redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

10 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=8332155226849724931

Request Chain 89

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1673023783819%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fdetecting-sharepoint-attacks-via-worker-process-activity%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&liSync=true&e_ipv6=AQIrfXG2fzywTQAAAYWH_QV9PQHE3wI7-dxKEu5JJTuygot2VQWlMZM7xiK4QJZ6HDZhLQ

110 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
13 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/	4 MB 220 KB	933ms 713ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash cf1b83226a4e32b1ff28a299a0c07430a1c3567484ab1cc556cc6e0a6dbfb034 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-US,en;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Fri, 06 Jan 2023 16:49:41 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=18923>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding x-cache MISS x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.1/	88 KB 31 KB	207ms 64ms	Script text/javascript	2607:f8b0:4006:807::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:807::200a Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Wed, 04 Jan 2023 20:50:33 GMT content-encoding gzip x-content-type-options nosniff age 158349 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31100 x-xss-protection 0 last-modified Thu, 08 Sep 2022 18:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 04 Jan 2024 20:50:33 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	208 KB 69 KB	158ms 46ms	Script application/x-javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 543 etag "2d8057b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7855f2cf0dd56ddd-MIA expires Fri, 06 Jan 2023 20:49:42 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	153ms 35ms	Script application/x-javascript	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mic/9AE2) / Resource Hash 3511de47d3250e54206caa8bfd8b2401d7ae512f821258d06a52d5e9584690f9 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip last-modified Thu, 05 Jan 2023 17:06:00 GMT server ECS (mic/9AE2) age 64793 etag "b3321dfc2721d91:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32316
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	6 KB 2 KB	162ms 59ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b944086ceb975b223f03d7c7a7564877a1034b35378ae07866771f2ab4f9cbe6 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip cf-cache-status HIT age 555 cf-polished origSize=6088 ce-version 11.5.16 cf-bgj minify last-modified Fri, 06 Jan 2023 16:40:27 GMT server cloudflare vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 7855f2d29a5a67b6-MIA
GET H2	200	js Show response www.googletagmanager.com/gtag/	228 KB 79 KB	228ms 85ms	Script application/javascript	2607:f8b0:4006:81d::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81d::2008 Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2f6b4f2283cb71863e24088e1a09c6ae72de54a09bb8166ff59d908cd75ac6a0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 80880 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Fri, 06 Jan 2023 16:49:42 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	232ms 82ms	Stylesheet text/css	2607:f8b0:4006:823::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:823::200a Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c89486a0c4b8c91529d5d3e2ce14f8501c467c13b3e571f613e1932590279bf9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Fri, 06 Jan 2023 16:49:42 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 06 Jan 2023 16:49:42 GMT
GET H2	200	qualified.js Show response js.qualified.com/	196 KB 61 KB	134ms 42ms	Script text/javascript	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 767fe5e5668a309ea20d41911f5a2fd022998a73f208a226f5dfdf14dd54062e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip via 1.1 spaces-router (e13668ca8eb7) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status HIT x-content-type-options nosniff x-permitted-cross-domain-policies none age 45973 x-xss-protection 1; mode=block x-request-id 943cc25c-5bfd-6654-18d0-230ab4b4b422 x-runtime 0.017675 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"f20a999c736b150e3dd8eb534e643313" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 7855f2d28b7b6ddd-MIA expires Fri, 06 Jan 2023 20:49:42 GMT
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	3 KB 1 KB	317ms 146ms	Script application/javascript	2600:9000:21dd:9800:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21dd:9800:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash d3afb61225cf41fb7e950369d6097cd1457b283b333100a0952aed1efdf62f78 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 081adfb0526af4d4162283117d917418.cloudfront.net (CloudFront) server envoy x-amz-cf-pop EWR53-C2 etag W/"7a0c9912f0babd17cf2b2081b4f7f3f7" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id M4Kkt6TpBINgMAU_aJiq8gLU7trk69IC_ektRr1pdR9yN2vCShj6Tg==
GET H2	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 611 B	127ms 53ms	Stylesheet text/css	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 19511886 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 271 last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-2fb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l2D%2BajDOpTAbyuz5yShOunKoYbRmucs%2FhT%2FoC87a6b0zKBIRBCRkTddjWh4mkQfCHF6TvNqEDCoxek87qfYtk6U9nEdQI2iGG15%2F1pbJbGoD5Tc6syEuoYGZLA%2BhU50Xus4870Htg75%2F%2Fm%2F6eYAiDFGX"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7855f2d00a55029b-MIA expires Wed, 27 Dec 2023 16:49:42 GMT
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	117ms 43ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 14067767 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 33250 last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-20801" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G6zpquq1J8JbaB2QwqEaDof5ieEZvDlK5cuweKmwwG%2BqSkC7pmV8NYJYSmzRQKXLU1CCFwlmPA3wY%2FNKPCyV2SWrj4VKR0LON8Au0nTDAEnlCQ14AybfLfMNMFHjbHryZqMuWVfGmid3bIkUNq%2BkPS3P"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7855f2d00a57029b-MIA expires Wed, 27 Dec 2023 16:49:42 GMT
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	355ms 123ms	Script application/x-js	52.218.229.0 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.218.229.0 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Server AmazonS3 x-amz-request-id TXQPDE322D86JK27 ETag "bab0c2b3523f8244564b675fe34db610" Content-Type application/x-js Cache-Control public Accept-Ranges bytes Content-Length 41617 x-amz-id-2 F1RVHlJ/0uDU+9F5G6ntU7sMmJ6SFqxEkcTC8QNLOX8uR6YOC58FLA3YHPqZdFiTKYjDXyAinl0=
