cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/blog/autohotkey-banking-trojan/
Submission: On April 07 via api (April 7th 2021, 2:04:29 pm UTC) from US

Summary HTTP 268 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 57 IPs in 6 countries across 48 domains to perform 268 HTTP transactions. The main IP is 35.188.168.180, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is cofense.com.
TLS certificate: Issued by R3 on February 27th 2021. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE)
83	108.161.188.228 108.161.188.228	33438 (HIGHWINDS2) (HIGHWINDS2)
4	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
5	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:209... 2600:9000:2093:d200:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.111.214.240 104.111.214.240	16625 (AKAMAI-AS) (AKAMAI-AS)
5	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
1	54.192.210.20 54.192.210.20	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:710... 2a02:26f0:7100:191::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
68	54.192.210.122 54.192.210.122	16509 (AMAZON-02) (AMAZON-02)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	3.220.33.83 3.220.33.83	14618 (AMAZON-AES) (AMAZON-AES)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:a852	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
1	184.73.100.94 184.73.100.94	14618 (AMAZON-AES) (AMAZON-AES)
1 2	2620:119:50e1... 2620:119:50e1:101::6cae:b25	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	142.250.74.194 142.250.74.194	15169 (GOOGLE) (GOOGLE)
1	54.230.183.9 54.230.183.9	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
2	2a00:1450:400... 2a00:1450:400c:c0b::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
2	178.62.192.243 178.62.192.243	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
6	104.16.95.80 104.16.95.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	52.44.242.176 52.44.242.176	14618 (AMAZON-AES) (AMAZON-AES)
1	54.147.47.240 54.147.47.240	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1 5	104.108.144.126 104.108.144.126	16625 (AKAMAI-AS) (AKAMAI-AS)
1	107.20.140.231 107.20.140.231	14618 (AMAZON-AES) (AMAZON-AES)
1	54.192.210.44 54.192.210.44	16509 (AMAZON-02) (AMAZON-02)
1 1	3.248.28.111 3.248.28.111	16509 (AMAZON-02) (AMAZON-02)
13 16	54.74.23.153 54.74.23.153	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	35.156.106.231 35.156.106.231	16509 (AMAZON-02) (AMAZON-02)
1 2	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	70.42.32.127 70.42.32.127	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	18.184.39.197 18.184.39.197	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1288:80:... 2a00:1288:80:800::7001	203220 (YAHOO-DEB) (YAHOO-DEB)
1 2	52.58.55.232 52.58.55.232	16509 (AMAZON-02) (AMAZON-02)
1 2	185.33.221.13 185.33.221.13	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	35.174.151.106 35.174.151.106	14618 (AMAZON-AES) (AMAZON-AES)
8	50.16.7.188 50.16.7.188	14618 (AMAZON-AES) (AMAZON-AES)
1	52.222.179.58 52.222.179.58	16509 (AMAZON-02) (AMAZON-02)
1	18.215.11.20 18.215.11.20	14618 (AMAZON-AES) (AMAZON-AES)
6	34.204.215.213 34.204.215.213	14618 (AMAZON-AES) (AMAZON-AES)
2	52.0.189.149 52.0.189.149	14618 (AMAZON-AES) (AMAZON-AES)
1	2a04:4e42:1b:... 2a04:4e42:1b::720	54113 (FASTLY) (FASTLY)
268	57

2 35.188.168.180 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

83 108.161.188.228 (United States)

ASN33438 (HIGHWINDS2, US)

qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.111.9.35 (United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:d200:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.214.240 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-240.deploy.static.akamaitechnologies.com

cdn.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.210.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-210-20.ham50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100:191::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

68 54.192.210.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-210-122.ham50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.33.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-33-83.compute-1.amazonaws.com

t.sf14g.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a852 (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.73.100.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-73-100-94.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:119:50e1:101::6cae:b25 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.74.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.230.183.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-183-9.ham50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0b::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.62.192.243 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

hits-i.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.95.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-ab46.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.44.242.176 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-242-176.compute-1.amazonaws.com

lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.147.47.240 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-47-240.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.108.144.126 (Berlin, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-144-126.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.140.231 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.192.210.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-210-44.ham50.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.248.28.111 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-28-111.eu-west-1.compute.amazonaws.com

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 54.74.23.153 (Dublin, Ireland) 13 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-23-153.eu-west-1.compute.amazonaws.com

d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.156.106.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.108.145.8 (Berlin, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.127 (United States) 1 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.184.39.197 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:80:800::7001 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

ads.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.58.55.232 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.13 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.151.106 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: pi0-lba1-4-ue1.aws.pardot.com

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 50.16.7.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
flow.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.179.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-179-58.ham50.r.cloudfront.net

embeds.driftcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.215.11.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-215-11-20.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.204.215.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.0.189.149 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-0-189-149.compute-1.amazonaws.com

event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:1b::720 (United States)

ASN54113 (FASTLY, US)

driftt.imgix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
83	netdna-ssl.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	2 MB
68	driftt.com js.driftt.com	758 KB
21	adroll.com 14 redirects s.adroll.com d.adroll.com	26 KB
17	drift.com metrics.api.drift.com bootstrap.api.drift.com targeting.api.drift.com event.api.drift.com flow.api.drift.com	10 KB
12	gstatic.com fonts.gstatic.com	217 KB
7	iubenda.com cdn.iubenda.com www.iubenda.com hits-i.iubenda.com	78 KB
6	marketo.com app-ab46.marketo.com	146 KB
5	google-analytics.com www.google-analytics.com	59 KB
5	googleapis.com fonts.googleapis.com	5 KB
4	doubleclick.net 1 redirects stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	3 KB
4	fontawesome.com use.fontawesome.com	173 KB
3	google.de www.google.de	766 B
3	google.com www.google.com	766 B
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	61 KB
3	cloudflare.com cdnjs.cloudflare.com	58 KB
3	googletagmanager.com www.googletagmanager.com	146 KB
2	pardot.com pi.pardot.com	3 KB
2	openx.net 1 redirects us-u.openx.net	480 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	bidswitch.net 1 redirects x.bidswitch.net	871 B
2	3lift.com 1 redirects eb2.3lift.com	738 B
2	outbrain.com 1 redirects sync.outbrain.com	832 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	facebook.net connect.facebook.net	94 KB
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	642 B
2	marketo.net munchkin.marketo.net	7 KB
2	cofense.com cofense.com	2 MB
1	imgix.net driftt.imgix.net	26 KB
1	driftcdn.com embeds.driftcdn.com	22 KB
1	facebook.com www.facebook.com	297 B
1	yahoo.com ads.yahoo.com	444 B
1	taboola.com sync.taboola.com	219 B
1	pubmatic.com simage2.pubmatic.com	806 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	advertising.com pixel.advertising.com	125 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	twitter.com analytics.twitter.com	652 B
1	lltrck.com lltrck.com
1	t.co t.co	448 B
1	googleadservices.com www.googleadservices.com	14 KB
1	shareaholic.net www.shareaholic.net	2 KB
1	zoominfo.com ws.zoominfo.com	724 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	sf14g.com t.sf14g.com	36 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com	44 KB
1	licdn.com snap.licdn.com	2 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	4 KB
268	48

	Domain	Requested by
83	qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	cofense.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
68	js.driftt.com	cofense.com js.driftt.com
16	d.adroll.com	13 redirects cofense.com
12	fonts.gstatic.com	fonts.googleapis.com
6	targeting.api.drift.com	js.driftt.com
6	metrics.api.drift.com	js.driftt.com
6	app-ab46.marketo.com	cofense.com app-ab46.marketo.com
5	s.adroll.com	1 redirects www.googletagmanager.com cofense.com s.adroll.com
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cofense.com
5	fonts.googleapis.com	cofense.com js.driftt.com
4	cdn.iubenda.com	cofense.com cdn.iubenda.com
4	use.fontawesome.com	cofense.com use.fontawesome.com
3	www.google.de	cofense.com
3	www.google.com	cofense.com
3	cdnjs.cloudflare.com	cofense.com
3	www.googletagmanager.com	cofense.com www.googletagmanager.com
2	flow.api.drift.com	js.driftt.com
2	event.api.drift.com	js.driftt.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	us-u.openx.net	1 redirects cofense.com
2	ib.adnxs.com	1 redirects cofense.com
2	x.bidswitch.net	1 redirects cofense.com
2	eb2.3lift.com	1 redirects cofense.com
2	sync.outbrain.com	1 redirects cofense.com
2	dsum-sec.casalemedia.com	1 redirects cofense.com
2	connect.facebook.net	d.adroll.com connect.facebook.net
2	hits-i.iubenda.com	cdn.iubenda.com
2	stats.g.doubleclick.net	www.google-analytics.com
2	px.ads.linkedin.com	1 redirects cofense.com
2	munchkin.marketo.net	cofense.com munchkin.marketo.net
2	cofense.com	cofense.com
1	driftt.imgix.net	js.driftt.com
1	bootstrap.api.drift.com	js.driftt.com
1	embeds.driftcdn.com	js.driftt.com
1	www.facebook.com	cofense.com
1	cm.g.doubleclick.net	1 redirects
1	ads.yahoo.com	cofense.com
1	sync.taboola.com	cofense.com
1	simage2.pubmatic.com	cofense.com
1	pixel.rubiconproject.com	cofense.com
1	pixel.advertising.com	cofense.com
1	d.adroll.mgr.consensu.org	1 redirects
1	vars.hotjar.com	static.hotjar.com
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	analytics.twitter.com	static.ads-twitter.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	lltrck.com	cofense.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.iubenda.com	cdn.iubenda.com
1	t.co	cofense.com
1	script.hotjar.com	static.hotjar.com
1	www.googleadservices.com	www.googletagmanager.com
1	www.linkedin.com	1 redirects
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	t.sf14g.com	cofense.com
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
268	61

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
support.cofense.com
cofenselabs.com
developer.cofense.com
go.cofense.com
community.cofense.com
ccbjournal.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
threatpost.com
www.bankinfosecurity.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com R3	`2021-02-27` - `2021-05-28`	3 months	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-22` - `2022-03-18`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-13` - `2021-12-14`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
www.iubenda.com DigiCert SHA2 Secure Server CA	`2021-03-26` - `2022-03-31`	a year	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
t.sf14g.com Go Daddy Secure Certificate Authority - G2	`2020-09-09` - `2021-09-09`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.shareaholic.net R3	`2021-03-16` - `2021-06-14`	3 months	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-01-06` - `2021-07-05`	6 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.iubenda.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-31` - `2022-01-30`	2 years	crt.sh
app-ab46.marketo.com Cloudflare Inc ECC CA-3	`2020-09-16` - `2021-09-16`	a year	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2020-09-23` - `2021-09-23`	a year	crt.sh
shareaholic.com Amazon	`2020-07-03` - `2021-08-03`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
*.shareaholic.com R3	`2021-03-16` - `2021-06-14`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2021-03-01` - `2021-08-24`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2019-10-29` - `2021-11-23`	2 years	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.ads.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-03-29` - `2021-05-05`	a month	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2020-12-05` - `2021-12-04`	a year	crt.sh
*.driftcdn.com Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh
imgix.map.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-08-06` - `2021-08-07`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://cofense.com/blog/autohotkey-banking-trojan/
Frame ID: 0AF9F0E2482BEB9DAA2B24A14ACD1B69
Requests: 193 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html
Frame ID: 1B52AC5DE996AA2538EAF169AAF69E85
Requests: 1 HTTP requests in this frame

Frame: https://app-ab46.marketo.com/index.php/form/XDFrame
Frame ID: C406E02428E01113FF4CE31DB2526345
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
Frame ID: BB0DB972AB97395B2E5FF59876646A24
Requests: 41 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat
Frame ID: A9ADFA9F865FD87239B69D1F80BE9554
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

268
Requests

100 %
HTTPS

31 %
IPv6

48
Domains

61
Subdomains

57
IPs

6
Countries

5360 kB
Transfer

13923 kB
Size

15
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://support.cofense.com/
Title: Customer Resource Center

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://developer.cofense.com/
Title: Cofense Dev

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Get a Demo

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cofense/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/phishme-inc-?trk=hb_tab_compy_id_1550880
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/phishme
Title:

Search URL Search Domain Scan URL

URL: https://ccbjournal.com/podcast/in-house-warrior-garage2global-with-rohyt-belani-ceo-of-cofense-with-cohosts-louis-lehot-of-l2counsel-and-richard-levick-and-ian-lipner-of-levick
Title: 1/04/21 In House Warrior: Garage2Global with Rohyt Belani, CEO of Cofense with cohosts Louis Lehot of L2Counsel and Richard Levick and Ian Lipner of LEVICK Corporate Counsel Business Journal

Search URL Search Domain Scan URL

URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/Telestra.pdf
Title: 12/31/2020 Telstra backs Melbourne Cofense cyber security centre to defend Asia Pacific The Australian

Search URL Search Domain Scan URL

URL: https://threatpost.com/emotet-returns-100k-mailboxes/162584/
Title: 12/23/2020 Emotet Returns to Hit 100K Mailboxes Per Day ThreatPost

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/emotet-botnet-returns-after-2-month-hiatus-a-15656
Title: 12/23/2020 Emotet Botnet Returns After 2-Month Hiatus Bank Info Security

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 93

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1617804249606%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%252Fautohotkey-banking-trojan%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true

Request Chain 163

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 165

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2 HTTP 302
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2

Request Chain 170

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&pv=57192077904.91825&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

Request Chain 172

https://d.adroll.com/cm/aol/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 173

https://d.adroll.com/cm/index/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251&C=1

