KB	18ms 14ms	XHR text/html	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Full URL https://www.cfr.org/site-api/cfr-wrapper Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software nginx / Resource Hash 51d75ba7be8e5286db3d4b53cbd9c157db51ebc1d54870ca3657c5eb501286f0 Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept text/html, */*; q=0.01 Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-encoding gzip x-cdn Imperva age 9925 x-dns-prefetch-control on x-iinfo 9-8262529-8262530 NNNN CT(1 2 0) RT(1615326945074 0) q(0 0 0 -1) r(0 0) U4 x-cache-hits 1, 1 x-served-by cache-mdw17373-MDW, cache-hhn4024-HHN x-timer S1615326946.862444,VS0,VE2 etag W/"1615317018" vary Accept-Encoding, Cookie, Cookie, Cookie access-control-allow-methods POST, GET, OPTIONS content-language en access-control-allow-origin * x-generator Drupal 8 (https://www.drupal.org) cache-control max-age=14400, public access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token x-pantheon-styx-hostname styx-fe4-b-7fbc4c4c64-vk554 date Tue, 09 Mar 2021 21:55:45 GMT via 1.1 varnish, 1.1 varnish x-content-type-options nosniff x-styx-req-id 165905ac-810b-11eb-b538-22fbb1c4de24 x-cache HIT, HIT x-drupal-dynamic-cache MISS x-ua-compatible IE=edge link <//cdn.cfr.org>; rel=preconnect; crossorigin, <//cdn.cfr.org>; rel=dns-prefetch last-modified Tue, 09 Mar 2021 19:10:18 GMT server nginx access-control-max-age 1000 expires Sun, 19 Nov 1978 05:00:00 GMT accept-ranges bytes content-type text/html; charset=UTF-8 x-drupal-cache MISS
GET H2	200	_Incapsula_Resource www.cfr.org/	1 B 35 B	6ms 6ms	Image text/plain	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/_Incapsula_Resource?SWKMTFSR=1&e=0.9679248955928839 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cache-control no-cache, no-store x-robots-tag noindex content-length 1 content-type text/plain
GET H3-Q050	200	www-widgetapi.js Show response www.youtube.com/s/player/d91669a4/www-widgetapi.vflset/	106 KB 38 KB	41ms 27ms	Script text/javascript	2a00:1450:4001:813::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/d91669a4/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c2d0c281519e31954278ba8946fa818eaeb68051112d3b030b9af11062df26fb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 08 Mar 2021 16:46:04 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 08 Mar 2021 01:18:06 GMT server sffe age 104982 vary Accept-Encoding, Origin content-type text/javascript cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 38484 x-xss-protection 0 expires Tue, 08 Mar 2022 16:46:04 GMT
GET H2	200	hotjar-1768366.js Show response static.hotjar.com/c/	3 KB 2 KB	111ms 36ms	Script application/javascript	13.225.80.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-1768366.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KFS3NQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.113 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-113.fra2.r.cloudfront.net Software / Resource Hash 489408e50ae07ca294b3bd61deff8cbeffd1497daf54c2575252173cfe4d0acb Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:21 GMT content-encoding br x-content-type-options nosniff cache-control max-age=60 age 25 etag W/52e6767adb2e12722cca3dc72015e8a8 vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript access-control-allow-origin * x-cache-hit 1 x-amz-cf-pop FRA2-C2 content-length 1540 via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) x-amz-cf-id U5mJiri_ZKhp2swtCkOrUsnvbfhnBLIyykRO5uor0B6UxNZFI50-iw==
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	91 KB 24 KB	7ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 23762 x-fb-rlafr 0 pragma public x-fb-debug c5I1tcuof+yywTmE/Gv2kSeKvtjHWYc6jfXdbzxNH0EK41HsaNIDwuTkKHbwRWpnhQkfHkHDT7iKBN++PF3Uzg== x-fb-trip-id 917726464 x-frame-options DENY cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Tue, 09 Mar 2021 21:55:46 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 origin-trial AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ== priority u=3,i cross-origin-opener-policy-report-only same-origin-allow-popups;report-to="coop_report" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	46 KB 19 KB	29ms 5ms	Script text/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-KFS3NQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Fri, 05 Feb 2021 21:33:27 GMT server Golfe2 age 6790 date Tue, 09 Mar 2021 20:02:36 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18980 expires Tue, 09 Mar 2021 22:02:36 GMT