GET H2	200	autoptimize_3074cc154d59b86167832e47a794beb1.js Show response redcanary.com/wp-content/cache/autoptimize/js/	295 KB 84 KB	82ms 79ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_3074cc154d59b86167832e47a794beb1.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c68e7883087b31afe16d1b095644182e84f8228f0b6f60289b6072c00697ec22 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests content-encoding br last-modified Thu, 05 Jan 2023 21:58:45 GMT server nginx etag W/"63b74815-49c02" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	235ms 68ms	Script application/x-javascript	104.102.141.31 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.141.31 Edison, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-141-31.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:42 GMT Content-Encoding gzip Last-Modified Fri, 09 Sep 2022 01:18:39 GMT Server AkamaiNetStorage ETag "92b41a298690c047b0c4602dd843cba4:1662686319.691662" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Length 728
GET H2	200	gtm.js Show response www.googletagmanager.com/	269 KB 90 KB	341ms 200ms	Script application/javascript	2607:f8b0:4006:81d::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81d::2008 Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c1e69f1b1163f8aa24b8d385435141ed317aeea0c19edc5c02bdec0e648fbb09 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 91991 x-xss-protection 0 last-modified Fri, 06 Jan 2023 15:47:37 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 06 Jan 2023 16:49:42 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	31 KB 10 KB	190ms 49ms	Script application/javascript	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 01 Dec 2022 20:20:43 GMT server nginx/1.14.0 (Ubuntu) etag "63890c9b-7ad6" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10143 expires Fri, 06 Jan 2023 16:49:42 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	0 29 B	375ms 219ms	Script application/javascript	52.204.243.204 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.204.243.204 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-204-243-204.compute-1.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT cache-control private, max-age=600 x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	168 KB 45 KB	315ms 158ms	Script application/javascript	52.204.243.204 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.204.243.204 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-204-243-204.compute-1.amazonaws.com Software envoy / Resource Hash 6ff2617dfab351552a5eba560038571ee65a568c6dbe2ab301235c0100f1d968 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
GET H2	404	forms.js x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	0 0	298ms 142ms	Script application/javascript	52.204.243.204 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/forms.js?page_path=%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.204.243.204 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-204-243-204.compute-1.amazonaws.com Software envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	source-sans-pro-v21-latin-regular.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	74ms 72ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Origin https://redcanary.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests last-modified Thu, 02 Jun 2022 17:26:25 GMT server nginx etag "6298f2c1-32ec" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13036
GET H2	200	source-sans-pro-v21-latin-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	134ms 133ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Origin https://redcanary.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests last-modified Thu, 02 Jun 2022 17:26:24 GMT server nginx etag "6298f2c0-327c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12924
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8a44a688437cf2706ee40f65658c02570a88022739c239a9a590f2195b229b6b Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2d1b5f8201899a67311336d2f0ed42ab9c36c2a0b7c6f11a6fd98e7b132a3583 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f4a7bfeb8ba51dd47e05a71366c0e37cd7da22bcf103961abb55df40d02b86f3 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 199dcae2090a81008033df2bd7c3ca998636ed321b3cafaf538590073d3f18c9 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 431730c3e5d8031a6a6db310773318b8637de26b3148f6825490a6060609a8cf Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5ba033266f2ef8d7e0bcb7910d84f453e64adf780dc49094d5276a656e22e844 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fea65204c5c8a3640151a3aea25cf85db656bc9539bb3af58339bcc9ac8314c1 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 72acdf48bc232d5e06cbd21da85fb0a6af59a026ec19ee8448f4f3e9e3d96ea4 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4a1357cb7bd193d4edf030b1fb3f0355d5ecac95a9e835840d7404b275d19dfd Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b67d9349d35dbf2fde9ad4d480c6790303781e1d16109e6c719f63441bec2c35 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f42fb0a758a15e4a78f75633eb2ee51fc5ac294c0fc202f907d310a5fdc71d31 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 7662abab871ae596ea71e7e6c0ea0dda6e2a214c87f994f0d0a403a76bfe12ef Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	68 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b77bc7f434ef18604b5fcafc9c758c305d0c3d9df5da92b32ad4721664254007 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	208ms 208ms	Script application/javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&callback=jQuery112402517629520370257_1673023782494&_=1673023782495 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68e28bcbac10cc59b31805f26674c32c328eda5e9a206c32b5b926d851fafa7a Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-encoding gzip server cloudflare cf-ray 7855f2d25b2f6ddd-MIA cached true vary Accept-Encoding content-type application/javascript; charset=utf-8
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	81ms 80ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 265634
GET H2	200	source-sans-pro-v21-latin-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	85ms 84ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Origin https://redcanary.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests last-modified Thu, 02 Jun 2022 17:26:22 GMT server nginx etag "6298f2be-329c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12956