Request Chain 174

https://d.adroll.com/cm/n/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expires=365

Request Chain 175

https://d.adroll.com/cm/outbrain/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&rdrctExp=true

Request Chain 176

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 177

https://d.adroll.com/cm/taboola/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

Request Chain 178

https://d.adroll.com/cm/triplelift/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://eb2.3lift.com/xuid?mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e HTTP 302
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

Request Chain 179

https://d.adroll.com/cm/r/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 180

https://d.adroll.com/cm/b/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://x.bidswitch.net/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

Request Chain 181

https://d.adroll.com/cm/x/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://ib.adnxs.com/setuid?entity=172&code=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DOWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

Request Chain 183

https://d.adroll.com/cm/o/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=9faf6c3750e4d8884bef33f5051eef20 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=9faf6c3750e4d8884bef33f5051eef20

Request Chain 184

https://d.adroll.com/cm/g/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=n69sN1Dk2IhL7zP1BR7vIA HTTP 302
https://d.adroll.com/cm/g/in

268 HTTP transactions
18 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/blog/autohotkey-banking-trojan/ 2 MB
2 MB 404ms
155ms Document
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: 931da3899d3ec2f4b3893db69089c4a990b2ea6a9c27c60fcaa640f6666a03ce

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /blog/autohotkey-banking-trojan/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Wed, 07 Apr 2021 14:04:08 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://cofense.com/?p=24289>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 1
x-cache-group: normal
content-encoding: br

GET
H2 200 cache.skin.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
400 B 86ms
19ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-d5"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/ 50 KB
8 KB 90ms
23ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: NetDNA-cache/2.2
etag: W/"606d8d98-c88a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/ 5 KB
1 KB 91ms
23ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/styles.css?ver=2.3.7
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:17 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2d-1421"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/css/ 10 KB
2 KB 125ms
58ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/css/style.css?ver=1617792557
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:17 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2d-2678"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/ 56 KB
12 KB 124ms
57ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/all.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-dff5"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/ 56 KB
10 KB 147ms
80ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-e1e0"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/ 65 KB
12 KB 128ms
62ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-10321"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ihover.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
76 KB 135ms
68ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:15 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2b-6ae1e"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
825 B 124ms
57ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-568"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
8 KB 132ms
66ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-9226"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page-list.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/ 2 KB
790 B 143ms
77ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-60c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/ 96 KB
11 KB 142ms
76ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:10 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e26-17e39"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 t4bnewsticker.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/ 2 KB
873 B 89ms
24ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/t4bnewsticker.css?v=1.2.3&ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:08 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e24-7d7"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 10 KB
2 KB 144ms
79ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:11 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e27-29ff"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 search-filter.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 24 KB
5 KB 142ms
77ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:11 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e27-61cc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
14 KB 101ms
36ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:20 GMT
server: NetDNA-cache/2.2
etag: W/"76cb46c10b6c0293433b371bae2414b2"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 js_composer.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/css/ 449 KB
45 KB 110ms
45ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-70240"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 magnific-popup.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 123ms
58ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-1802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 animate.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 123ms
59ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-10cbc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 40ms
14ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 13:18:42 GMT
server: ESF
date: Wed, 07 Apr 2021 14:04:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Apr 2021 14:04:08 GMT

GET
H2 200 elegant-icons.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 139ms
75ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-103d"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 434ms
371ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:06 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e22-577a"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 608 KB
72 KB 144ms
81ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:08 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e24-980d1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-shortcodes.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 28 KB
5 KB 140ms
77ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-6f98"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 113 KB
19 KB 100ms
37ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-1c254"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wmx-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 5 KB
1 KB 125ms
62ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/wmx-styles.css?ver=1617792545
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-1572"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 responsive.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 102 KB
12 KB 140ms
78ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:06 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e22-198c3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 101ms
38ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-3aed"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/ 93 KB
16 KB 127ms
65ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88bb8f201b753bea7a809832098ed1062a54d74d26aff22742d34b9e18f8b059

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-175f1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 24 KB
1 KB 38ms
14ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7742176d36a9ea889f4db0a843e62f522ba690a8d514e91dd5aa09eccf7340ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 12:45:24 GMT
server: ESF
date: Wed, 07 Apr 2021 14:04:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Apr 2021 14:04:08 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 102ms
41ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:22 GMT
server: NetDNA-cache/2.2
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 jquery-1.12.4-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/ 95 KB
33 KB 152ms
91ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-17a56"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate-1.4.1-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/ 23 KB
8 KB 148ms
87ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-5c79"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.bundle.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/ 79 KB
23 KB 148ms
87ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.bundle.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:17 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2d-13b0a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 39 KB
11 KB 147ms
86ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/front.js?ver=3.1.11
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-9a93"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.jquery.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 51 KB
9 KB 149ms
88ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/chosen.jquery.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-cbc3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 core.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 4 KB
2 KB 150ms
89ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/core.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-f5b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 script.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 145ms
85ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-c1c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/ 7 KB
2 KB 149ms
89ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/front.js?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:10 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e26-1d3b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.liscroll.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/ 2 KB
1 KB 150ms
90ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/jquery.liscroll.js?ver=1.2.3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:08 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e24-98a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modernizr.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
5 KB 150ms
90ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-283b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 9 KB
4 KB 55ms
16ms Script
application/javascript 2600:9000:2093:d200:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2093:d200:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 73952cc80c6ea36f277133e6aad1b4257fc9b4ac776643b70e7e882a2854b42d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:03:47 GMT
content-encoding: gzip
age: 25
x-cache: Hit from cloudfront
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 3705
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 14:23:39 GMT
server: nginx
etag: "44d44ff0b824723e320fc0bd54bb7010"
content-type: application/javascript; charset=UTF-8
via: 1.1 918126cde448a82c2757fd37058ea3ec.cloudfront.net (CloudFront)
cache-control: max-age=1200, public
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: ryUptpK5QAEhzhW-QyArl5vsnoQaNKxwNmzop1TRidHWU_YgMurdvw==

GET
H2 200 css
fonts.googleapis.com/ 3 KB
585 B 36ms
15ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Rubik:400,500

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 13:45:27 GMT
server: ESF
date: Wed, 07 Apr 2021 14:04:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Apr 2021 14:04:08 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 185 KB
62 KB 42ms
22ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2be49977c527343c796a571fd55041417c2f19cfbdf4558611df64c065a23478

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62626
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 07 Apr 2021 14:04:09 GMT

GET
H2 200 wp-emoji-release.min.js Show response
cofense.com/wp-includes/js/ 14 KB
5 KB 158ms
158ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://cofense.com/blog/autohotkey-banking-trojan/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: br
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: nginx
etag: W/"606d8d98-3795"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/ 256 KB
54 KB 28ms
14ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/lottie.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 2997437
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54959
cf-request-id: 094e3edf6d000014567b8b6000000001
timing-allow-origin: *
last-modified: Mon, 02 Nov 2020 04:51:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f9f9048-3ff8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IyT38S0DLGEHEye5aET8cWBv9kMpL%2F7J1cNObt6BK7vYRs%2FmMLZVa9e48JX9tT4BaVRKOGTkbi7K33opNlrbXNh0vyL34y%2FwWnDA2zyh2fktJc5iLhja52PbU1FzUjYtdg%3D%3D"}]}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63c3cdabeb811456-FRA
expires: Mon, 28 Mar 2022 14:04:08 GMT

GET
H2 200 iubenda_cons.js Show response
cdn.iubenda.com/cons/ 228 B
495 B 94ms
34ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 18:21:59 GMT
server: nginx/1.19.1
etag: "60660f47-d6"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 214
expires: Wed, 07 Apr 2021 17:04:09 GMT

GET
H2 200 iubenda_cs.js Show response
cdn.iubenda.com/cs/ 451 B
618 B 35ms
29ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 355bd04dd9add083f79f4f7a2313ec94361614ee26e08a043d987c243bc8e61e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 18:22:11 GMT
server: nginx/1.19.1
etag: "60660f53-14f"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 335
expires: Wed, 07 Apr 2021 17:04:09 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 25ms
21ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bda72c6918f7fa2683b5172f4192480b7808d79070e9e1dfc6eced0245e0a404

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35852
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 07 Apr 2021 14:04:09 GMT

GET
H2 200 cofense-logo.svg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
1 KB 25ms
20ms Image
image/svg+xml 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-b20"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 26ms
21ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-c2a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 26ms
21ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-cd3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 26ms
21ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-b2e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET
H2 200 cofense-pds.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 26ms
22ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-ff4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4084

GET
H2 200 cofense-triage.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 26ms
22ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-c04"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3076

GET
H2 200 cofense-vision.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 27ms
22ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-ad5"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2773

GET
H2 200 cofense-intelligence.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 27ms
23ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-c34"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 cofense-livefeed.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 5 KB
5 KB 27ms
23ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-livefeed.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-12ad"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4781

GET
H2 200 virus-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/ 6 KB
7 KB 27ms
23ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/virus-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:47:29 GMT
server: NetDNA-cache/2.2
etag: "606d8dc1-198b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6539

GET
H2 200 wfh-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/ 4 KB
5 KB 39ms
35ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/wfh-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:47:22 GMT
server: NetDNA-cache/2.2
etag: "606d8dba-111d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4381

GET
H2 200 cofense-threat_education.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 39ms
35ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_education.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-e51"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3665

GET
H2 200 phishing-threats-db.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/ 5 KB
5 KB 39ms
36ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/phishing-threats-db.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:47:13 GMT
server: NetDNA-cache/2.2
etag: "606d8db1-1469"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5225

GET
H2 200 cofense-cloud_seeker.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
5 KB 40ms
36ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:00 GMT
server: NetDNA-cache/2.2
etag: "606d8de0-1166"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4454

GET
H2 200 facebook.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 666 B
902 B 239ms
236ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/facebook.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:41 GMT
server: NetDNA-cache/2.2
etag: "606d8e09-29a"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 666

GET
H2 200 linkedin.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 723 B
959 B 240ms
237ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/linkedin.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:41 GMT
server: NetDNA-cache/2.2
etag: "606d8e09-2d3"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 723

GET
H2 200 twitter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 809 B
1 KB 239ms
236ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/twitter.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:48:42 GMT
server: NetDNA-cache/2.2
etag: "606d8e0a-329"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 809

GET
H2 200 free-access-blog.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ 95 KB
96 KB 378ms
375ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/free-access-blog.png
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:47:20 GMT
server: NetDNA-cache/2.2
etag: "606d8db8-17d95"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 97685

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
49 KB 29ms
27ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ce0866099ca449f69ca05bcb83cec88645bfabfa99232147fc2ae45ea804708e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50311
x-xss-protection: 0
expires: Wed, 07 Apr 2021 14:04:09 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Mar 2021 19:22:18 GMT
server: Golfe2
age: 2294
date: Wed, 07 Apr 2021 13:25:55 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19463
expires: Wed, 07 Apr 2021 15:25:55 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 9 KB
2 KB 99ms
35ms Script
application/javascript 54.192.210.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.20 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-20.ham50.r.cloudfront.net

Software

Resource Hash

932a2989a52c2d3cd76fa9846de75adde5222be99538a8ae48fd75a55ae19565

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:03:29 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
age: 40
etag: W/040612bfd32bd4d5d3931ab82b5ad3c5
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: JcwqvqvOLH0rRk1Br2eLDICuW2SVsf4fCns89qvEr8KGuFIg5NxVDQ==
via: 1.1 f2bfcb0e5eaa96cb4b9aaa38ccd55547.cloudfront.net (CloudFront)

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 28ms
7ms Script
application/x-javascript 2a02:26f0:7100:191::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:191::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=59342
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v19/ 46 KB
47 KB 26ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 14:36:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:37:32 GMT
server: sffe
age: 516433
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47272
x-xss-protection: 0
expires: Fri, 01 Apr 2022 14:36:56 GMT

GET
H2 200 28krvx2uf9n3.js Show response
js.driftt.com/include/1617804300000/ 212 KB
60 KB 209ms
148ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1617804300000/28krvx2uf9n3.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

fe245ebf501ed020b82e52d76e07551f8ee4bca927483c457b97d3a8a69760a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: V3tdRh.i0EiQpYNjvdSIapt0gZ3KaDgY
content-encoding: gzip
etag: W/"8be9bcccb4fc6eac1882562ca490388e"
x-amz-cf-pop: HAM50-C2
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:58:54 GMT
server: nginx
date: Wed, 07 Apr 2021 14:04:09 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pHh7TIvLOwk3M775bFawPn9hcwExWwhV2c6IA_3lCSJkP1oj2di-jw==

GET
DATA 200
OK truncated
/ 122 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ca275e3abc25d28d1687290d7022fbdc1dbc65897a57edf625612becc7cd4cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 86 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c346378eecdbc49f1af4027e1782ccfcf6daed7c02125d0c3efa715ae8273157

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 40 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0cd273dd31151f7c238927161bba7c45f7a62a762c33b179b69c8a44205825a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 nav-arrow.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
3 KB 20ms
19ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: "606d8e21-b8d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2957

GET
H2 200 icn-nav-search@2x.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 20ms
20ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: "606d8e21-514"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1300

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 34ms
28ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Mon, 23 Mar 2020 16:08:17 GMT
server: NetDNA-cache/2.2
etag: "b15db15f746f29ffa02638cb455b8ec0"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 79444

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 16 KB
16 KB 14ms
11ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 19:15:25 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 67724
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
expires: Wed, 06 Apr 2022 19:15:25 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
75 KB 56ms
53ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Mon, 23 Mar 2020 16:10:04 GMT
server: NetDNA-cache/2.2
etag: "a06da7f0950f9dd366fc9db9d56d618a"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 76612

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 12ms
9ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 146929
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:20 GMT