POST H2	200	/ Show response api.amplitude.com/	7 B 168 B	579ms 198ms	XHR text/html	34.208.234.132 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.amplitude.com/ Requested by Host: cdn.amplitude.com URL: https://cdn.amplitude.com/libs/amplitude-7.1.0-min.gz.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.208.234.132 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-208-234-132.us-west-2.compute.amazonaws.com Software / Resource Hash aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers access-control-allow-origin * date Tue, 09 Mar 2021 21:55:46 GMT content-length 7 strict-transport-security max-age=15768000 access-control-allow-methods GET, POST content-type text/html;charset=utf-8
GET H2	200	p.gif p.typekit.net/	35 B 182 B	21ms 6ms	Image image/gif	2a02:26f0:6c00:28d::19fd AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://p.typekit.net/p.gif?s=1&k=ygq0fud&ht=tk&h=www.cfr.org&f=1883.1884.1885&a=6042891&js=1.20.0&app=typekit&e=js&_=1615326946068 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28d::19fd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT last-modified Wed, 02 Sep 2020 00:55:11 GMT server nginx etag "5f4eed6f-23" content-type image/gif access-control-allow-origin * cache-control public, max-age=604800 accept-ranges bytes content-length 35
GET H2	200	model-diplomacy.jpg www.cfr.org/themes/custom/cfr_theme/src/assets/images/	13 KB 14 KB	27ms 26ms	Image image/jpeg	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_theme/src/assets/images/model-diplomacy.jpg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 782d1bb23c4b52f990535350d7019bfe0a701f9795a6c1df822e21ad82843e17 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT last-modified Mon, 08 Mar 2021 22:02:21 GMT x-cdn Imperva etag "2c05d031" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/jpeg access-control-allow-origin * x-iinfo 9-8262540-8248744 2VNN RT(1615326945295 0) q(0 0 0 -1) r(1 1) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 13561
GET H2	200	world-101.jpg www.cfr.org/themes/custom/cfr_theme/src/assets/images/	8 KB 8 KB	42ms 40ms	Image image/jpeg	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_theme/src/assets/images/world-101.jpg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 12e1a4b245e5129c713ef5995fce6a94159adb3dd3ff919808728fe20130ce47 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT last-modified Mon, 08 Mar 2021 22:02:19 GMT x-cdn Imperva etag "7634c9f3" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/jpeg access-control-allow-origin * x-iinfo 9-8262541-8250197 2VNN RT(1615326945299 0) q(0 1 1 -1) r(1 1) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 8293
GET H2	200	cfr-centennial.jpg www.cfr.org/themes/custom/cfr_theme/src/assets/images/	4 KB 5 KB	33ms 32ms	Image image/jpeg	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_theme/src/assets/images/cfr-centennial.jpg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 4fa639ca535a8d80ba164624f1a31a4700c491d77f235493749dfe69786ee99e Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Mon, 08 Mar 2021 22:02:15 GMT x-cdn Imperva etag "0670250e" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/jpeg access-control-allow-origin * x-iinfo 9-8262542-8256744 2VNN RT(1615326945304 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 4480
GET H2	200	council-of-councils.jpg www.cfr.org/themes/custom/cfr_theme/src/assets/images/	4 KB 4 KB	27ms 26ms	Image image/jpeg	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_theme/src/assets/images/council-of-councils.jpg?1611943321 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash f6b2fe590055944bd6a21219c021a013ab3a46e96db5814ee12309a5bbd8b073 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Mon, 08 Mar 2021 22:02:19 GMT x-cdn Imperva access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/jpeg access-control-allow-origin * x-iinfo 9-8262543-8258166 2VNN RT(1615326945309 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 4164