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 379 B	140ms 139ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:42 GMT content-security-policy upgrade-insecure-requests content-encoding br last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	ipv cdn.bizible.com/m/	43 B 304 B	36ms 35ms	Image image/gif	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=fe946ade53964f14ba8dab28e25a43a4&_biz_s=45308a&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&_biz_t=1673023782829&_biz_i=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&_biz_n=0&a=redcanary.com&rnd=294970&cdn_o=a&_biz_z=1673023782909 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mic/9ACD) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:42 GMT last-modified Sat, 31 Dec 2022 18:33:59 GMT server ECS (mic/9ACD) age 512143 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 204 B	36ms 34ms	Image image/gif	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=fe946ade53964f14ba8dab28e25a43a4&_biz_s=45308a&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&_biz_t=1673023782912&_biz_i=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&a=redcanary.com&rnd=691188&cdn_o=a&_biz_z=1673023782912 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mic/9ABD) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:42 GMT last-modified Sun, 01 Jan 2023 07:30:06 GMT server ECS (mic/9ABD) age 465576 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	FW_CTA.png redcanary.com/wp-content/uploads/2021/12/	10 KB 10 KB	78ms 76ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/12/FW_CTA.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 189ad7a7020dd6c9ea981356dd3984efa36851e4eead327f5c94110e139d08c2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests last-modified Tue, 21 Dec 2021 02:58:51 GMT server nginx etag "61c142eb-286e" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 10350
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	80ms 78ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 6680
GET H2	200	Threat-Detection-Square-975x975.jpg redcanary.com/wp-content/uploads/2019/10/	46 KB 47 KB	84ms 83ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/10/Threat-Detection-Square-975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 1383384cf05afa89f3e23039d5ec58a8c39be1d229d90e07dbebdd6e8c99cb5a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 09 Nov 2020 21:31:27 GMT server nginx etag "5fa9b52f-b9e9" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 47593
GET H2	200	SamVega-500x500-1.png redcanary.com/wp-content/uploads/2019/10/	94 KB 95 KB	85ms 84ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/10/SamVega-500x500-1.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 4a58b43da6316828ea7a38eef7ec026ad70a890fc573ec695bec7c915ca380ed Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 09 Nov 2020 21:31:29 GMT server nginx etag "5fa9b531-178cd" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 96461
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 445 B	99ms 98ms	Script text/javascript	152.199.2.76 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=fe946ade53964f14ba8dab28e25a43a4&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.18&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.2.76 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (mic/9B61) / Resource Hash 560c64b2c08170597ace0d7c2f781f7ec7d23eb22a05126ffc71e535ee037f51 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers content-type text/javascript; charset=utf-8 date Fri, 06 Jan 2023 16:49:43 GMT cache-control private, must-revalidate, max-age=21600 server ECS (mic/9B61) etag B43D20E8 content-length 116 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
GET H2	200	image11.png redcanary.com/wp-content/uploads/2019/10/	10 KB 11 KB	83ms 83ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/10/image11.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 90a42879483af3a0a7166fc978a540501e852cb4fe1f4311e072edffbb7fc55e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests last-modified Mon, 09 Nov 2020 21:31:41 GMT server nginx etag "5fa9b53d-2996" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 10646
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/site/ Frame 6A32	7 KB 2 KB	123ms 52ms	XHR application/json	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 507225c76413cb7464af25128a6a644960fd0c6e2c35dfb4081319a3f272fe82 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip cf-cache-status HIT age 373 ce-version 11.5.16 content-length 1993 last-modified Fri, 06 Jan 2023 16:43:30 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7855f2d5bf0a221a-MIA
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 815 B	227ms 70ms	XHR application/json	68.67.179.164 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 68.67.179.164 Secaucus, United States, ASN29990 (ASN-APPNEX, US), Reverse DNS 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Fri, 06 Jan 2023 16:49:43 GMT AN-X-Request-Uuid 7618068b-dd62-4671-8fd9-c1dae900ebd3 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 38.132.118.68; 38.132.118.68; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	50ms 49ms	XHR text/html	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	18 B 250 B	245ms 79ms	XHR text/html	2600:1400:d:5af::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1400:d:5af::1c91 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 233d4ebac2ff167b34cb41315a9ada6f664a267446cdcdb1afdd9343e88987fc Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:43 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:550:1d05:1::6 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 18 expires Fri, 06 Jan 2023 16:49:43 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/162/	11 KB 5 KB	73ms 73ms	Script application/x-javascript	104.102.141.31 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/162/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.141.31 Edison, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-141-31.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:43 GMT Content-Encoding gzip Last-Modified Fri, 01 Jul 2022 00:59:12 GMT Server AkamaiNetStorage ETag "75daf56f6191efe42577301908659c29:1656637152.894482" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4677 Expires Sun, 16 Apr 2023 16:49:43 GMT
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	140ms 140ms	Stylesheet text/css	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare etag "2d4004c-3437-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7855f2d578536ddd-MIA content-length 2623 expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 395 B	49ms 49ms	Stylesheet text/css	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 5925 etag "2da060b-33c-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7855f2d588566ddd-MIA content-length 246 expires Fri, 06 Jan 2023 20:49:43 GMT
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	296ms 156ms	XHR application/json	52.20.167.62 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.20.167.62 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-20-167-62.compute-1.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://redcanary.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://api.segment.io https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