GET
H3-Q050 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 12ms
9ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:16:38 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:29 GMT
server: sffe
age: 146851
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15712
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:16:38 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 11ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:49 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 146900
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:49 GMT

GET
H3-Q050 200 KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2
fonts.gstatic.com/s/roboto/v27/ 17 KB
17 KB 13ms
11ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOiCnqEu92Fr1Mu51QrEzAdLw.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ec2c7c341db456f2c057a73bdcc82be478efc0834741036198d9589765af6a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:24:56 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 146353
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17016
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:24:56 GMT

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/ 150 KB
44 KB 78ms
26ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 02ccdd095156565fe6098cef9a1918b92e86dc6023b22fdcb27a2eef3a330482

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Tue, 06 Apr 2021 14:23:38 GMT
server: nginx
x-amz-request-id: T7N4BD2Y6GNQ2Y89
etag: "511bd43262d9bbf1b6d8c71b70947f5c"
x-hw: 1617804249.cds056.fr8.hn,1617804249.cds122.fr8.c
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
content-length: 44435
x-amz-id-2: tQxgkFNi8Fm3RUaOujbzt9UD8x6anoEW+Ez869rNE3QQbkxKvefr05g5StuLi1gyaygh2OAW3xs=

GET
DATA 200
OK truncated
/ 108 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dff95065f38a434e84c6e9cfff039fc30f6981fc1b91f139fd6bace0dfe7ca61

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 sf14g.js Show response
t.sf14g.com/ 36 KB
36 KB 417ms
195ms Script
application/javascript 3.220.33.83
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://t.sf14g.com/sf14g.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.220.33.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-220-33-83.compute-1.amazonaws.com

Software

Kestrel /

Resource Hash

6b171db7ca7ffee17e14f5d432d37e4ec87d6e7a5ce361670e329f705ee34364

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
last-modified: Tue, 09 Feb 2021 15:39:01 GMT
server: Kestrel
etag: "1d6fef9b02c88cc"
strict-transport-security: max-age=2592000
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 36940
expires: -1

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 97ms
34ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
via: 1.1 varnish
last-modified: Fri, 04 Dec 2020 00:21:46 GMT
age: 50701
etag: "cbc512946c8abb461c6215ed5b454e5f+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1957
x-timer: S1617804250.631955,VS0,VE0
x-served-by: cache-fra19166-FRA

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
724 B 207ms
192ms Script
text/javascript 2606:4700::6810:a852
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 63c3cdafd9ea4a9d-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length: 0
cf-request-id: 094e3ee1e400004a9d5abaf000000001

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 90ms
32ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 312ms
103ms XHR
application/json 184.73.100.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.73.100.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-184-73-100-94.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-client-geo-country: BE,Belgium
date: Wed, 07 Apr 2021 00:05:54 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
content-length: 1672
server: nginx
x-client-geo-region: BRU,Brussels Capital
x-client-geo-metrocode
etag: W/"b64e92c54cf8815d6fff0a70489dc30b"
access-control-max-age: 2000
x-client-geo-city: Brussels
x-varnish: 707686928 694106140
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 1060
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 50.827400,4.348000

GET
H2 200 core-d2a24f1d20d2043482758bef114eb219.js Show response
cdn.iubenda.com/cons/iubenda_cons/ 21 KB
7 KB 31ms
31ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons/core-d2a24f1d20d2043482758bef114eb219.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 18:21:59 GMT
server: nginx/1.19.1
etag: "60660f47-1b74"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 7028
expires: Thu, 07 Apr 2022 14:04:09 GMT

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1617804249606%26url%3Dhttps%253A%252F%252Fcofense.com%252Fblog%25...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true

0
59 B

191ms
191ms

Image
application/javascript

2620:119:50e1:101::6cae:b25
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server: Play
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
x-li-proto: http/2
x-li-pop: prod-esv5
content-type: application/javascript
content-length: 0
x-li-uuid: 6vS89mSYcxag7keNOysAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
content-length: 0
x-li-uuid: jc3N5mSYcxZANhw8xyoAAA==
pragma: no-cache
x-li-pop: afd-prod-lor1
x-msedge-ref: Ref A: 14F863468FF9424B9116BB7C0A29363C Ref B: FRAEDGE1109 Ref C: 2021-04-07T14:04:10Z
x-frame-options: sameorigin
date: Wed, 07 Apr 2021 14:04:09 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=31536000
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1617804249606&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 core-en.js Show response
cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/ 287 KB
69 KB 30ms
30ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: faac6b9031d79a3f00c6f066e1123f99cc6c9db4de3c7f5606c7009fdce481fa

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
last-modified: Thu, 01 Apr 2021 18:22:10 GMT
server: nginx/1.19.1
etag: "60660f52-1135f"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 70495
expires: Thu, 07 Apr 2022 14:04:09 GMT

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 105 KB
39 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm2&cid=1893042670.1617804250&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

12e64cd0ed369a4af602eee3f09ad619369e3ebb2376a2a29c4843ac72dd0c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39540
x-xss-protection: 0
expires: Wed, 07 Apr 2021 14:04:09 GMT

POST
H3-Q050 204 collect
www.google-analytics.com/g/ 0
38 B 15ms
14ms Other
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0HTW6C6HJS&gtm=2oe3v0&_p=238647248&sr=1600x1200&ul=en-us&cid=1893042670.1617804250&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&sid=1617804249&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 35 KB
14 KB 93ms
35ms Script
text/javascript 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f2.1e100.net

Software

cafe /

Resource Hash

cd3601b2f79f3cccc6333afba636cc8e645f7703257326df7df02497dc09d2df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13758
x-xss-protection: 0
server: cafe
etag: 4262303240453495685
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 07 Apr 2021 14:04:09 GMT

GET
H2 200 modules.0cb976794ef50d89b299.js Show response
script.hotjar.com/ 217 KB
58 KB 93ms
34ms Script
application/javascript 54.230.183.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.0cb976794ef50d89b299.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.183.9 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-183-9.ham50.r.cloudfront.net

Software

Resource Hash

67e0dec4a7a856e51c4bc5cfb2dd7a71b06ea2e935cb38d46b3014041d37fa3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 01 Apr 2021 10:27:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 531422
x-cache: Hit from cloudfront
content-length: 58593
access-control-allow-origin: *
last-modified: Thu, 01 Apr 2021 10:26:58 GMT
etag: "9788f73dd0ec050ba354063604c23c0e"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 135eb6368d07b066aff0760ea5228bab.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: 4orAemkbAUchu6_Im4NRoPC8mdl5hDLh2HBok0XE26oeFpojXtwp5g==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 30ms
30ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Fri, 16 Jul 2021 14:04:09 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 200ms
146ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Wed, 07 Apr 2021 14:04:09 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: cfb5c34a53cc824dee9becea1a140087
x-transaction: 00f54da900fc0b65
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 76856514.js Show response
www.iubenda.com/cookie-solution/confs/js/ 63 B
435 B 34ms
32ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.iubenda.com/cookie-solution/confs/js/76856514.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:09 GMT
access-control-request-method: *
content-encoding: gzip
content-length: 69
last-modified: Fri, 26 Mar 2021 11:56:36 GMT
server: nginx
etag: "605dcbf4-3f"
vary: Accept-Encoding
access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Thu, 08 Apr 2021 14:04:09 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
443 B 99ms
29ms XHR
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=306159095&gjid=2071082645&_gid=380478613.1617804250&_u=aGDAgUADQAAAAE~&z=155659200

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 07 Apr 2021 14:04:09 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
120 B 6ms
6ms Image
image/gif 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j89&aip=1&a=238647248&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&ul=en-us&de=UTF-8&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&exp=Y916st7_TUq9exzEKHDaPA.0&_u=aGDAgUADQ~&jid=306159095&gjid=2071082645&cid=1893042670.1617804250&tid=UA-114787942-1&_gid=380478613.1617804250&gtm=2wg3v05RQ37KH&z=2084227344

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14432
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 397 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: decb22061966d60e11818d21d2ac0a8886bf6908c98c9f3253546fc7697fbfc5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 15 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 026c031ea4bf0b31b0819e6576940574507c6293d8dc6c8200363b54ac7030a8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
2 KB 36ms
17ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1617804249780&cv=9&fst=1617804249780&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6836c6fe662385fd0e8f2b6f8b09b3b3d437dc540da4104ae0b462b6ecdae99d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1080
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 105 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c55c8751dbcb177cef9a5fd0b35d7bc18237574724c5e27432da0d857d0b0a49

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
505 B 50ms
30ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=306159095&_u=aGDAgUADQAAAAE~&z=879341196

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
505 B 49ms
29ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=306159095&_u=aGDAgUADQAAAAE~&z=879341196

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 99 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d53d2be00a4528f66c74e090ff517d270fef7a9698d462ea122a1c58c75259a5

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 56 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dabbb72e22cb1b6b46076eb52af87040bc18bcc082060fc20a86250896da0414

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 write Show response
hits-i.iubenda.com/ 0
397 B 40ms
39ms XHR
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/
Authorization: Basic aGl0czFfdTpoaXRzMV91cHdk
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
server: nginx
x-influxdb-build: OSS
access-control-allow-methods: DELETE, GET, OPTIONS, POST, PUT
access-control-allow-origin: https://cofense.com
access-control-expose-headers: Date, X-InfluxDB-Version, X-InfluxDB-Build
request-id: 1fe6ed9a-97aa-11eb-a686-0242ac110002
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Length, Content-Type, X-CSRF-Token, X-HTTP-Method-Override
x-influxdb-version: 1.8.2
x-request-id: 1fe6ed9a-97aa-11eb-a686-0242ac110002

OPTIONS
H2 204 write
hits-i.iubenda.com/ Frame 0
0 116ms
58ms Preflight
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Protocol: H2
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Wed, 07 Apr 2021 14:04:10 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: *, authorization
access-control-max-age: 1728000
access-control-allow-credentials: true
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
154 B 21ms
21ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1617804249780&cv=9&fst=1617804000000&num=1&bg=ffffff&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&async=1&fmt=3&is_vtc=1&random=2168435949&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
154 B 20ms
20ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1617804249780&cv=9&fst=1617804000000&num=1&bg=ffffff&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&tiba=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&async=1&fmt=3&is_vtc=1&random=2168435949&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 79 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 98e89f927a0dd5f4fcb92a9f4a08b7d3ba87d95f4964fc0a213cfbf31029d5bc

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 174 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 734976c4bb5a252fb49c7380c9b1dca1d36d2c14462716ab6c5f5a732637c82a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 11 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5430d6fe02af3c64feb8afbc260c7aceb1204fa869aa422f421f7d921dd382ea

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 112 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6f24078660b09ece82cb18154ca70658e05e25be808029dd09c22668676a7fd

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 43 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af71da6e0b8871d0806f440e932cb3b99706330fa4306e8becc7cbf2c7860c4d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 66 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d355d2a4e8ff0e3eba6acd9b35c7972985fa371cbff6b3ba72d9735e04c057b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 61 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0f73cdb5b4ff4fc3339c1d8ddcdf35ea878691e8c33a0a299676f2b0352bb8e7

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 58 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 938fefbc4f39e13fa1d382e19d72864b406f82f201df9d0376910adf439db117

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 infobox.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 2 KB
847 B 223ms
220ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/infobox.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:14 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2a-821"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 swiped-events.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 2 KB
1 KB 22ms
18ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/swiped-events.min.js?ver=1.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:17 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2d-6e8"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 imagesloaded.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 5 KB
2 KB 23ms
19ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: NetDNA-cache/2.2
etag: W/"606d8d98-15fd"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 effect.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 13 KB
5 KB 24ms
19ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/effect.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-33d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ditty-news-ticker.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 14 KB
3 KB 25ms
20ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ditty-news-ticker.min.js?ver=1617792557
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:17 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2d-3670"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.form.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 16 KB
6 KB 25ms
20ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: NetDNA-cache/2.2
etag: W/"606d8d98-3e97"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.t-countdown.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 26ms
21ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:15 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2b-23d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wow.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 26ms
21ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-1ff6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modules.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
35 KB 29ms
24ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:16 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2c-1e4e2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 245ms
240ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-99c8"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.sticky.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 10 KB
3 KB 35ms
30ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-2765"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 14 KB
4 KB 35ms
31ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/custom.js?ver=1617792545
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-3802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-scripts.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 139 KB
39 KB 39ms
35ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:06 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e22-22de9"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 42ms
38ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-10964"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.waypoints.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 244ms
241ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-2344"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 sticky.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 1 KB
830 B 245ms
242ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e21-4db"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment-reply.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 3 KB
2 KB 247ms
244ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/comment-reply.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: NetDNA-cache/2.2
etag: W/"606d8d98-ba6"
vary: Accept-Encoding, Accept-Encoding
x-cache: MISS
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
1016 B 44ms
41ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/wp-embed.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:46:48 GMT
server: NetDNA-cache/2.2
etag: W/"606d8d98-592"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 js_composer_front.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/js/dist/ 18 KB
6 KB 45ms
42ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=5.1.1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:15 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e2b-49dc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.modal.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 5 KB
2 KB 32ms
16ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 672726
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1399
cf-request-id: 094e3ee39c00001e4766168000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-1359"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bRuV4xJG9zclQpabrHNpx6YHj00E1bw1yh%2FMSxzTf2phQjuoFROLTCCti7jN8DR6b1nlsajVYOQTEkYsSP%2B3aKbpLBDKXan0GWDfLfM%2B%2Bs5HSW4bjJJFh22Lfp9m0SWzBg%3D%3D"}]}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63c3cdb29deb1e47-FRA
expires: Mon, 28 Mar 2022 14:04:10 GMT