GET H2	200	think-global-health.jpg www.cfr.org/themes/custom/cfr_theme/src/assets/images/	6 KB 6 KB	32ms 31ms	Image image/jpeg	2a02:e980:d2::97 INCAPSULA
General Check archive.org Show headers Download Go to Show image Full URL https://www.cfr.org/themes/custom/cfr_theme/src/assets/images/think-global-health.jpg Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a02:e980:d2::97 , United States, ASN19551 (INCAPSULA, US), Reverse DNS Software / Resource Hash 10a36e954b61f6264af88ae8150b145563f33c1773e9604d0178fc7de7eb8c87 Request headers Referer https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:45 GMT last-modified Mon, 08 Mar 2021 22:02:15 GMT x-cdn Imperva etag "9a57eff2" access-control-max-age 1000 access-control-allow-methods POST, GET, OPTIONS content-type image/jpeg access-control-allow-origin * x-iinfo 9-8262544-8262545 2VNN RT(1615326945313 0) q(0 0 0 -1) r(0 0) cache-control max-age=0 access-control-allow-headers x-requested-with, Content-Type, origin, authorization, accept, client-security-token content-length 5813
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	197 KB 60 KB	20ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js?hash=695f325ea631c281d89a4c7391b05f32&ua=modern_es6 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c04d457ada304f7c7072b6e818c7f70debbdd2ae4e07f6dffcba73d07ce1f15f Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Origin https://www.cfr.org Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 FoRpF9DDIQ5TZLQ+rlD0UQ== cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 60564 x-fb-rlafr 0 x-fb-debug U6Yr7MZVIEcSlcG6d/o/wWSiSg0OVOJWJRnmjEb3+YTv8gZAsHudZnAst/uYHMZX7EtJqq7Fc4n/xMmFqpBagQ== x-fb-trip-id 2130091508 x-fb-content-md5 9209de71daa1212351adb494b26a553b x-frame-options DENY date Tue, 09 Mar 2021 21:55:46 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable etag "6b28daad2da7f4248a73ccfc70e74fae" timing-allow-origin * priority u=3,i expires Wed, 09 Mar 2022 21:48:38 GMT
GET H2	200	1714601028806149 Show response connect.facebook.net/signals/config/	241 KB 69 KB	7ms 7ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1714601028806149?v=2.9.33&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 2d526b33deaa2c3eb3f1254d9acda4683b1879df6a22c90b8c9c70d3e63273ec Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff x-xss-protection 0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 70574 x-fb-rlafr 0 pragma public x-fb-debug XzrnieglAHq2zakwinpprI5MnNOECilHrLsmYbAUmQN2ix4aqYFMG3WfxuqVnnfoH36hqHKkDIb77JCwhcrUBA== x-fb-trip-id 917726464 x-frame-options DENY date Tue, 09 Mar 2021 21:55:46 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 444 B	43ms 16ms	XHR text/plain	2a00:1450:400c:c1b::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=1713055763&gjid=61383676&_gid=2109554816.1615326946&_u=YGBAgEADQAAAAE~&z=938325924 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 09 Mar 2021 21:55:46 GMT content-type text/plain access-control-allow-origin https://www.cfr.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	js Show response www.google-analytics.com/gtm/	84 KB 33 KB	49ms 33ms	Script application/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-PWR4BQ4&t=gtm35&cid=66823669.1615326946&aip=true Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 6abb3e2caa568ec2b41dbf44059949169818c70bfe0f82d77633d28c486d248c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 33775 x-xss-protection 0 last-modified Tue, 09 Mar 2021 21:00:48 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 09 Mar 2021 21:55:46 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 383 B	36ms 21ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j88&aip=1&a=463925196&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cfr.org%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities&ul=en-us&de=UTF-8&dt=Compromise%20of%20websites%20related%20to%20Uighur%20communities%20%7C%20CFR%20Interactives&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEADQ~&jid=1713055763&gjid=61383676&cid=66823669.1615326946&tid=UA-3596942-1&_gid=2109554816.1615326946&gtm=2wg2o0KFS3NQ&cd4=interactive&cd5=drupal_interactives&cd7=&cd8=&cd10=9608&cd11=&cd14=&cd15=GTM-KFS3NQ&z=1585117644 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 19:41:25 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 8061 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	modules.33a772c48beaa5222edf.js Show response script.hotjar.com/	217 KB 58 KB	150ms 61ms	Script application/javascript	13.224.193.121 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.33a772c48beaa5222edf.