POST H2	204	collect www.google-analytics.com/g/	0 345 B	225ms 79ms	Ping text/plain	2607:f8b0:4006:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oe120&_p=1721641806&cid=1582679798.1673023783&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1673023783&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&dt=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:43 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	57ms 56ms	XHR text/html	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	210ms 64ms	Script application/javascript	146.75.28.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.28.157 Ashburn, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 18:08:41 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip" vary Accept-Encoding,Host x-cache HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kiad7000165-IAD
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	220ms 69ms	Script application/x-javascript	2600:1400:d::17db:5c73 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1400:d::17db:5c73 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3fe29b8c78990a7b9438b55099db5603e79ad1438a8c3efab09cedf8eb415b66 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip last-modified Wed, 04 Jan 2023 15:09:15 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=63275 accept-ranges bytes content-length 4773
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	25 KB 8 KB	124ms 35ms	Script application/javascript	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 4b4e80032e1c164685d3ff6eb4c606785ebaebaa648d3984478b0cc8d114190b Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 07 Nov 2022 16:45:46 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "3528fd00b652f61a266eb584d96f4fcc" vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7722
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	1 KB 1 KB	244ms 104ms	Script text/javascript	2607:f8b0:4006:80c::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1673023783374&cv=11&fst=1673023783374&bg=ffffff&guid=ON&async=1&gtm=2wg120&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&tiba=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&auid=1562762443.1673023783&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:80c::2002 Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash cc706252133e5c4f22c027178ec25f50d9324e29a22001a6c23b48e34a447b78 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:43 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 902 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	149ms 60ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f2c4b7d20ff42a433d0c76631c460cd75128f8f0436d052ce2cf79dc4fa6a244 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Fri, 06 Jan 2023 16:49:42 GMT last-modified Mon, 05 Dec 2022 17:15:50 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: B1074E496038479BA43FF821CECD9594 Ref B: MIAEDGE2615 Ref C: 2023-01-06T16:49:43Z etag "027e538cd8d91:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 11460
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	105 KB 28 KB	220ms 67ms	Script application/x-javascript	2a03:2880:f012:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash cba8862bc0eeff77ab390c0669021b95055e809f226aa0e7dc438d79e3ad399f Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Fri, 06 Jan 2023 16:49:43 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27613 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug MXjYHkESZVdt25jZwS/RW7AkWA+qUWKlhOJYTTsRe5JJTEmQWeqE+uiDksFWZ9vKq/Qdn7w85mZSuutIT8a8hg== x-fb-trip-id 1512268381 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=8332155226849724931	0 233 B	305ms 144ms	Image application/json	2600:9000:210b:4c00:12:3734:2a40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=8332155226849724931 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Server 2600:9000:210b:4c00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:44 GMT via 1.1 2ca278c258e2c9c6a2d0cc60b816bd50.cloudfront.net (CloudFront) x-amz-cf-pop EWR53-C3 x-cache Miss from cloudfront content-type application/json x-amz-cf-id FMUZfUUWvO7rZBTEYmT0Hz1Expsas98Ke1o9BLsoh8r-ybH2OvmRnQ== content-length 0 apigw-requestid eVGeTiLRoAMESMg= Redirect headers Date Fri, 06 Jan 2023 16:49:43 GMT P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 38.132.118.68; 38.132.118.68; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com Content-Length 0 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid 8f135abd-c525-4f29-88d9-92c58c305f9d Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type text/html; charset=utf-8 Access-Control-Allow-Origin * Location https://attr.ml-api.io/?domain=redcanary.com&pId=8332155226849724931 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	91184d02a87923a014c1209f71972a90.js Show response script.crazyegg.com/pages/versioned/common-scripts/	77 KB 26 KB	47ms 47ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2286f307668c84511e2271af5e2805b4400511bca2a28edbabd32fcdcea17c7c Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 21 Dec 2022 12:59:21 GMT server cloudflare age 1377863 vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes timing-allow-origin * cf-ray 7855f2d659db67b6-MIA content-length 26887
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 815 B	155ms 71ms	XHR application/json	68.67.179.164 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 68.67.179.164 Secaucus, United States, ASN29990 (ASN-APPNEX, US), Reverse DNS 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Fri, 06 Jan 2023 16:49:43 GMT AN-X-Request-Uuid 0675268b-317d-48e2-b145-0634d7ebb892 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 38.132.118.68; 38.132.118.68; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	66ms 64ms	XHR text/html	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	18 B 250 B	96ms 74ms	XHR text/html	2600:1400:d:5af::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1400:d:5af::1c91 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 233d4ebac2ff167b34cb41315a9ada6f664a267446cdcdb1afdd9343e88987fc Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:43 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:550:1d05:1::6 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 18 expires Fri, 06 Jan 2023 16:49:43 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 815 B	227ms 88ms	XHR application/json	68.67.179.164 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 68.67.179.164 Secaucus, United States, ASN29990 (ASN-APPNEX, US), Reverse DNS 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Fri, 06 Jan 2023 16:49:43 GMT AN-X-Request-Uuid a71299a4-5a6c-4632-a22a-87d77caaa872 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 38.132.118.68; 38.132.118.68; 582.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	63ms 63ms	XHR text/html	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	18 B 250 B	98ms 80ms	XHR text/html	2600:1400:d:5af::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2600:1400:d:5af::1c91 New York, United States, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 233d4ebac2ff167b34cb41315a9ada6f664a267446cdcdb1afdd9343e88987fc Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:43 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:550:1d05:1::6 server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 18 expires Fri, 06 Jan 2023 16:49:43 GMT