GET
H2 200 jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 3 KB
2 KB 31ms
15ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2361666
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1541
cf-request-id: 094e3ee39c00001e47c609d000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-c81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=C7xO64u9gi6UGLO24ZNdXxIL8GNhiwQDNVGgng0T5Q%2BH06uBKLAz3YWKIgAxu%2FBZcHHCBPJK39PQkSCmOl085Gmc9falH%2BZnnfadHCGXiLdKJqGLN72qUhPeybSmvptcFg%3D%3D"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63c3cdb29dec1e47-FRA
expires: Mon, 28 Mar 2022 14:04:10 GMT

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ 204 KB
69 KB 212ms
36ms Script
application/x-javascript 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5462
strict-transport-security: max-age=63113904
cf-request-id: 094e3ee44500004c1928b2d000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "28e078e-33187-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 63c3cdb3ab1b4c19-AMS
expires: Wed, 07 Apr 2021 18:04:10 GMT

GET
DATA 200
OK truncated
/ 96 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6b251fb950a81e0947386320b408ba05a9cd60ef73329331502aa4adfb171e37

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 b-g.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 840 KB
841 KB 359ms
358ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1617792545
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:49:08 GMT
server: NetDNA-cache/2.2
etag: "606d8e24-d20af"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET
H2 200 twitter_social_tile_A2_1200_628-510x240.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/ 31 KB
31 KB 222ms
220ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/twitter_social_tile_A2_1200_628-510x240.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:46:57 GMT
server: NetDNA-cache/2.2
etag: "606d8da1-7b63"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 31587

GET
H2 200 footer-graphic.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 4 KB
4 KB 22ms
19ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:48:47 GMT
server: NetDNA-cache/2.2
etag: "606d8e0f-e4e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3662

GET
H2 200 footer-graphic-b.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 212 B
438 B 23ms
19ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:48:47 GMT
server: NetDNA-cache/2.2
etag: "606d8e0f-d4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 212

GET
H2 200 footer-graphic-a.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 107 B
333 B 22ms
20ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:48:47 GMT
server: NetDNA-cache/2.2
etag: "606d8e0f-6b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 107

GET
H2 200 ssb-icon.ttf
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ 6 KB
4 KB 269ms
222ms Font
application/octet-stream 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ssb-icon.ttf?eahqa2
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131

Request headers

Origin: https://cofense.com
Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
last-modified: Wed, 07 Apr 2021 10:49:10 GMT
server: NetDNA-cache/2.2
etag: W/"606d8e26-17f8"
vary: Accept-Encoding
x-cache: MISS
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H3-Q050 200 KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2
fonts.gstatic.com/s/roboto/v27/ 17 KB
17 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOjCnqEu92Fr1Mu51TzBic6CsQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a42cc82f30fbf25a268f6d5a10158e8312a838222da6847158ea4175fa289d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:25:08 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:44 GMT
server: sffe
age: 146342
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17004
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:25:08 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:49 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 146901
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:49 GMT

GET
H3-Q050 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v27/ 17 KB
17 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:25:00 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:42 GMT
server: sffe
age: 146350
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17484
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:25:00 GMT

GET
H2 403 tracking
lltrck.com/api/ 0
0 324ms
106ms Image
text/html 52.44.242.176
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lltrck.com/api/tracking?accountId=19612&page=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&referer=&fp=52baf7eeb2f871a3666e26ca07c8d65d
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.242.176 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-242-176.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 getForm Show response
app-ab46.marketo.com/index.php/form/ 24 KB
6 KB 256ms
255ms Script
application/javascript 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-ab46.marketo.com/index.php/form/getForm?munchkinId=404-JHU-612&form=1378&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&callback=jQuery11240064337046350748_1617804250546&_=1617804250547
Requested by: Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f6cb97a416cbccfc8a63fc286d439ecab3a3e1465955337603322f0906c2132

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-request-id: 094e3ee5c900004c19692a9000000001
content-encoding: gzip
server: cloudflare
date: Wed, 07 Apr 2021 14:04:10 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 63c3cdb609714c19-AMS
cached: true

POST
H2 200 e
analytics.shareaholic.com/ 43 B
377 B 330ms
108ms Other
image/gif 54.147.47.240
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.47.240 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-47-240.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:10 GMT
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
652 B 195ms
140ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Wed, 07 Apr 2021 14:04:10 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: ec0a03e4c2f82852aeb56bb6b8d67766
x-transaction: 00677274007a6cb7
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 41 KB
13 KB 99ms
34ms Script
text/javascript 104.108.144.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.126 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-126.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ecfec6edd361b81190425a403385fb537c339984464c26413437ef7dc551a0a3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: nkHCm_xeWIjraGkeLYKhlD5Mi9FxU1pe
Content-Encoding: gzip
ETag: "64986b995b49e1feeccb58c9c06afef7"
x-amz-request-id: M8JT0DRWSNHQWNF2
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12936
x-amz-id-2: UaJgkqahhvnmY+EprGUVU7rj5UlsD+G3+MfQdOHzuTlVw1GAtQCvkxib4Sev/d0/doHcrvTIDEQ=
Last-Modified: Mon, 05 Apr 2021 16:54:49 GMT
Server: AmazonS3
Date: Wed, 07 Apr 2021 14:04:10 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 510ms
300ms Script
application/javascript 107.20.140.231
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&cl=en-US&id_sync=d02ebdb5-ffaa-4cb9-a1b4-c82c1a5ddad4&minify=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.140.231 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:10 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 box-5e3cec51ed8e99df6977c199d27812d7.html Show response
vars.hotjar.com/ Frame 1B52 1 KB
1 KB 86ms
26ms Document
text/html 54.192.210.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.210.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-210-44.ham50.r.cloudfront.net
Software: /
Resource Hash: 486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-5e3cec51ed8e99df6977c199d27812d7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html
content-length: 684
date: Tue, 30 Mar 2021 16:10:32 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "4e332edbbc3b46800c87f197cc7d3bb6"
last-modified: Tue, 30 Mar 2021 14:48:51 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0db8881d14f219a945f6f3898134012d.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: 7l69H8H3KS1WPCFzIPyQBFGg5m2f43v6GT4uIUS18zjGJxq3ZBjO4A==
age: 683618

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

32ms
32ms

Script
application/javascript

104.108.144.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.126 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-126.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 8C_4p5S6NLuKOM2fXKpm7asomxwPn3IL
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: A6E4D842C4F3666B
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 1Pslf+Y9QwUHIZmwUo95w2CKA8MTrgZpbGBRFLUwAevxRDJ3euWTGuAJ2AJ78njOjdUd48ZsKSg=
Last-Modified: Tue, 19 Jan 2021 16:25:36 GMT
Server: AmazonS3
Date: Wed, 07 Apr 2021 14:04:10 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Wed, 07 Apr 2021 14:04:10 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/ 0
705 B 150ms
90ms Script
text/javascript 104.108.144.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.126 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-126.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: qSiw2DAoSi34nL7MIxHtkdBLi7rEjO2O
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-request-id: CGDP2DWWCFJAGWNF
x-amz-server-side-encryption: AES256
Connection: keep-alive
Content-Length: 0
x-amz-id-2: XoMnorTjv7CxdvBDNfYj9v+XJVI2G9krr8MRQJdDEn9R0sX/SkRe6r9giIcP/mICESx7EmHjxU0=
Last-Modified: Tue, 06 Apr 2021 19:59:49 GMT
Server: AmazonS3
Date: Wed, 07 Apr 2021 14:04:10 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2

394 B
862 B

110ms
36ms

Script
application/javascript

54.74.23.153
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.74.23.153 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-23-153.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 5ced7308fef1e27867127d1b3b5c0e8ac2dab7eb139d75daad0ec71b891ba2ce

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:10 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: application/javascript
content-length: 394
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Redirect headers

location: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1dedea6db0f75d0f2d0fe6478d8fe2a4&_b=2
date: Wed, 07 Apr 2021 14:04:10 GMT
server: nginx/1.18.0
content-length: 105

GET
H2 200 forms2.css
app-ab46.marketo.com/js/forms2/css/ 13 KB
3 KB 44ms
44ms Stylesheet
text/css 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4678
content-length: 2623
cf-request-id: 094e3ee6cf00004c19271b3000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "2c408d2-3437-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 63c3cdb7bdb04c19-AMS
expires: Wed, 07 Apr 2021 18:04:10 GMT

GET
H2 200 forms2-theme-plain.css
app-ab46.marketo.com/js/forms2/css/ 828 B
362 B 45ms
44ms Stylesheet
text/css 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 129
content-length: 246
cf-request-id: 094e3ee6cf00004c1933bdb000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "28e07cb-33c-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 63c3cdb7bdb24c19-AMS
expires: Wed, 07 Apr 2021 18:04:10 GMT

GET
H2 200 select_ui.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 21ms
21ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/select_ui.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:10 GMT
last-modified: Wed, 07 Apr 2021 10:49:05 GMT
server: NetDNA-cache/2.2
etag: "606d8e21-43d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1085

GET
H2 200 XDFrame Show response
app-ab46.marketo.com/index.php/form/ Frame C406 2 KB
919 B 374ms
374ms Document
text/html 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/index.php/form/XDFrame

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-ab46.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cf_bm=28bc4150ec1a3f1d34ca8a9605ee675ee93edcbb-1617804250-1800-AZ7RHWt6V/pqK+nJWWD0/u6Eg7zpqNXNirguQwh2ONGj9Pe5LgcDYcKs9uYWcCn6+scJCdhYr7jO7TCMtQBQCII=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
content-type: text/html; charset=utf-8
content-length: 653
set-cookie: __cfduid=df6f211dc067b1ee0616f006d16be157a1617804250; expires=Fri, 07-May-21 14:04:10 GMT; path=/; domain=.app-ab46.marketo.com; HttpOnly; SameSite=Lax BIGipServerab46web-nginx-app_https=!Bm+2CZwSrggbcxDaIvODocHezid2PaSX0sgPnfQpoCFxRl6Bk+4vDF1h3T/pd5dPByIztjyCx9EY0w==;Path=/;Version=1;Secure;Httponly
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-request-id: 094e3ee74700004c195c992000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 63c3cdb87fa94c19-AMS

GET
H/1.1

200
OK

LZCH7AGKEBFGLOFOIHTG7Q.js Show response
s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/
Redirect Chain

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-troja...
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

4 KB
2 KB

42ms
41ms

Script
text/javascript

104.108.144.126
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.126 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-126.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: pV63wssUTNuzKRiEhPCUY6UWHFWb2FIJ
Content-Encoding: gzip
ETag: "a7a27b8b818085dc9afcceff9102471d"
x-amz-request-id: 2JDG6X7Z4H2H4PAY
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1499
x-amz-id-2: CrE21TTmTCfm5C7IIh79iRrCQ0W3Ra7W9D9bF4Xgi7EVKPRQTHZymaOhe5wP22u9oj5O0ZTl36w=
Last-Modified: Tue, 26 Jan 2021 22:18:13 GMT
Server: AmazonS3
Date: Wed, 07 Apr 2021 14:04:11 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.18.0
x-rule: *
date: Wed, 07 Apr 2021 14:04:11 GMT
x-segment-eid: LZCH7AGKEBFGLOFOIHTG7Q
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
cache-control: no-store, no-cache, must-revalidate
x-segment-display-name: Visitors to Unsegmented Pages
x-pixel-eid: JLU6TD3D6FA2JAELGSQWLD
x-segment-name: *
x-advertisable-eid: TFV7KNIV3VHWLJ6GAQ3KFT
content-length: 0
x-conversion-currency

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
24 KB 21ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d.adroll.com
URL: https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&pv=57192077904.91825&cookie=&adroll_s_ref=&keyw=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

86cc35989be655e6cbe68540cf835dec34388862a948fbd05850100797c32319

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23784
x-fb-rlafr: 0
pragma: public
x-fb-debug: gzgLqdYqc1hW8BurvYZ5mjs90U3+jtz50raD8sunqusP/PqzrwgcOVZJvJPIUZr/qJYgO3t7/LSlXI8KfhytXQ==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Wed, 07 Apr 2021 14:04:11 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ...
https://pixel.advertising.com/ups/55980/sync?uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
125 B

84ms
27ms

Image
text/plain

35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55980/sync?uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/55980/sync?uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 167
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHW...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251&C=1

43 B
1 KB

65ms
65ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251&C=1
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 07 Apr 2021 14:04:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 07 Apr 2021 14:04:11 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 07 Apr 2021 14:04:11 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expiration=1649340251&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Wed, 07 Apr 2021 14:04:11 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expires=365

0
239 B

125ms
29ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expires=365
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&expires=365
pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&rdrctExp=true

0
477 B

92ms
92ms

Image
text/plain

70.42.32.127
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&rdrctExp=true
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.127 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:11 GMT
Cache-Control: no-cache
X-TraceId: 4e086841956e27411a38b33d7113364d
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&rdrctExp=true
Date: Wed, 07 Apr 2021 14:04:11 GMT
X-TraceId: 939f32893f161b9f856ada258dc1b4ba
Content-Length: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...