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1768366.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.121 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-121.fra2.r.cloudfront.net Software / Resource Hash 9bd71240933790c0dc85d69741a3b0bcfef32a44b46ce8893d2541ecaee2db72 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 05 Mar 2021 16:20:08 GMT content-encoding br x-content-type-options nosniff age 365738 x-cache Hit from cloudfront content-length 58652 access-control-allow-origin * last-modified Fri, 05 Mar 2021 16:19:37 GMT etag "a93d27db17b2296071120e76a2ccbea0" vary Accept-Encoding content-type application/javascript via 1.1 172e63b20fb363ed969de28ae3937e21.cloudfront.net (CloudFront) cache-control max-age=31536000 x-amz-cf-pop FRA2-C1 accept-ranges bytes x-robots-tag none x-amz-cf-id BhZ3n18ezPuH7pf9Si6psCwRZsBFHHEMDL2bGCjORIlp5ZKI8QEsug==
GET H2	200	/ www.facebook.com/tr/	44 B 409 B	22ms 6ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1714601028806149&ev=PageView&dl=https%3A%2F%2Fwww.cfr.org%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities&rl=&if=false&ts=1615326946178&sw=1600&sh=1200&v=2.9.33&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1615326946176.1941491593&it=1615326946105&coo=false&rqm=GET Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Tue, 09 Mar 2021 21:55:46 GMT
GET H3-Q050	200	ga-audiences www.google.com/ads/	42 B 274 B	19ms 19ms	Image image/gif	2a00:1450:4001:803::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=1713055763&_u=YGBAgEADQAAAAE~&z=809251081 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 505 B	38ms 17ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=1713055763&_u=YGBAgEADQAAAAE~&z=809251081 Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	box-469cf41adb11dc78be68c1ae7f9457a4.html Show response vars.hotjar.com/ Frame 696B	2 KB 1 KB	96ms 31ms	Document text/html	13.224.193.91 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-1768366.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.193.91 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-193-91.fra2.r.cloudfront.net Software / Resource Hash 66f396314193bfe4809457b6c8004d026e3c503befe550e29ea068667f84ce39 Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-469cf41adb11dc78be68c1ae7f9457a4.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://www.cfr.org/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://www.cfr.org/ Response headers content-type text/html content-length 851 date Mon, 23 Nov 2020 17:01:03 GMT accept-ranges bytes cache-control max-age=31536000 content-encoding br etag "d594f1d4c3e5dbd6b556c60d34e0daea" last-modified Mon, 23 Nov 2020 15:41:01 GMT x-robots-tag none vary Accept-Encoding x-cache Hit from cloudfront via 1.1 7a3193ebce69450274ae629ce856b09d.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id PzdcpM9wd_SBlRc5eJrhwK_jBBzjWmTAuPbHX4cfOXZ-qFOYW8HoKw== age 9176083
GET H2	200	nr-1198.min.js Show response js-agent.newrelic.com/	27 KB 11 KB	113ms 40ms	Script application/javascript	151.101.114.110 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-1198.min.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.110 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 39893061747f88b837a34d0395d05fca83e7cd5bbf2d582d181a73c5c9a174c6 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 21:55:46 GMT content-encoding gzip x-amz-request-id 6G7N8SBZFWDP9P9M x-cache HIT content-length 10682 x-amz-id-2 0UGCO4Mhlfex45xXj/8DAFadaQ6I71xHRyRaRgwDh98IVodQV5SoRghdxpscDq1FfJKXoBas7qw= x-served-by cache-hhn4035-HHN last-modified Fri, 29 Jan 2021 19:19:08 GMT server AmazonS3 x-timer S1615326946.454020,VS0,VE0 etag "59c98195ba35e0b45cbe2e5beebd1ac8" vary Accept-Encoding content-type application/javascript via 1.1 varnish cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 19136