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	563ms 103ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1673023783425&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1673023783424-77524&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/162/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:43 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id a66966f7-c39a-4945-aeb2-e91361dc9dc1
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 525 B	72ms 72ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-security-policy upgrade-insecure-requests content-encoding br last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	125ms 110ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A43%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	117ms 108ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A6%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame 82FE	2 KB 868 B	136ms 136ms	Document text/html	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-US,en;q=0.9 Response headers cache-control max-age=3600 cf-cache-status DYNAMIC cf-ray 7855f2d73b046ddd-MIA content-encoding gzip content-type text/html; charset=utf-8 date Fri, 06 Jan 2023 16:49:43 GMT server cloudflare vary Accept-Encoding x-content-type-options nosniff
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 609 B	720ms 720ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ X-Requested-With XMLHttpRequest accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Fri, 06 Jan 2023 16:49:44 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff, nosniff content-encoding br x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin server nginx vary Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN, deny content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store access-control-allow-credentials true feature-policy microphone 'none'; geolocation 'none' x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 577 B	178ms 61ms	XHR application/json	34.225.250.50 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.225.250.50 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-225-250-50.compute-1.amazonaws.com Software nginx / Resource Hash e75ad969c74ac0238355fc54da6ec4f3c836e30a4d58a7f8e4d16113100a4171 Request headers Referer https://redcanary.com/ accept-language en-US,en;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 394
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	302ms 60ms	Preflight	34.225.250.50 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.225.250.50 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-225-250-50.compute-1.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-max-age 1800 date Fri, 06 Jan 2023 16:49:43 GMT server nginx
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	150ms 74ms	Image image/gif	151.101.65.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1673023783554&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=a85dec23-4b5e-43fd-a26c-38d3ea1e5cc2&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_1967aea8 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/sampling/ Frame 6A32	159 B 237 B	42ms 41ms	XHR application/json	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=464728 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d3d044e2cb095446ba415e6ea96f265e2181388e529737d6b22585e71de007b Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip cf-cache-status HIT age 363 ce-version 11.5.16 content-length 145 last-modified Fri, 06 Jan 2023 16:43:40 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7855f2d7595c221a-MIA
GET H2	204	56383426.js Show response bat.bing.com/p/action/	0 119 B	144ms 144ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Fri, 06 Jan 2023 16:49:42 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 6E7AE6032F6E4E3899D5EF99652D11DF Ref B: MIAEDGE2615 Ref C: 2023-01-06T16:49:43Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 175 B	60ms 59ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=3d35b47c-b86a-4b94-a474-d5e63b033f23&sid=1eb4cb508de211eda7c2b1adb166fee6&vid=1eb4f8208de211edab7d1d5ce5b6f3ef&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&r=&lt=1889&evt=pageLoad&sv=1&rn=516116 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Fri, 06 Jan 2023 16:49:42 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: F1DD78A063D74C3A91DE91D405365221 Ref B: MIAEDGE2615 Ref C: 2023-01-06T16:49:43Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	messenger Show response app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 8AA5	6 KB 3 KB	262ms 81ms	Document text/html	35.169.154.38 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 35.169.154.38 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-154-38.compute-1.amazonaws.com Software nginx / Resource Hash 8ea4aa3a3a7681ec22a0803427061fdc8c49c37f246ee3c214afa7ee495bfa0e Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1687 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Fri, 06 Jan 2023 16:49:43 GMT Etag W/"8ea4aa3a3a7681ec22a0803427061fdc" Link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (e13668ca8eb7) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id 54d4c227-c206-89e2-646b-409e79df586d X-Runtime 0.020763 X-Xss-Protection 1; mode=block
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 6A32	19 B 460 B	201ms 61ms	XHR application/json	54.230.163.24 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.230.163.24 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-54-230-163-24.ewr53.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 19 Dec 2022 02:55:27 GMT via 1.1 4ce15cd7013298653f4333aa57416c80.cloudfront.net (CloudFront) x-amz-cf-pop EWR53-C3 age 1605257 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id o465XW2hVHuaZ7sS72-_Ds29JQQcusMMQhW89v0fg8Ah_ZSAemMOgA==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 6A32	19 B 463 B	220ms 62ms	XHR application/json	108.139.29.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.139.29.44 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-139-29-44.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Tue, 23 Aug 2022 06:15:02 GMT via 1.1 c1685d59e35fdb859ab8a1f97feb5652.cloudfront.net (CloudFront) x-amz-cf-pop JFK50-P2 age 11788482 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id IE_o-VfjJ8FAnCqvGFHMn7BDlyM2VJCssEpPfyZix4lmJXKXd5x8kQ==