1 B
806 B

118ms
29ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:11 GMT
X-lat: lhrpug012:0:410
Server: nginx
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 220
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3V...
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

0
219 B

68ms
21ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

tbl-x-upstream: 10.41.22.181:10213
date: Wed, 07 Apr 2021 14:04:11 GMT
server: nginx
x-fastly-to-nlb-rtt: 4031

Redirect headers

location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

xuid
eb2.3lift.com/
Redirect Chain

https://d.adroll.com/cm/triplelift/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNI...
https://eb2.3lift.com/xuid?mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=

37 B
352 B

26ms
26ms

Image
image/gif

18.184.39.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.39.197 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: /xuid?ld=1&mid=4714&xuid=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

204

v1
ads.yahoo.com/cms/
Redirect Chain

https://d.adroll.com/cm/r/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
444 B

21ms
7ms

Image
text/plain

2a00:1288:80:800::7001
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

location: https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 165
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

200

sync
x.bidswitch.net/ul_cb/
Redirect Chain

https://d.adroll.com/cm/b/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://x.bidswitch.net/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

43 B
344 B

30ms
29ms

Image
image/gif

52.58.55.232
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.55.232 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://d.adroll.com/cm/x/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://ib.adnxs.com/setuid?entity=172&code=OWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DOWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

43 B
1 KB

20ms
20ms

Image
image/gif

185.33.221.13
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DOWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.13 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

729.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 07 Apr 2021 14:04:11 GMT
X-Proxy-Origin: 194.187.251.62; 194.187.251.62; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.150:80
AN-X-Request-Uuid: 6e361d65-dd01-40f9-94db-310822660b6a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 07 Apr 2021 14:04:11 GMT
X-Proxy-Origin: 194.187.251.62; 194.187.251.62; 729.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.151:80
AN-X-Request-Uuid: aa04e847-3c4b-4843-8c4e-b303a30cafe5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DOWZhZjZjMzc1MGU0ZDg4ODRiZWYzM2Y1MDUxZWVmMjA
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 out
d.adroll.com/cm/l/ 42 B
180 B 58ms
56ms Image
image/gif 54.74.23.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/l/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.74.23.153 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-23-153.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.18.0
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=9faf6c3750e4d8884bef33f5051eef20
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=9faf6c3750e4d8884bef33f5051eef20

43 B
180 B

27ms
27ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=9faf6c3750e4d8884bef33f5051eef20
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.205.50 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
via: 1.1 google
server: OXGW/16.205.50
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=9faf6c3750e4d8884bef33f5051eef20
date: Wed, 07 Apr 2021 14:04:11 GMT
via: 1.1 google
server: OXGW/16.205.50
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=2eb15c5d5097434e6fd662eacd903845-1617804250984&arrfrr=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6G...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=n69sN1Dk2IhL7zP1BR7vIA
https://d.adroll.com/cm/g/in

42 B
536 B

36ms
36ms

Image
image/gif

54.74.23.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.74.23.153 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-23-153.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
server: nginx/1.18.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 356920024481298 Show response
connect.facebook.net/signals/config/ 240 KB
70 KB 58ms
57ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/356920024481298?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: public
x-fb-debug: ngpfAstTkShMISW82vUSzmN1kYW2MmfkkA10R663Q9wc0IEvblXP48ST76DeEJoT4GicqVkCr320UP0G8I2OWw==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 07 Apr 2021 14:04:11 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"include_subdomains":true}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
priority: u=3,i
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 18ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=356920024481298&ev=PageView&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&rl=&if=false&ts=1617804251195&cd[segment_eid]=LZCH7AGKEBFGLOFOIHTG7Q&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=29&fbp=fb.1.1617804251193.1798826306&it=1617804251108&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Requested by

Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 07 Apr 2021 14:04:11 GMT

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ Frame C406 204 KB
68 KB 36ms
35ms Script
application/x-javascript 104.16.95.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.95.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://app-ab46.marketo.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 5463
strict-transport-security: max-age=63113904
cf-request-id: 094e3ee8c200004c1954218000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "28e078e-33187-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 63c3cdbade1a4c19-AMS
expires: Wed, 07 Apr 2021 18:04:11 GMT

GET
H2 200 core Show response
js.driftt.com/ Frame BB0D 3 KB
1 KB 134ms
134ms Document
text/html 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1617804300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

89ab8d06c38cc33f4799bd4741d73b45c34bea92671595eda701ff86d9f1e63d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Wed, 07 Apr 2021 13:58:43 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: j6nQlRwCd2D36WAb9wdzMNb1Tijz5_Fj
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache
etag: W/"f1f73108959bc01a868352f08dd5b679"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: crp3ezA-msKrTbPLnCJqS17yPSmeJRbYBP7UpKA9-WRhCA9O8cLNIg==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame A9AD 3 KB
1 KB 139ms
139ms Document
text/html 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1617804300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

89ab8d06c38cc33f4799bd4741d73b45c34bea92671595eda701ff86d9f1e63d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core/chat
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Wed, 07 Apr 2021 13:58:43 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: j6nQlRwCd2D36WAb9wdzMNb1Tijz5_Fj
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 07 Apr 2021 14:04:11 GMT
cache-control: no-cache
etag: W/"f1f73108959bc01a868352f08dd5b679"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: W3JCNdox-Ic-x01vfRC1luh7TWQppHjayfTM9exTNHy6tr10oDLxaA==

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 562ms
103ms Script
application/javascript 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/blog/autohotkey-banking-trojan/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:12 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Last-Modified: Fri, 13 Mar 2020 17:27:16 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Fri, 07 Apr 2023 14:04:12 GMT

GET
H2 200 runtime~main.f44d8ad4.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 5 KB
3 KB 29ms
25ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

455273a089f02f97923d6614e596567ab375c77a516f0ec7ee263c925a847481

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:19 GMT
server: nginx
etag: W/"9f2926d1a951e051f2ef0588ba0ba993"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: hq_nbEe3EfS90e8Ws1VaPa_gTZkK.Rb7
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ORjfTqukNv1cBcIk_r9GvwvQ1DHtSEyURijuQBxHlEvzH_wXTGY8QA==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 40 KB
12 KB 33ms
29ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 5912199
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mdTo7ep7rf0-OTnnjv89Pwp8QFiknJlIf_iHEbQzpQ6cTeBlwHYJfg==

GET
H2 200 24.51b9fb55.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 42 KB
12 KB 33ms
28ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.51b9fb55.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"cef2e36f386b30af63a3565f56cb570c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2YkFlG1sZ1uGuw9fRJhr_rduXEPaItbU
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cf1vOhFgZcKDC5KKBGhbMpVP6cUJouEnYrYq6YPWnMDgWXLNWm5DuQ==

GET
H2 200 18.df9af1cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 70 KB
21 KB 38ms
34ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.df9af1cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"4dd1a4c39ef032a7370127a7a049792b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: h.C2zbsx58v1pJxunn7Ah5lgmrvqa1du
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vxwlguVOMfXzjPJ-2wSgmptAfEwfHTQAHj0SmHEmWdsej3InA52fnQ==

GET
H2 200 30.d7884983.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 48 KB
15 KB 38ms
34ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.d7884983.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 2929210
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"4e1b145be04e5bc76ea6d15f491a0174"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RQGg9Lzfff.JlTlK.NLmBXc6K0oL5gia
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TYJu3r59VtWErwgnaKtwsWp_Io-sae_HLaiidSTruXItXmZlarV6eg==

GET
H2 200 17.01346f26.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 29 KB
8 KB 38ms
35ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.01346f26.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"d881c1078c1983fec915bc6b6aa0deb9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DZAqQV.UJvsXxwZF6YiaFl2qyaLgaBjX
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: h2gD7I0q-oq6FxYAaC3NToYLL_e7U5_E3Cn-Fbzmp0DBsNkajpRs9w==

GET
H2 200 19.96441b8b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 39 KB
10 KB 43ms
40ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"854e298ba40cc0c37109059dacdab629"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oTlkJr3lyDhhX5V2tq9V1Joa8tA1WCFnuR9hq2xfcXvn9JcMbU9JCQ==

GET
H2 200 35.a8afab31.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 52 KB
18 KB 43ms
41ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:47:00 GMT
content-encoding: gzip
age: 2312230
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Mar 2021 19:15:02 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .G4l5M3zdEr.H9Ym7Vn1RjNno_gNBdpu
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ZivABYf77Q7Pl80sGb_yRfFqHPf_AKwgwSAEfpPKEv405m5Dfl_V3w==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 24 KB
10 KB 43ms
41ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:28:48 GMT
content-encoding: gzip
age: 2918123
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 16:50:21 GMT
server: nginx
etag: W/"185cc47f69cf9cfd71f532b15a0b6e8e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Sa1cQ5AXCSfvmijtq3l0XPcobRiPq9R0
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: URzc8Jo6MzEamaUycmtbuqvEa5BADh-2ol8GrYl_SouNI6JC1Ghu4w==

GET
H2 200 13.dce07d58.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 60 KB
21 KB 44ms
41ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.dce07d58.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"53cb1bc6a93f37cb23bd87c0969623e9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: B9qKAkZ_gCQFUK9XQjx8Tol3YM6NhFM1
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HBJHBZ0rUcdh7dD3YII8Zawo31i3EXhdYzpp0uLjZ6yhVoySGS5lyA==

GET
H2 200 main~493df0b3.40a201b4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 21 KB
7 KB 57ms
55ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.40a201b4.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"69fb0eac23d360e99d09dc8ff2d9f962"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bSwH_75xAiofeTvLmJWwyVFlVbSGw1A9
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YC_lN8QtUwgtVzcIDCq6hxNv4aH00E9Id07LULpneFp8WlRxofIMrA==

GET
H2 200 main~970f9218.fe9024ab.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 63 KB
16 KB 57ms
55ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.fe9024ab.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"e5ee197ba311176a274dc6e7fee6e7f6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7P0jL99.Os6SrCjfRNCPbidx0BZ2SnmU
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8O31MDtxuS3LygTXoSRD6EV7h7VQVKbIRZLnoZZ1axYT3mIYxAsQRw==

GET
H2 200 main~89e24786.afbb2c59.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 62 KB
17 KB 57ms
55ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.afbb2c59.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"664d363329fb00cc74d058503814a7ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JcerQY68_yXSuUYCWk2Pjyd9PnG2n_nr
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: x0zu5YQlNNKdDw9mAw3mneIcOXYf_C-b1w7k5Bd2VsXGh0HGUR3AhQ==

GET
H2 200 main~53ca99a6.77730165.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 28 KB
9 KB 57ms
56ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.77730165.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

7dd95da50fded770bb16672861accc255de79b14a1a85492ddd11e86b91f4964

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:19 GMT
server: nginx
etag: W/"c1173f7ed3d0704ae8ba247c445a3d31"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KeZLjxHCOY4e5bBhd8p3S3cMpMO0t.xQ
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: O2oGmDm6r-UikuBOSq1BjsfeMAgejzvDvEmRwxaKd7zUJX6rm3qCKQ==

GET
H2 200 runtime~main.f44d8ad4.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 5 KB
3 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

455273a089f02f97923d6614e596567ab375c77a516f0ec7ee263c925a847481

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:19 GMT
server: nginx
etag: W/"9f2926d1a951e051f2ef0588ba0ba993"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: hq_nbEe3EfS90e8Ws1VaPa_gTZkK.Rb7
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RagP9DdcljKd8UEbsqUimx0bgI2EmaqBXcuZ9LFL4qNs_fpDK-F8gQ==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 40 KB
12 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 5912199
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: d_Zv97zAl2vLK1w9CyBq4A3gop3bRPBOl54hjfxhwYCnbD-VwTeIUg==

GET
H2 200 24.51b9fb55.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 42 KB
12 KB 52ms
49ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.51b9fb55.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"cef2e36f386b30af63a3565f56cb570c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2YkFlG1sZ1uGuw9fRJhr_rduXEPaItbU
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1YROR0tfEfwKoqYWSyZrqkeV4pgzcqZkmnxMb08gGebHV4VKU6smRg==

GET
H2 200 18.df9af1cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 70 KB
21 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.df9af1cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"4dd1a4c39ef032a7370127a7a049792b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: h.C2zbsx58v1pJxunn7Ah5lgmrvqa1du
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: k7VsXqtk4jbix7JDQcMfG__8FYTZAPqnR9WJ_fOBPVBDjwZZbt9i8w==

GET
H2 200 30.d7884983.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 48 KB
15 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.d7884983.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 2929210
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"4e1b145be04e5bc76ea6d15f491a0174"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RQGg9Lzfff.JlTlK.NLmBXc6K0oL5gia
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WhnFebACpJU8Hn_37QMFWR9ojFmJXDpUMlKj48GYp04TcSkYnUqTPg==

GET
H2 200 17.01346f26.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 29 KB
8 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.01346f26.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"d881c1078c1983fec915bc6b6aa0deb9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DZAqQV.UJvsXxwZF6YiaFl2qyaLgaBjX
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 54FhP21nnzCZnAvCgE0aksONmY3rOTfcE1PGefjJlgdl_RyE9TgpnA==

GET
H2 200 19.96441b8b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 39 KB
10 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"854e298ba40cc0c37109059dacdab629"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zsW-Yih8tMchdV2wfZXB05GIszjrkV6GWARC_XD6tkCtCIhwWwl6qQ==

GET
H2 200 35.a8afab31.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 52 KB
18 KB 52ms
50ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:47:00 GMT
content-encoding: gzip
age: 2312230
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Mar 2021 19:15:02 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .G4l5M3zdEr.H9Ym7Vn1RjNno_gNBdpu
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Kx3ybE6lbJF6wkjPM4au2zRFf7oxfRD7Cj4y5-StSauKH8-mn4U3RQ==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 24 KB
10 KB 52ms
51ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:28:48 GMT
content-encoding: gzip
age: 2918123
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 16:50:21 GMT
server: nginx
etag: W/"185cc47f69cf9cfd71f532b15a0b6e8e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Sa1cQ5AXCSfvmijtq3l0XPcobRiPq9R0
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qRAlgd3t6Q8iTu2CClakaH5HdiLUITeOhPz7nO3UL0j6oyN2WNELTw==