GET H2	200	chartbeat_video.js Show response static.chartbeat.com/js/	69 KB 23 KB	11ms 10ms	Script application/x-javascript	2600:9000:2127:9a00:18:1fcd:34e:d2a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.chartbeat.com/js/chartbeat_video.js Requested by Host: microsites-live-backend.cfr.org URL: https://microsites-live-backend.cfr.org/cdn/ff/iypLa7_onA06J9XptxqirXToJgWPFjH5dK-vGCKLgaA/1611074859/public/js/js_zC2EnPyNBPn-E2cXkQ2FAlS52TGteDfGL7kH05jjbI0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2127:9a00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash d5cf5fd859bb5721d9be0446a12f5b3b69386d5bf1c6a4f5a9de89d34f3ddba1 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 01:54:19 GMT content-encoding gzip last-modified Thu, 28 Jan 2021 02:14:19 GMT server nginx age 72087 etag W/"60121dfb-11304" vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript via 1.1 4b7022ec3e11edfdd972039992f837df.cloudfront.net (CloudFront) cache-control max-age=86400 x-amz-cf-pop PRG50-C1 x-amz-cf-id E5DoTqYWb2B8r6gjALDgdI14AbXTvwqXgY7w7aipwYwIRPGt-FA96Q== expires Wed, 10 Mar 2021 01:54:19 GMT
GET H2	200	chartbeat.js Show response static.chartbeat.com/js/	36 KB 14 KB	11ms 10ms	Script application/x-javascript	2600:9000:2127:9a00:18:1fcd:34e:d2a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.chartbeat.com/js/chartbeat.js Requested by Host: www.cfr.org URL: https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2127:9a00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx / Resource Hash 927ee0dfe51ef11076e57510990fd5c5fcee1cffd5204a4e3d3caee529c3bd01 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 09 Mar 2021 18:15:23 GMT content-encoding gzip last-modified Thu, 28 Jan 2021 02:03:13 GMT server nginx age 13223 etag W/"60121b61-8e23" vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript via 1.1 4b7022ec3e11edfdd972039992f837df.cloudfront.net (CloudFront) cache-control max-age=86400 x-amz-cf-pop PRG50-C1 x-amz-cf-id yWxL089NQ5_Mz1cTGOZg9N7SP6Qk1MYMsQBA6nbaBMAyawVGCsbSFg== expires Wed, 10 Mar 2021 18:15:23 GMT
POST H3-Q050	200	collect Show response www.google-analytics.com/j/	2 B 74 B	13ms 13ms	XHR text/plain	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j88&aip=1&a=463925196&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.cfr.org%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities&ul=en-us&de=UTF-8&dt=Compromise%20of%20websites%20related%20to%20Uighur%20communities%20%7C%20CFR%20Interactives&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=25%25&_u=aGDACEADRAAAAG~&jid=115193941&gjid=2113277620&cid=66823669.1615326946&tid=UA-3596942-1&_gid=2109554816.1615326946&_r=1&gtm=2wg2o0KFS3NQ&cd4=interactive&cd5=drupal_interactives&cd7=&cd8=&cd10=9608&cd11=&cd14=&cd15=GTM-KFS3NQ&cm1=1&z=1132777210 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.cfr.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	collect www.google-analytics.com/	35 B 85 B	7ms 6ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j88&aip=1&a=463925196&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.cfr.org%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities&ul=en-us&de=UTF-8&dt=Compromise%20of%20websites%20related%20to%20Uighur%20communities%20%7C%20CFR%20Interactives&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=50%25&_u=aGDACEADRAAAAG~&jid=&gjid=&cid=66823669.1615326946&tid=UA-3596942-1&_gid=2109554816.1615326946&gtm=2wg2o0KFS3NQ&cd4=interactive&cd5=drupal_interactives&cd7=&cd8=&cd10=9608&cd11=&cd14=&cd15=GTM-KFS3NQ&cm1=1&z=1230489572 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 20:21:33 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 5653 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ping ping.chartbeat.net/	43 B 169 B	375ms 124ms	Image image/gif	34.235.184.233 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://ping.chartbeat.net/ping?h=cfr.org&p=%2Fcyber-operations%2Fcompromise-websites-related-uighur-communities&u=ZLHmfCHokAFkWEIN&d=cfr.org&g=61524&g0=No%20Section&g1=No%20Author&n=1&f=00001&c=0&x=0&m=0&y=1919&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1152&t=Di2ZlGDKLUSBDlfkHxCBOVMlD3dRrh&V=122&i=Compromise%20of%20websites%20related%20to%20Uighur%20communities%20%7C%20CFR%20Interactives&tz=-60&sn=1&sv=D-kinrCnIIpWCofbMthLfjjl7UZL&sd=1&im=067b0ff3&_ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.235.184.233 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-235-184-233.compute-1.amazonaws.com Software / Resource Hash cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 43 expires 0