GET H2	200	adsct t.co/i/	43 B 375 B	204ms 67ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=482262fa-05f4-47f6-afd2-c4eb3efdc3e1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0bea5fb7-781f-4e11-b375-2c4d1ecd997e&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers x-response-time 6 date Fri, 06 Jan 2023 16:49:43 GMT strict-transport-security max-age=0 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id 01c9b3fd8cac3cc2 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash bebf9c243ee58abd04a6092434415c77da12f1a263c4ef50acc20baf84d7e137 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 392 B	207ms 70ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=482262fa-05f4-47f6-afd2-c4eb3efdc3e1&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=0bea5fb7-781f-4e11-b375-2c4d1ecd997e&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_b / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers x-response-time 7 date Fri, 06 Jan 2023 16:49:43 GMT strict-transport-security max-age=631138519 server tsa_b content-type image/gif;charset=utf-8 x-transaction-id 2a3e480e00f3c125 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash d673b2cc562759d2f2a9db00076d657022296eca74aeeb833120fbcc016371a2 content-length 43
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame 82FE	208 KB 69 KB	47ms 46ms	Script application/x-javascript	104.17.70.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 544 etag "2d8057b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7855f2d8ed466ddd-MIA expires Fri, 06 Jan 2023 20:49:43 GMT
GET BLOB	200 OK	6034f44b-182b-4cce-97f3-9c3a7354ebf0 https://redcanary.com/	45 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/6034f44b-182b-4cce-97f3-9c3a7354ebf0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Length 45 Content-Type text/javascript
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/	36 B 367 B	66ms 66ms	XHR application/json	2600:9000:21ec:2200:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ec:2200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://redcanary.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/json Response headers date Fri, 06 Jan 2023 16:15:20 GMT content-encoding gzip via 1.1 f141d4a0b9a72779a9dd3a57c2c25f52.cloudfront.net (CloudFront) x-amz-cf-pop JFK51-C1 age 2064 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id TQe09VgwTfS-NBOES3zXk8m8aUlvylu_JTWLTWTpTxMJcEYjayLUxQ==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1673023783819%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&l... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&...	0 488 B	194ms 101ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&liSync=true&e_ipv6=AQIrfXG2fzywTQAAAYWH_QV9PQHE3wI7-dxKEu5JJTuygot2VQWlMZM7xiK4QJZ6HDZhLQ Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: F592D66A50CF461C9B72E3C91F7E1FA6 Ref B: MIAEDGE1615 Ref C: 2023-01-06T16:49:44Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAXxmzRgAuNvzWIRWpGc/A== Redirect headers date Fri, 06 Jan 2023 16:49:43 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: B23A31D8798C4F1B887F4A3E736565CA Ref B: MIA301000102025 Ref C: 2023-01-06T16:49:44Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673023783819&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&cookiesTest=true&liSync=true&e_ipv6=AQIrfXG2fzywTQAAAYWH_QV9PQHE3wI7-dxKEu5JJTuygot2VQWlMZM7xiK4QJZ6HDZhLQ x-li-proto http/2 content-length 0 x-li-uuid AAXxmzRdTDUAEx+P3Egqmg==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/ Frame	0 0	255ms 66ms	Preflight	2600:9000:21ec:2200:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21ec:2200:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 31291 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Fri, 06 Jan 2023 08:08:13 GMT via 1.1 f141d4a0b9a72779a9dd3a57c2c25f52.cloudfront.net (CloudFront) x-amz-cf-id pjKGHV2-kekytNNBrRXCWw85PXF_VQByhfgkBwbf5tUdYcEEHFSWaA== x-amz-cf-pop JFK51-C1 x-cache Hit from cloudfront
GET H2	200	1042590016249604 Show response connect.facebook.net/signals/config/	301 KB 86 KB	153ms 152ms	Script application/x-javascript	2a03:2880:f012:8:face:b00c:0:1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.91&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f012:8:face:b00c:0:1 Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 899dfea5ca9ad9dff951698675f25c811c60eac02821233f448cfb171705d652 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Fri, 06 Jan 2023 16:49:43 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug ZXsuDEnz06j16KWIOFK9aBPDlXAR0e4z/hnfUgStSNBhXwY2wRClCB2HhdsNSMXbdBIoz7kXt+0ffDIeyKxnRg== x-fb-trip-id 1512268381 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 548 B	221ms 86ms	Image image/gif	2607:f8b0:4006:821::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1673023783374&cv=11&fst=1673020800000&bg=ffffff&guid=ON&async=1&gtm=2wg120&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&tiba=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&fmt=3&is_vtc=1&random=2336815564&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:821::2004 Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:44 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 6A32	27 B 134 B	216ms 80ms	XHR text/plain	3.223.42.226 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1673023783871&tk=40ea43635c9a9388c5f9f97df894a565 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.223.42.226 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-223-42-226.compute-1.amazonaws.com Software awselb/2.0 / Resource Hash 5341d311d6d3a0971b1aa2bc919d8e855dbef345b3c09e0528135e199d71f81a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-origin * date Fri, 06 Jan 2023 16:49:44 GMT cache-control no-store server awselb/2.0 content-length 27 content-type text/plain