GET
H2 200 13.dce07d58.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 60 KB
21 KB 52ms
51ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.dce07d58.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1098549
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"53cb1bc6a93f37cb23bd87c0969623e9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: B9qKAkZ_gCQFUK9XQjx8Tol3YM6NhFM1
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Y7CbAFrCSdAygyIk7CQDbUOdFup9xbO5iGoH92bLe5GKQhRCxjLVJQ==

GET
H2 200 main~493df0b3.40a201b4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 21 KB
7 KB 52ms
51ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.40a201b4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"69fb0eac23d360e99d09dc8ff2d9f962"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bSwH_75xAiofeTvLmJWwyVFlVbSGw1A9
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iTKxZLfN83h4ONYu3t1rGoq_1x9Vad56AEWUjy4lybih3sA7AxH--w==

GET
H2 200 main~970f9218.fe9024ab.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 63 KB
16 KB 53ms
51ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.fe9024ab.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"e5ee197ba311176a274dc6e7fee6e7f6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7P0jL99.Os6SrCjfRNCPbidx0BZ2SnmU
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hQuvyreI-fy3uhF-jO1dfycP4fSnOuCBoMWIEbGeTsR7URn2TMtYag==

GET
H2 200 main~89e24786.afbb2c59.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 62 KB
17 KB 52ms
52ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.afbb2c59.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"664d363329fb00cc74d058503814a7ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JcerQY68_yXSuUYCWk2Pjyd9PnG2n_nr
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UbJn3hjGYbYKVmXJMcBXqHUpxgmmQcHb7KOdZ19lzveJRzCYHShHtw==

GET
H2 200 main~53ca99a6.77730165.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 28 KB
9 KB 53ms
52ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.77730165.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

7dd95da50fded770bb16672861accc255de79b14a1a85492ddd11e86b91f4964

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:19 GMT
server: nginx
etag: W/"c1173f7ed3d0704ae8ba247c445a3d31"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KeZLjxHCOY4e5bBhd8p3S3cMpMO0t.xQ
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6HBL5A-CC3HgOtmoGrOQQ89Apm7dSg47RR8vmSph9b4qcnbywBGSrg==

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 6 KB
3 KB 28ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 5228042
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qLjrkPxFqcU4dkTUEev9jbsd6lMQz-8R2fPlilvQaogyM-g5tlX35w==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 107 KB
34 KB 28ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 5639701
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aBlw-3WO9p9N12QZrZKsEeoxcCJ49wxcIEeqR02f3QvY-faqzA9Deg==

GET
H2 200 27.fca79052.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 27 KB
9 KB 28ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.fca79052.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 2929210
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"778effaa1518bcdcddb080ef14f98e02"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FaSQOMF905756twg_WaxPLtYkgG28uFg
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5iDzfQ4o5pz1gSijuRg0noMFTL3wh96-ChzPWg9mcty-ngdMVgv-iQ==

GET
H2 200 31.3f86bbb6.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 2 KB
1 KB 29ms
29ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/31.3f86bbb6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"2c4cc154316ee9ade3012f13a2c1b2f5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: D08ovFtBYED.yu6DiCG0PnrMH4qOS5.j
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cK0QRErOu-4OG-aRdrAE21RXAStoy7USGIEIbN_6BdF04zgiufkvkw==

GET
H2 200 31.fc68d554.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 5 KB
2 KB 29ms
29ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/31.fc68d554.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

3bada64766a47b3e43fb09f497482ab4eed65c3f2fc516f318ea62feea3bd3fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"6e76b0c3f142cb51aa9b9e3675052cc1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sfQdTfB1nM6GN5tmZn1veVCVK3Nvu7Ad
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: e7T5bPjz8HnBuYW-V_ZHn2R3qpq_u09QK9-9PhPvZgB0hNBCEL4kJw==

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 6 KB
3 KB 26ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 5228042
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yO3APFSxhxXY18ZdO5XXlnUFMd2ERmjvdsPo7oQgpO2ZRDLI_sMC_Q==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 107 KB
34 KB 27ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 5639701
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EepEkXSjhF99kl0T3WgOSKxHMW6yaYLrw7tq3DmPSVSLAfVBOhVHkA==

GET
H2 200 27.fca79052.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 27 KB
9 KB 27ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.fca79052.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 2929210
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"778effaa1518bcdcddb080ef14f98e02"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FaSQOMF905756twg_WaxPLtYkgG28uFg
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: KLTDz349W69L9h_-OPcTeUZrVfCiHrY4_GRMlT1DX5HUpVeI3DcwNw==

GET
H2 200 31.3f86bbb6.chunk.css
js.driftt.com/core/assets/css/ Frame BB0D 2 KB
1 KB 28ms
27ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/31.3f86bbb6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"2c4cc154316ee9ade3012f13a2c1b2f5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: D08ovFtBYED.yu6DiCG0PnrMH4qOS5.j
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lqxqDhpIBEMYVglLp8HckvVYyHJGNGG9Guvr_dFCSNF8Iv9hmkbMFw==

GET
H2 200 31.fc68d554.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 5 KB
2 KB 28ms
28ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/31.fc68d554.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

3bada64766a47b3e43fb09f497482ab4eed65c3f2fc516f318ea62feea3bd3fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"6e76b0c3f142cb51aa9b9e3675052cc1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sfQdTfB1nM6GN5tmZn1veVCVK3Nvu7Ad
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: muPWMjrwxoFkHkcDxUwamGpjZOO0OLxIoC89uqu3hXnfaQ0hR1NEJw==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 17 KB
6 KB 27ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 4706970
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4rrIkcEdkkji14JUAeDHn1ekkw-gNEYi_o41xHWlfYQiT98yM-O3Aw==

GET
H2 200 32.e776e5b0.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 6 KB
1 KB 27ms
26ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.e776e5b0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"9f36443a9402e1e03bf8070ddc88b8db"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: N9pz_uaOqz_LcCJXwq2fP8udkLRQP9sW
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pa70L9o8pC4LcdfQ9yVn9YtpzqHm3aiyxLS-p41zpbsJhZsslcCNgg==

GET
H2 200 32.cfad6e60.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 2 KB
2 KB 27ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.cfad6e60.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

7ec343f7fca9ed1dbc2668d17a8d0147c50aec1aa64f2ee980f70b07dae86636

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"1fa8376c6a29751fe9b4d0666993a08d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: BpHgjxy3ZkW2JixQtvZXs5rIvB8KoyYT
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qV2QjSKj-3PmJMtm4gika9iu4t976odzoJc2GYGGxrPqXF9Bhrx6VA==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 17 KB
6 KB 26ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 4706970
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HwUg4TtZaU6y3IEsw9KZnfVIhKlQXZoSZOwTt9zwHQpI6dXSBSnFJw==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 68 KB
20 KB 27ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 5228503
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9iH4-lrgOI1_IkFajU0eoYyCAPwtbHfAgs63PqZRjLRmaik9BzkU7A==

GET
H2 200 28.973133ca.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 41 KB
12 KB 27ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.973133ca.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 20:53:07 GMT
content-encoding: gzip
age: 2826663
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Mar 2021 20:23:41 GMT
server: nginx
etag: W/"ecf99724b02f7b23e01b9717ae480786"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: TA00J8zYqpnkOZxchdfs_j6Px0w36iW5
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Bj__DDPJr_Z_OOeD_jNARMbOVe8EqzG5MOGF-sGEwJ-FDVq4kxsR_A==

GET
H2 200 2.775c793d.chunk.css
js.driftt.com/core/assets/css/ Frame BB0D 2 KB
1 KB 29ms
29ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.775c793d.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

8fb572ce1f6b6945872c63bef10ac2ae8ff616a444295e873c950f32a32e59c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"d62b021c3cb146b35b42d2753028a068"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: yt_Mp0e5UsBirQro5nfCD8rrRiAyJOQd
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: To-Xa4wZraZems-m4CCaME2VahgJkxFKJqdFLYP7kA4KoXEC7dJBZQ==

GET
H2 200 2.76142f45.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 27 KB
10 KB 29ms
29ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 15:57:00 GMT
content-encoding: gzip
age: 684431
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 30 Mar 2021 15:09:56 GMT
server: nginx
etag: W/"e418db8de1c2a6e2f3ff10bd84e11107"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: zbmshXq66aPkSIx6jZ4E08JKXtO0ykBo
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bGcxXlqt4pGvPmLEYc9UGuUw9BlrcuYnwMfvWEfLyIm5mSSbhOTyxA==

GET
H2 200 26.02e62d23.chunk.css
js.driftt.com/core/assets/css/ Frame BB0D 8 KB
2 KB 29ms
28ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/26.02e62d23.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 16:09:55 GMT
content-encoding: gzip
age: 1202056
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Mar 2021 15:54:56 GMT
server: nginx
etag: W/"4a7ea3158114815c3ce4a439e64bb20f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: grRYYHSSp1mU3ptY3c1ADwZbODEJ.GD2
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Lwc6Owb32LALT4tzT7qTGWJhES6G42PxdYs-VO8_0IX7oBOQur9ahA==

GET
H2 200 26.b28fcc1f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 68 KB
19 KB 30ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.b28fcc1f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

45c6471f9b8d9a882dc0997d5f2582e6be47dce98d963383521ab6b480b46a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"a965df5333777d7d38412493ddeb27f7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Et3fWJqlSsaH1UfzviBYLJKUWDVmkgJr
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: i4dM90im2zdL4HSa2wFBpVfGEs1sb4rupu1YIKYSDDFkE8UozAIqDQ==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 68 KB
20 KB 32ms
31ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 5228503
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1TyFB416jqn_XkV8IWB65IR82Vg2DCCe5E9zPgjC4qUThdbFZfH0AQ==

GET
H2 200 6.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 7 KB
2 KB 32ms
30ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/6.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 4W7j47FaGFn6zfjP8WI3XQH_pHab5cA8
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -HwxrwHIkbvFBWeneG0ypjRBfO5wxXioGLzYW3pDwS_6Wwcay2gzCQ==

GET
H2 200 6.8a170c54.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 38 KB
13 KB 32ms
30ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/6.8a170c54.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

49768b3da5cf97cb82a6f3db73097011454b7cce09529bff08c9decb23b80254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"ef7ecb5ffb6e97b627cffdd96eb98848"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LUrYItfzRfdEwKDAEgZAQj1eonofAAo7
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VQ7OelNEDxjmib3d0HUeCHYGI5Z8TEJsM-Ug6uyO-H-wix22c9tQPg==

GET
H2 200 5.39718cbd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 50 KB
14 KB 33ms
31ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.39718cbd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

b05c21426d9a2999f3f7b48d494bc6dba7b4fba240d3eae1047c99116c075232

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"22b4f20089aad6d0ac685e754c01e20c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: I8vDvAQu.ULzgfdeCA0aGGvdnMiGhc1j
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VunP5sgjEguG_T1lyGB08Z09VVX4c5kri-L4I8TeKfdMlmRPJfZpcg==

GET
H2 200 2.775c793d.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 2 KB
1 KB 31ms
30ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.775c793d.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

8fb572ce1f6b6945872c63bef10ac2ae8ff616a444295e873c950f32a32e59c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"d62b021c3cb146b35b42d2753028a068"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: yt_Mp0e5UsBirQro5nfCD8rrRiAyJOQd
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PptEdxmReGn1w8EMWa426-Be8S80x4r68UkN2YqBL2OKHG22VKpebQ==

GET
H2 200 2.76142f45.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 27 KB
10 KB 32ms
31ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 15:57:00 GMT
content-encoding: gzip
age: 684431
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 30 Mar 2021 15:09:56 GMT
server: nginx
etag: W/"e418db8de1c2a6e2f3ff10bd84e11107"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: zbmshXq66aPkSIx6jZ4E08JKXtO0ykBo
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0KPC5OEYtE0dcfxmSmCn236MFaYvxiZMq50iqTMBhzQU87Cs3h-NjQ==

GET
H2 200 7.e10c6f40.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 14 KB
3 KB 32ms
31ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/7.e10c6f40.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

4ab346b1d21f307629c9836a9f640965a400ab887fa4963417b6f301255267be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:15 GMT
server: nginx
etag: W/"b3b5cd1d956e79a0f86d75a757a6c5f9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RiBkwgpYu336J2HKpCThKsrWlCT.X0Et
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: X9AM9svMQgDkyl4FwEsgITubBg8F3ss6YL-UvF4MDZFsNxy1ykl0yA==

GET
H2 200 7.062288d8.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 15 KB
6 KB 29ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/7.062288d8.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

d29ed5acf4e8847d8fc78fa935811e3411f26fd92c7d2684426763d44baba531

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 330
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:18 GMT
server: nginx
etag: W/"36c9901dcb57cdaa85a9c58b4019729d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: n3IQEHdi3wD572HZmiSNAYOWBJo_3MFN
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vQiQQNGTIkE3KlOrOhMUJjtkiNaJ112b_mCCRzB-ce2AWyRIpGTFfA==

GET
H2 200 4.e5e2545a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 20 KB
8 KB 29ms
27ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.e5e2545a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

98a3d9270823f352c29bdf42e76166b1700adbee258b1ead079bd58a72806e96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"69db2892d35f13904165a59c38ddf124"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: r1_GSayKMVXjL1JhIFbefRE4YJdogXZs
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qFuIfgEkS_KRKIoyCat_a4RUfAaEIzBqPhUeOD9IqzrT5YT_Eu-BRA==