POST H3-Q050	200	collect Show response stats.g.doubleclick.net/j/	4 B 422 B	42ms 15ms	XHR text/plain	2a00:1450:400c:c1b::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=115193941&gjid=2113277620&_gid=2109554816.1615326946&_u=aGDACEADRAAAAG~&z=1640759861 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Tue, 09 Mar 2021 21:55:46 GMT content-type text/plain access-control-allow-origin https://www.cfr.org cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ga-audiences www.google.com/ads/	42 B 65 B	18ms 17ms	Image image/gif	2a00:1450:4001:803::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=115193941&_u=aGDACEADRAAAAG~&z=409024521 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3-Q050	200	ga-audiences www.google.de/ads/	42 B 483 B	45ms 31ms	Image image/gif	2a00:1450:4001:803::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-3596942-1&cid=66823669.1615326946&jid=115193941&_u=aGDACEADRAAAAG~&z=409024521 Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 09 Mar 2021 21:55:46 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	NRJS-41206ed7d43567b5fba Show response bam-cell.nr-data.net/1/	57 B 643 B	692ms 647ms	Script text/javascript	162.247.243.146 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/1/NRJS-41206ed7d43567b5fba?a=629193583&v=1198.fe6ec20&to=bgNRNkIAWEFYUkALCVdJcgFECFlcFkFVBQNmBVIBWAQ%3D&rst=1275&ck=1&ref=https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities&ap=86&be=165&fe=1152&dc=650&perf=%7B%22timing%22:%7B%22of%22:1615326945206,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:9,%22c%22:9,%22s%22:15,%22ce%22:25,%22rq%22:25,%22rp%22:149,%22rpe%22:155,%22dl%22:152,%22di%22:650,%22ds%22:650,%22de%22:678,%22dc%22:1152,%22l%22:1152,%22le%22:1160%7D,%22navigation%22:%7B%7D%7D&fp=839&fcp=839&at=QkRSQAoaS08%3D&jsonp=NREUM.setToken Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1198.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 09 Mar 2021 21:55:47 GMT Content-Encoding gzip CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type text/javascript;charset=ISO-8859-1 Transfer-Encoding chunked Connection keep-alive CF-Ray 62d78ca7da342790-PRG cf-request-id 08ba963ced0000279062862000000001 Expires Thu, 01 Jan 1970 00:00:00 GMT
POST H2	200	/ www.facebook.com/tr/	0 82 B	6ms 6ms	Other text/plain	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundary8ivdDu8defPYdolt Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Tue, 09 Mar 2021 21:55:46 GMT content-type text/plain access-control-allow-origin https://www.cfr.org access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0
POST H/1.1	200 OK	NRJS-41206ed7d43567b5fba Show response bam-cell.nr-data.net/events/1/	24 B 487 B	646ms 646ms	XHR image/gif	162.247.243.146 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam-cell.nr-data.net/events/1/NRJS-41206ed7d43567b5fba?a=629193583&v=1198.fe6ec20&to=bgNRNkIAWEFYUkALCVdJcgFECFlcFkFVBQNmBVIBWAQ%3D&rst=11275&ck=1&ref=https://www.cfr.org/cyber-operations/compromise-websites-related-uighur-communities Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-1198.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.243.146 , United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash 0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300 Request headers Referer https://www.cfr.org/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 content-type text/plain Response headers Date Tue, 09 Mar 2021 21:55:57 GMT CF-Cache-Status DYNAMIC Server cloudflare Expect-CT max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Vary Accept-Encoding Content-Type image/gif Access-Control-Allow-Origin https://www.cfr.org Access-Control-Allow-Credentials true Connection keep-alive CF-Ray 62d78ce61eb42790-PRG Content-Length 24 cf-request-id 08ba9663cc00002790138f2000000001