GET H2	200	messenger-94e6eccc.chunk.css assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame 8AA5	35 KB 7 KB	68ms 55ms	Stylesheet text/css	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611 Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id CR7RLVOSvN8A59.U_Z8vAhDQbuXMYHqb content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:35 GMT server cloudflare x-amz-request-id TW4FQD1GJAZ6F2D3 age 6021 etag W/"a788ecf510f83ee517cbaf79306145dd" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7855f2d96de16ddd-MIA x-amz-id-2 D+NKlrHOD1mQnRrT6qnPnmdHaq4OnPJV0oxhc9Bj8PuBgvpkOKfav0XHur0Im8hBrw9xkE7hB+g= expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	messenger-84a66aeb.chunk.css assets.qualified.com/packs/css/widget/sandboxed/ Frame 8AA5	5 KB 1 KB	55ms 42ms	Stylesheet text/css	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id 5Ydu6k4rPSG3QXcV_n2ryczMueyoFhYW content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:35 GMT server cloudflare x-amz-request-id TW46QVSWY0WVAMDS age 6021 etag W/"22d5f23e695250d3c5a5b1e76a015c5e" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7855f2d96de06ddd-MIA x-amz-id-2 v1/UDnY1AUljmD2q0Qkv25Hj2mQpqEj4EeR/ZtxjgUqBJZ6naYoK+7FiRnwzUMslyYZzvJ/coAo= expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	messenger~runtime-19fb018b7698170bb479.js Show response assets.qualified.com/packs/js/widget/sandboxed/ Frame 8AA5	2 KB 1 KB	54ms 54ms	Script application/javascript	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-19fb018b7698170bb479.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c47fbfe3ec24df4a7c921d328ef20e298c886174bd9b9751b533193bff6ad2a3 Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id teGzXPCuxGFNA.s8ZvdWUPfgPMWceCB5 content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:45 GMT server cloudflare x-amz-request-id TW4823E65QH53ZPR age 6018 etag W/"1e3c4cd6611da8b321fa70a42f883923" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7855f2d97e096ddd-MIA x-amz-id-2 BOg/T8dipfxq97XYu1i5X/UOpNRoOfiEJoSFk7fx5Rhn1H2+SYazGG6jzvbip+1PkEtuZU/ldVw= expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	messenger-75e5a4133c054ccfd374.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame 8AA5	991 KB 296 KB	63ms 62ms	Script application/javascript	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-75e5a4133c054ccfd374.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d9dc5ff442e0bfbdd552ab452c6f24922e9b3d9dfaebdf34d39582eda9b844b5 Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id xYUbQ3FxmGUE_meBQkAOc8WikPI5kcvR content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:44 GMT server cloudflare x-amz-request-id TW40R5CXB39PYJ57 age 6018 etag W/"2886ec6ae25e93c84a6485d7b1ebde1d" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7855f2d97e0a6ddd-MIA x-amz-id-2 P46eifMHuqR6Sgk51fhg2bcXaYwtLfM8m1Ry1YNBGgFwAxkcJqTVaMyLczziShbzFOt2a2N5RGg= expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	messenger-8aa3418a2d030f6118a0.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame 8AA5	438 KB 120 KB	57ms 56ms	Script application/javascript	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-8aa3418a2d030f6118a0.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91beccc38ee367c5b0307e947f25ff467da81108854a3866d193f6554aec5d6e Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id O3mAzOYAj6mx.1UB_LG_0UcFUAzio0V6 content-encoding gzip cf-cache-status HIT last-modified Thu, 05 Jan 2023 22:56:15 GMT server cloudflare x-amz-request-id N93KCFEAXN20TN3V age 6655 etag W/"7fffc0b9266fcbb6836f0903cdd10e92" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7855f2d9ae556ddd-MIA x-amz-id-2 EM/WZQrd+ZWKkPdbKqSyGdI9fc69RuyoMSeSbEq4E1hI31d+QwLE+AyeRweZNTASNIoSjmvK0RX5pRy40WWa6w== expires Fri, 06 Jan 2023 20:49:43 GMT
GET H2	200	Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 8AA5	97 KB 97 KB	124ms 46ms	Font font/woff2	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos cf-cache-status HIT x-amz-request-id AYAMQWC0SQ2BS80Q age 2473657 content-length 98868 x-amz-id-2 LE3mwm3k9b2Jk2MMYpDDLKz2O1NZKAnbIY/qHZDgucBFsmJhEnGZWANIezJF5UZVac1aK9nmgzE= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "dc131113894217b5031000575d9de002" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7855f2d9d946db11-MIA expires Sat, 06 Jan 2024 22:49:43 GMT
GET H2	200	Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 8AA5	103 KB 104 KB	161ms 83ms	Font font/woff2	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=7eb91dda-21df-4844-b83d-e9ab306d1c14 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:43 GMT x-amz-version-id ePBeoMCujYBxKBCWHO9COs36tHcpJSw9 cf-cache-status HIT x-amz-request-id AYAJ03Z7TNH33B7J age 2473657 content-length 105804 x-amz-id-2 JlhPNDNNzepliPJADISnjAFOG/pG8vEQRRjYUAE1pTWqEYoUt8eM8KeZk9JEkc7YTTdXDjRh35I= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "007ad31a53f4ab3f58ee74f2308482ce" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7855f2d9d94cdb11-MIA expires Sat, 06 Jan 2024 22:49:43 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	208ms 68ms	Image text/plain	2a03:2880:f112:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&rl=&if=false&ts=1673023784130&sw=1600&sh=1200&v=2.9.91&r=stable&ec=0&o=30&fbp=fb.1.1673023784128.1844938680&it=1673023783828&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Fri, 06 Jan 2023 16:49:44 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
POST H/1.1	200 OK	/ Show response sentry.io/api/1332833/envelope/ Frame 8AA5	2 B 407 B	279ms 70ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-75e5a4133c054ccfd374.chunk.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.qualified.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Fri, 06 Jan 2023 16:49:44 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary Origin Content-Type application/json access-control-allow-origin https://app.qualified.com access-control-expose-headers x-sentry-rate-limits, x-sentry-error, retry-after x-envoy-upstream-service-time 2 Connection keep-alive Content-Length 2
GET BLOB	200 OK	79bdb1dc-f3b3-4339-a2e8-e1ff59223cd9 https://redcanary.com/	241 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/79bdb1dc-f3b3-4339-a2e8-e1ff59223cd9 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash ba860807d58acdebb183234adc0c67c0658ad5b7ac61f65f1a3fec4c483c9ea5 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Length 241 Content-Type text/javascript