GET
H2 200 3.a77ffcb8.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 36 KB
7 KB 31ms
30ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.a77ffcb8.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

b44559f438094bfb585d8c8401a7f8f8fc3db5c00f6bc1eeceb0c74ec74809fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 329
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:15 GMT
server: nginx
etag: W/"d6fe3f9924893c56f7b7857702e3e02b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9feSQA.DxBRXHRaWJn0r1_p.jJ0e4fVY
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: fk7hbspmK8G2B9tqa9M-GpNOiRcHkI2SCVl0rwROXKT4UM148w11Bg==

GET
H2 200 3.95faf3f5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 69 KB
21 KB 30ms
28ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.95faf3f5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

fbd58020016361b4221dcadd69699df2f163ae097b5c44e35ec6c0c2f6201148

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 73869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"2e809b213a922cd4b68668df620d914c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: aAsuoiQFZAx7pkY.FAwQmiQ2ql4FM2yR
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3Be7QpZqijC-MiM7ZnrD9mAjYKZ_a6ro030utOXHNLPkxui_FQJQnA==

GET
H2 200 22.364adea2.chunk.css
js.driftt.com/core/assets/css/ Frame A9AD 17 KB
3 KB 32ms
31ms Stylesheet
text/css 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/22.364adea2.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

78c6ffd12098a22a7685a700e71b7e7e73cec2d55d770a667eb60a4d937fa972

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1098548
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"4a03f3b3e6ec6635468f55189cd9f6be"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VAkJO1xHnPSYVwtOxadfNJPO0zY7mGu7
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0c1sXEnajXvLR9JKaXqsM0-YjY_H-h4p53rlSfk4NcEgGH7XjTU5SQ==

GET
H2 200 22.6d760e29.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 27 KB
9 KB 31ms
28ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6d760e29.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

b696f1acce2adb2cd7f45d0947e54fc052b524d5323f826473887c2d85968683

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Apr 2021 13:06:31 GMT
content-encoding: gzip
age: 435461
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 01 Apr 2021 19:08:15 GMT
server: nginx
etag: W/"7b946524d7cb8f26bbcda2f3e5eddcf4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6.e1ISFW7Q2Ky8.MgnInjgDqrPgTGi25
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xeOhDqfCqzyXmw7Gga1LHEV_tp4Jl6N67P8h0ENl_DQPuLHiUYTKsg==

OPTIONS
H/1.1 200
OK v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 453ms
115ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:12 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftac0a47a4ece97ea3f720684b309
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

GET
H2 200 28krvx2uf9n3.json Show response
embeds.driftcdn.com/embeds/ Frame BB0D 128 KB
22 KB 480ms
418ms XHR
application/json 52.222.179.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embeds.driftcdn.com/embeds/28krvx2uf9n3.json
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.179.58 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-179-58.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ec0654ba9eaf36ed77d4154393565cca7cd00a4e7421f9a971ad04b606f3fc73

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 12:54:02 GMT
server: AmazonS3
etag: W/"0a635797490b470c5aedca575ad14b67"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=UTF-8
via: 1.1 a6e1678aced1951bb094538ec62256f5.cloudfront.net (CloudFront)
cache-control: public, max-age=30
x-amz-cf-id: gsaWwFdsFlmPlFYG8bzb2kCZe7LQKu_yW1mPPjYwATvDo3H7UlGfyQ==

POST
H/1.1 200
OK v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame BB0D 25 B
696 B 149ms
149ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:12 GMT
server: istio-envoy
requestid: 35526c7a5e320ca
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 37
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 72 B
533 B 113ms
113ms Script
text/html 35.174.151.106
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&url=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.151.106 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: pi0-lba1-4-ue1.aws.pardot.com
Software: PardotServer /
Resource Hash: d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Wed, 07 Apr 2021 14:04:12 GMT
Content-Encoding: gzip
X-Pardot-Route: d5a18e4517a9c8ba62b77de366a4cdb5
X-Pardot-LB: a5df88223e39cf9fcb783877fed82f24
Server: PardotServer
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=63072000
Content-Length: 89
Expires: Fri, 07 Apr 2023 14:04:12 GMT

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame BB0D 17 KB
6 KB 26ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=838bddd5-8f57-4b39-8050-3c1d541c8ec6&sessionStarted=1617804251&campaignRefreshToken=d56e6c30-6a83-4210-8fa7-314f03dfc53f&hideController=false&pageLoadStartTime=1617804249931
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 5059358
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Xtjhah-1Cho1TwCEJP6jIuh4Op5UyDK2pkwwonAO4Ipe_Ek7E4e46A==

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame BB0D 5 KB
3 KB 812ms
580ms XHR
application/json 18.215.11.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.215.11.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-215-11-20.compute-1.amazonaws.com

Software

Resource Hash

9ce98a5974148994a1fd1dcaf54f1c73a06e9b6b592dd5661fecb65df48c8225

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
content-encoding: gzip
requestid: e1529306dc07ffca
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2103
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 28krvx2uf9n3
targeting.api.drift.com/hours/availability/combined/ Frame 0
0 341ms
112ms Preflight
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Protocol

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: HEAD,GET,OPTIONS
requestid: drift298257a4e5597db75b3032cdaef

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 321ms
104ms Preflight
text/plain 52.0.189.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Server

52.0.189.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-189-149.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift6bb9d604ae7ba0e1a90b0fa299f

GET
H2 200 28krvx2uf9n3 Show response
targeting.api.drift.com/hours/availability/combined/ Frame BB0D 46 B
490 B 138ms
137ms XHR
application/json 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

d0f78359816f160593648991009f3b2799922d1199b82232b8b73911b221650a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
requestid: 9c9644a5c2647796
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 46
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H2 200 css
fonts.googleapis.com/ Frame BB0D 4 KB
739 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 13:45:43 GMT
server: ESF
date: Wed, 07 Apr 2021 14:04:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Apr 2021 14:04:13 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame BB0D 609 B
1 KB 107ms
107ms XHR
application/json 52.0.189.149
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.0.189.149 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-0-189-149.compute-1.amazonaws.com

Software

Resource Hash

aa5cdfe16f85324a2ccbcddc5d59a92da3595b1b5d11e7de0476327ddb232ba5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:13 GMT
requestid: 2b598500f6c7d79
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 609

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame A9AD 17 KB
6 KB 26ms
26ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f44d8ad4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 5059359
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: LrP0XzdnrHYMPV6PU9x-uToCw3s4j54AqvU2cwOKTm-10Fbqq13quA==

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame A9AD 4 KB
1 KB 43ms
28ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 07 Apr 2021 13:36:52 GMT
server: ESF
date: Wed, 07 Apr 2021 14:04:13 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 07 Apr 2021 14:04:13 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ Frame A9AD 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:22 GMT
server: sffe
age: 446436
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Sat, 02 Apr 2022 10:03:37 GMT

GET
H3-Q050 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ Frame A9AD 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:00 GMT
server: sffe
age: 446436
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15056
x-xss-protection: 0
expires: Sat, 02 Apr 2022 10:03:37 GMT

OPTIONS
H2 200 evaluate_with_log
targeting.api.drift.com/targeting/ Frame 0
0 113ms
112ms Preflight
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Protocol

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: driftdcdc007478bb5121ed7f0bdc1c9

POST
H2 200 evaluate_with_log Show response
targeting.api.drift.com/targeting/ Frame BB0D 2 KB
1 KB 117ms
117ms XHR
application/json 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/targeting/evaluate_with_log

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

ab97721bba7236bb5040fdd96abb88d69182bd3b9b7d59c2beb50298688b3941

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
content-encoding: gzip
requestid: 4802ac044be887f7
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 703
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK render_initial
flow.api.drift.com/flows/ Frame 0
0 475ms
111ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift113fa2c49ddbf30015564de47bf
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

POST
H/1.1 200
OK render_initial Show response
flow.api.drift.com/flows/ Frame BB0D 4 KB
3 KB 159ms
159ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://flow.api.drift.com/flows/render_initial

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

660717e8d86e9a4dade206addd331b964f9dd10b249633bda47d6b84a8723970

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
content-encoding: gzip
server: istio-envoy
requestid: b186fe26018ba449
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 34
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2024
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0
0 113ms
113ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drifte27eabd4c54bf388eec63006c66
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/event2/ Frame BB0D 25 B
697 B 142ms
141ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
server: istio-envoy
requestid: 4a7e43d1da59e9dd
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

POST
H2 204 widget Show response
targeting.api.drift.com/impressions/ Frame BB0D 0
381 B 119ms
119ms XHR
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:15 GMT
requestid: 3f1728240ed60727
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 widget
targeting.api.drift.com/impressions/ Frame 0
0 113ms
113ms Preflight
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/impressions/widget

Protocol

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: drift318b58e426ca84224abf7ab36c2

GET
H2 200 https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2106400%252F13690614ba4dc30e40747e74e1535a5adzn4mi89fik3%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w...
driftt.imgix.net/ Frame BB0D 26 KB
26 KB 28ms
10ms Image
image/png 2a04:4e42:1b::720
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.amazonaws.com%252Fcustomer-api-avatars-prod%252F2106400%252F13690614ba4dc30e40747e74e1535a5adzn4mi89fik3%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3D3d628948700c6adffa763ed302d1aec1?fit=max&fm=png&h=200&w=200&s=b89b9dce21f66015eedf860da053c36f

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a04:4e42:1b::720 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

imgix /

Resource Hash

11a41838971be0f75a5c082cfc1d6a648846a20140750a0f616e239e4f97b3f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 14:04:14 GMT
x-content-type-options: nosniff
fastly-restarts: 1
last-modified: Sat, 20 Mar 2021 21:37:02 GMT
server: imgix
age: 1528033
x-cache: MISS, HIT, HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=315360000
x-imgix-id: ea88f1605f001b47232c070f4613f6f5019f71c8
accept-ranges: bytes
content-length: 26435
x-served-by: cache-sjc10051-SJC, cache-sjc10082-SJC, cache-hhn4023-HHN

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ Frame BB0D 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 02 Apr 2021 10:03:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:22 GMT
server: sffe
age: 446437
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Sat, 02 Apr 2022 10:03:37 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
204 B 13ms
13ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j89&aip=1&a=238647248&t=event&ni=1&_s=1&dl=https%3A%2F%2Fcofense.com%2Fblog%2Fautohotkey-banking-trojan%2F&ul=en-us&de=UTF-8&dt=AutoHotKey%20Leveraged%20by%20Metamorfo%2FMekotio%20Banking%20Trojans&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Drift%20Widget&ea=Playbook%20Fired&el=Playbook%20ID%3A%202216778&_u=aHDAAUADQAAAAG~&jid=1634840399&gjid=1237853410&cid=1893042670.1617804250&tid=UA-114787942-1&_gid=380478613.1617804250&_r=1&gtm=2wg3v05RQ37KH&z=715754829

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 23ms
23ms XHR
text/plain 2a00:1450:400c:c0b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=1634840399&gjid=1237853410&_gid=380478613.1617804250&_u=aHDAAUADQAAAAG~&z=19948371

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 07 Apr 2021 14:04:14 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 32ms
31ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=1634840399&_u=aHDAAUADQAAAAG~&z=1800541254

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 32ms
31ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1893042670.1617804250&jid=1634840399&_u=aHDAAUADQAAAAG~&z=1800541254

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 07 Apr 2021 14:04:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4.7e67eece.chunk.js Show response
js.driftt.com/conductor/assets/ 158 B
820 B 26ms
25ms Script
application/javascript 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/4.7e67eece.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1617804300000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

7060ccc4a800448d37027d5c6beb0084ad19061feb48a523e29ea1b7dbc1ae3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 22 Mar 2021 14:41:19 GMT
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
age: 1380176
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 158
last-modified: Mon, 22 Mar 2021 14:08:22 GMT
server: nginx
etag: "807a90e9d6c19e174f5905b1d130989a"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2OKAPOEBwmfC7ciZWi3f2oC9TZifZTh1
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pFmT0duTril0yDqxxRE-ulnGL_ZoOMMjL3RygeTbXngd6iJXiz-F3Q==

GET
H2 206 notification.d46d7db1.mp3
js.driftt.com/conductor/assets/media/ 20 KB
21 KB 27ms
26ms Media
audio/mpeg 54.192.210.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/conductor/assets/media/notification.d46d7db1.mp3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.192.210.122 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-192-210-122.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=0-

Response headers

date: Thu, 11 Mar 2021 22:01:41 GMT
via: 1.1 e0b7b5b5acbaaf300b6a25ae8c1035a9.cloudfront.net (CloudFront)
age: 2304154
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
Content-Range: bytes 0-20896/20897
Content-Length: 20897
last-modified: Thu, 11 Mar 2021 21:29:39 GMT
server: nginx
etag: "d46d7db110874da77e094dcbc4bec8e6"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Qw4ohBG6iBhPX0HyTJ2OV8nxTFBd8zR_
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: audio/mpeg
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RJvTUpZaSnO2v6LD71mHn6VmSuhv6foSzobwgmFg5M0tLkaFoNuLXw==

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/add/ Frame BB0D 25 B
696 B 113ms
113ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjI4Nzg4MzgwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTM0MDI1MywiaWF0IjoxNjE3ODA0MjUzfQ.qyxeNsic6-iBc6bmQfesHiE1tX-ftfepyBXv8H2HPr1JwVSfP_hMXAWR9pfH2Q40u5kPBPKMdhW8y6JrSsNC5w
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 07 Apr 2021 14:04:17 GMT
server: istio-envoy
requestid: 440de619210124ee
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 0
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 0
0 111ms
111ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 07 Apr 2021 14:04:17 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftef6a881451abb5163a95cb3cb8b
content-length: 13
x-envoy-upstream-service-time: 0
server: istio-envoy

Verdicts & Comments Add Verdict or Comment

251 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.app-ab46.marketo.com/	1970-01-19 17:23:26	Name: __cf_bm Value: 28bc4150ec1a3f1d34ca8a9605ee675ee93edcbb-1617804250-1800-AZ7RHWt6V/pqK+nJWWD0/u6Eg7zpqNXNirguQwh2ONGj9Pe5LgcDYcKs9uYWcCn6+scJCdhYr7jO7TCMtQBQCII=
.cofense.com/	1970-01-19 19:33:00	Name: _fbp Value: fb.1.1617804251193.1798826306
.cofense.com/	1970-01-20 02:09:00	Name: __ar_v4 Value: %7CTFV7KNIV3VHWLJ6GAQ3KFT%3A20210407%3A1%7CJLU6TD3D6FA2JAELGSQWLD%3A20210407%3A1%7CLZCH7AGKEBFGLOFOIHTG7Q%3A20210407%3A1
.cofense.com/	1970-01-19 17:23:26	Name: _hjFirstSeen Value: 1
.cofense.com/	1970-01-19 17:23:26	Name: attr_last Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fautohotkey-banking-trojan%2F%22%2C%22date%22%3A%222021-04-7%22%2C%22timestamp%22%3A1617804249552%7D
.cofense.com/	1970-01-20 02:09:21	Name: __adroll_fpc Value: 2eb15c5d5097434e6fd662eacd903845-1617804250984
.cofense.com/	1970-01-20 02:09:00	Name: _hjid Value: b8b282f0-47c1-4cf7-81d2-cc475bebf14a
.cofense.com/	1970-01-20 10:54:36	Name: _ga Value: GA1.2.1893042670.1617804250
.cofense.com/	1970-01-19 17:23:24	Name: _dc_gtm_UA-114787942-1 Value: 1
.cofense.com/	1970-01-19 18:56:09	Name: _gaexp Value: GAX1.2.Y916st7_TUq9exzEKHDaPA.18789.0
.cofense.com/	1970-01-19 19:33:00	Name: _gcl_au Value: 1.1.1312678943.1617804249
.cofense.com/	1970-01-20 10:54:36	Name: _ga_0HTW6C6HJS Value: GS1.1.1617804249.1.0.1617804249.0
cofense.com/	1970-01-19 17:23:26	Name: drift_campaign_refresh Value: d56e6c30-6a83-4210-8fa7-314f03dfc53f
.cofense.com/	1970-01-19 17:24:50	Name: _gid Value: GA1.2.380478613.1617804250
.cofense.com/	1970-01-20 10:54:36	Name: attr_first Value: %7B%22source%22%3A%22(direct)%22%2C%22medium%22%3A%22(none)%22%2C%22campaign%22%3A%22(not%20set)%22%2C%22term%22%3A%22(not%20provided)%22%2C%22content%22%3A%22(not%20set)%22%2C%22lp%22%3A%22cofense.com%2Fblog%2Fautohotkey-banking-trojan%2F%22%2C%22date%22%3A%222021-04-7%22%2C%22timestamp%22%3A1617804249552%7D

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 23) Message: JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: jQuery.fn.load() is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: 'ready' event is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.yahoo.com
analytics.shareaholic.com
analytics.twitter.com
app-ab46.marketo.com
bootstrap.api.drift.com
cdn.iubenda.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cofense.com
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
driftt.imgix.net
dsms0mj1bbhn4.cloudfront.net
dsum-sec.casalemedia.com
eb2.3lift.com
embeds.driftcdn.com
event.api.drift.com
flow.api.drift.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hits-i.iubenda.com
ib.adnxs.com
js.driftt.com
lltrck.com
m9m6e2w5.stackpathcdn.com
metrics.api.drift.com
munchkin.marketo.net
partner.shareaholic.com
pi.pardot.com
pixel.advertising.com
pixel.rubiconproject.com
px.ads.linkedin.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
s.adroll.com
script.hotjar.com
simage2.pubmatic.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
t.sf14g.com
targeting.api.drift.com
us-u.openx.net
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.iubenda.com
www.linkedin.com
www.shareaholic.net
x.bidswitch.net
104.108.144.126
104.108.145.8
104.111.214.240
104.111.234.67
104.16.95.80
104.244.42.197
104.244.42.3
107.20.140.231
108.161.188.228
141.226.228.48
142.250.185.66
142.250.74.194
151.101.12.157
151.139.128.11
178.62.192.243
18.184.39.197
18.215.11.20
184.73.100.94
185.33.221.13
185.64.190.80
23.111.9.35
2600:9000:2093:d200:c:d51b:4400:21
2606:4700::6810:125e
2606:4700::6810:a852
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2a00:1288:80:800::7001
2a00:1450:4001:800::200e
2a00:1450:4001:803::2003
2a00:1450:4001:809::2008
2a00:1450:4001:80e::200a
2a00:1450:4001:810::2003
2a00:1450:4001:813::2002
2a00:1450:4001:82a::2004
2a00:1450:400c:c0b::9a
2a02:26f0:7100:191::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:1b::720
3.220.33.83
3.248.28.111
34.204.215.213
35.156.106.231
35.174.151.106
35.188.168.180
35.244.159.8
50.16.7.188
52.0.189.149
52.222.179.58
52.44.242.176
52.58.55.232
54.147.47.240
54.192.210.122
54.192.210.20
54.192.210.44
54.230.183.9
54.74.23.153
69.173.144.138
70.42.32.127
00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e
014bdcd85899b1e128d977bbb8f899d6c9623e68cfb63b3a637d39f61ff01ff5
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
026c031ea4bf0b31b0819e6576940574507c6293d8dc6c8200363b54ac7030a8
02ccdd095156565fe6098cef9a1918b92e86dc6023b22fdcb27a2eef3a330482
03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
0f73cdb5b4ff4fc3339c1d8ddcdf35ea878691e8c33a0a299676f2b0352bb8e7
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11a41838971be0f75a5c082cfc1d6a648846a20140750a0f616e239e4f97b3f6
122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a
12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149
12e64cd0ed369a4af602eee3f09ad619369e3ebb2376a2a29c4843ac72dd0c6a
1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126
19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121
1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3
1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83
1d355d2a4e8ff0e3eba6acd9b35c7972985fa371cbff6b3ba72d9735e04c057b
201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0
21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f
22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87
2a42cc82f30fbf25a268f6d5a10158e8312a838222da6847158ea4175fa289d4
2be49977c527343c796a571fd55041417c2f19cfbdf4558611df64c065a23478
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be
2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175
2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
355bd04dd9add083f79f4f7a2313ec94361614ee26e08a043d987c243bc8e61e
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978
3bada64766a47b3e43fb09f497482ab4eed65c3f2fc516f318ea62feea3bd3fd
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3ca275e3abc25d28d1687290d7022fbdc1dbc65897a57edf625612becc7cd4cd
43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b
455273a089f02f97923d6614e596567ab375c77a516f0ec7ee263c925a847481
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
45c6471f9b8d9a882dc0997d5f2582e6be47dce98d963383521ab6b480b46a31
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2
477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d
486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33
49768b3da5cf97cb82a6f3db73097011454b7cce09529bff08c9decb23b80254
4ab346b1d21f307629c9836a9f640965a400ab887fa4963417b6f301255267be
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545
50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7
523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37
539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1
53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea
5430d6fe02af3c64feb8afbc260c7aceb1204fa869aa422f421f7d921dd382ea
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd
578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf
5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5ced7308fef1e27867127d1b3b5c0e8ac2dab7eb139d75daad0ec71b891ba2ce
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
5ec2c7c341db456f2c057a73bdcc82be478efc0834741036198d9589765af6a2
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276
65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131
660717e8d86e9a4dade206addd331b964f9dd10b249633bda47d6b84a8723970
67e0dec4a7a856e51c4bc5cfb2dd7a71b06ea2e935cb38d46b3014041d37fa3c
6836c6fe662385fd0e8f2b6f8b09b3b3d437dc540da4104ae0b462b6ecdae99d
6b171db7ca7ffee17e14f5d432d37e4ec87d6e7a5ce361670e329f705ee34364
6b251fb950a81e0947386320b408ba05a9cd60ef73329331502aa4adfb171e37
7060ccc4a800448d37027d5c6beb0084ad19061feb48a523e29ea1b7dbc1ae3b
708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c
70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
734976c4bb5a252fb49c7380c9b1dca1d36d2c14462716ab6c5f5a732637c82a
7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc
737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1
73952cc80c6ea36f277133e6aad1b4257fc9b4ac776643b70e7e882a2854b42d
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
7742176d36a9ea889f4db0a843e62f522ba690a8d514e91dd5aa09eccf7340ce
78c6ffd12098a22a7685a700e71b7e7e73cec2d55d770a667eb60a4d937fa972
7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766
7dd95da50fded770bb16672861accc255de79b14a1a85492ddd11e86b91f4964
7ec343f7fca9ed1dbc2668d17a8d0147c50aec1aa64f2ee980f70b07dae86636
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410
817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86cc35989be655e6cbe68540cf835dec34388862a948fbd05850100797c32319
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
88bb8f201b753bea7a809832098ed1062a54d74d26aff22742d34b9e18f8b059
89ab8d06c38cc33f4799bd4741d73b45c34bea92671595eda701ff86d9f1e63d
8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
8d9a46db80c58e316c5594342e8e62bb792d4706ae90d02e4af8a03218335117
8f6cb97a416cbccfc8a63fc286d439ecab3a3e1465955337603322f0906c2132
8fb572ce1f6b6945872c63bef10ac2ae8ff616a444295e873c950f32a32e59c8
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
931da3899d3ec2f4b3893db69089c4a990b2ea6a9c27c60fcaa640f6666a03ce
932a2989a52c2d3cd76fa9846de75adde5222be99538a8ae48fd75a55ae19565
93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822
938fefbc4f39e13fa1d382e19d72864b406f82f201df9d0376910adf439db117
9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf
969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd
98a3d9270823f352c29bdf42e76166b1700adbee258b1ead079bd58a72806e96
98e89f927a0dd5f4fcb92a9f4a08b7d3ba87d95f4964fc0a213cfbf31029d5bc
9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
9ce98a5974148994a1fd1dcaf54f1c73a06e9b6b592dd5661fecb65df48c8225
a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
aa5cdfe16f85324a2ccbcddc5d59a92da3595b1b5d11e7de0476327ddb232ba5
ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2
ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4
ab97721bba7236bb5040fdd96abb88d69182bd3b9b7d59c2beb50298688b3941
abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad80ac33ed04b4e6d78167b4162ecd3d2e8c29d17b43eb3df1f35b216b2ac5c5
af71da6e0b8871d0806f440e932cb3b99706330fa4306e8becc7cbf2c7860c4d
af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c
b05c21426d9a2999f3f7b48d494bc6dba7b4fba240d3eae1047c99116c075232
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b44559f438094bfb585d8c8401a7f8f8fc3db5c00f6bc1eeceb0c74ec74809fc
b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e
b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29
b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229
b696f1acce2adb2cd7f45d0947e54fc052b524d5323f826473887c2d85968683
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
bda72c6918f7fa2683b5172f4192480b7808d79070e9e1dfc6eced0245e0a404
be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7
c346378eecdbc49f1af4027e1782ccfcf6daed7c02125d0c3efa715ae8273157
c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d
c55c8751dbcb177cef9a5fd0b35d7bc18237574724c5e27432da0d857d0b0a49
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cd3601b2f79f3cccc6333afba636cc8e645f7703257326df7df02497dc09d2df
ce0866099ca449f69ca05bcb83cec88645bfabfa99232147fc2ae45ea804708e
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d0f78359816f160593648991009f3b2799922d1199b82232b8b73911b221650a
d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5
d29ed5acf4e8847d8fc78fa935811e3411f26fd92c7d2684426763d44baba531
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4
d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858
d53d2be00a4528f66c74e090ff517d270fef7a9698d462ea122a1c58c75259a5
d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
dabbb72e22cb1b6b46076eb52af87040bc18bcc082060fc20a86250896da0414
db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc
dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
decb22061966d60e11818d21d2ac0a8886bf6908c98c9f3253546fc7697fbfc5
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275
dff95065f38a434e84c6e9cfff039fc30f6981fc1b91f139fd6bace0dfe7ca61
e0377c505a7d560f42802298baa2f3aacb7903203ab235af12a055c558f9ba19
e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60
e6f24078660b09ece82cb18154ca70658e05e25be808029dd09c22668676a7fd
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
ec0654ba9eaf36ed77d4154393565cca7cd00a4e7421f9a971ad04b606f3fc73
ecfec6edd361b81190425a403385fb537c339984464c26413437ef7dc551a0a3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0cd273dd31151f7c238927161bba7c45f7a62a762c33b179b69c8a44205825a
f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7
f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c
f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723
faac6b9031d79a3f00c6f066e1123f99cc6c9db4de3c7f5606c7009fdce481fa
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
fbd58020016361b4221dcadd69699df2f163ae097b5c44e35ec6c0c2f6201148
fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69
fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45
fe245ebf501ed020b82e52d76e07551f8ee4bca927483c457b97d3a8a69760a3
fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40
ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

268 Requests

100 %HTTPS

31 %IPv6

48 Domains

61 Subdomains

57 IPs

6 Countries

5360 kBTransfer

13923 kBSize

15 Cookies

16 Outgoing links

Redirected requests

268 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 18 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

268
Requests

100 %
HTTPS

31 %
IPv6

48
Domains

61
Subdomains

57
IPs

6
Countries

5360 kB
Transfer

13923 kB
Size

15
Cookies

268 HTTP transactions
18 data transactions