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	159ms 158ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A43%20GMT%22%2C%22timeSpent%22%3A%221034%22%2C%22totalTimeSpent%22%3A%221034%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/detecting-sharepoint-attacks-via-worker-process-activity/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:44 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	optimize.js Show response www.google-analytics.com/gtm/	113 KB 45 KB	216ms 81ms	Script application/javascript	2607:f8b0:4006:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f422daddce5429e6c3f813a76ca03fa20b65fa4227a0f1175139c8e53f3aa05b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:44 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45601 x-xss-protection 0 last-modified Fri, 06 Jan 2023 15:47:37 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 06 Jan 2023 16:49:44 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 8AF9	0 17 B	144ms 70ms	Document text/plain	2a03:2880:f112:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f112:83:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://redcanary.com Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Fri, 06 Jan 2023 16:49:44 GMT priority u=0 server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H3	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	66ms 66ms	Script text/javascript	2607:f8b0:4006:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Fri, 06 Jan 2023 16:44:02 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 342 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Fri, 06 Jan 2023 18:44:02 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	79ms 79ms	XHR text/plain	2607:f8b0:4006:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1721641806&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&ul=en-us&de=UTF-8&dt=Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=1623017230&gjid=1395495858&cid=1582679798.1673023783&tid=UA-52702906-1&_gid=1846561811.1673023785&_r=1&gtm=2wg120PXWC8JW&cd4=&cd5=&cd6=United%20States&cd7=Florida&cd8=Miami&cd9=&cd10=&cd11=&cd12=&cd13=&cd14=&cd18=null&z=443873886 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:80f::200e Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:44 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	2 B 438 B	191ms 68ms	XHR text/plain	2607:f8b0:4004:c08::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-52702906-1&cid=1582679798.1673023783&jid=1623017230&gjid=1395495858&_gid=1846561811.1673023785&_u=YADAAEAAQAAAACAAI~&z=1032649756 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c08::9b Ashburn, United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Fri, 06 Jan 2023 16:49:45 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	221ms 85ms	Image image/gif	2607:f8b0:4006:821::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-52702906-1&cid=1582679798.1673023783&jid=1623017230&_u=YADAAEAAQAAAACAAI~&z=321924603 Protocol H3 Security QUIC, , AES_128_GCM Server 2607:f8b0:4006:821::2004 Nutley, United States, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Fri, 06 Jan 2023 16:49:45 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	83ms 82ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A44%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222036%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:45 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 8AA5	13 KB 13 KB	226ms 90ms	Image image/png	52.216.24.96 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.24.96 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:47 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id SBEHDSV7J79XB80J ETag "fd481ec600c1b3fad6f9e29aa732a946" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 2gBAGEJ0WZ62iZAguY7ByTty1xwFNsSSozhELploGOp4tVaZolZYdLo/41i0aTqX/NwY8/hhbA4=
GET H/1.1	200 OK	b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 8AA5	13 KB 13 KB	71ms 71ms	Image image/png	52.216.24.96 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.24.96 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:47 GMT Last-Modified Thu, 20 Oct 2022 23:48:08 GMT Server AmazonS3 x-amz-request-id SBEPR0DZS0HA05PB ETag "7797b96a7f999ac42de528bede3329af" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 13099 x-amz-id-2 k7flRs48mfdKHV7VUv1oYRDgmNkyOLjn9dvRMv7/rIPolOZtkLdSoHPu5EUv5LMyv2n5oJiw4tg=
GET H2	200	RedCanary_Logo_Primary.png redcanary.com/wp-content/uploads/2022/11/ Frame 8AA5	15 KB 15 KB	139ms 139ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2022/11/RedCanary_Logo_Primary.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 82ff0da13fe2fc8c21420a72d5e6255f6d1023c8dee0a35573319d4b64953ee3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:46 GMT content-security-policy upgrade-insecure-requests last-modified Tue, 15 Nov 2022 20:15:42 GMT server nginx etag "6373f36e-3ad4" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 15060
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	86ms 86ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223037%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:46 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 8AA5	13 KB 13 KB	71ms 71ms	Image image/png	52.216.24.96 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.24.96 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Fri, 06 Jan 2023 16:49:47 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id SBEX2C3TQ9JEDJBG ETag "fd481ec600c1b3fad6f9e29aa732a946" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 3fDV9OG2+/XzkE5s/hx/X2fwS/nxlC7dqaaFGm/QRF8jx2mw8q2ukhwFXjM3OAjdYYRiJGjhOBY=
GET H2	200	Inter-roman.var-ba4caefcdf5b36b438db92786991c845.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 8AA5	222 KB 222 KB	43ms 43ms	Font font/woff2	2606:4700::6812:1005 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-roman.var-ba4caefcdf5b36b438db92786991c845.woff2 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3 Request headers Referer https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Origin https://app.qualified.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:46 GMT x-amz-version-id 8iJAUpJd6e_Yyn0OiVIrGWhC4aEObLYF cf-cache-status HIT x-amz-request-id RCKRVR093A6NWBQ8 age 2473659 content-length 227180 x-amz-id-2 ibqi9FS6mle2zeVcUD/OWXplZVwII23eBL74h7TUPiGW36IDZC/+ClwJ+p5c49nq9OKqT1Hm4rg= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "66c6e40883646a7ad993108b2ce2da32" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7855f2e92f34db11-MIA expires Sat, 06 Jan 2024 22:49:46 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	90ms 90ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A46%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224039%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:47 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	RedCanary_Logo_Primary.png redcanary.com/wp-content/uploads/2022/11/ Frame 8AA5	15 KB 15 KB	140ms 139ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2022/11/RedCanary_Logo_Primary.png Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-75e5a4133c054ccfd374.chunk.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 82ff0da13fe2fc8c21420a72d5e6255f6d1023c8dee0a35573319d4b64953ee3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers accept-language en-US,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:47 GMT content-security-policy upgrade-insecure-requests last-modified Tue, 15 Nov 2022 20:15:42 GMT server nginx etag "6373f36e-3ad4" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 15060
GET H/1.1	206 Partial Content	7bfc614b2b8cf39efbfb3b15da61c94a.mp3 app.qualified.com/packs/	6 KB 6 KB	60ms 59ms	Media audio/mpeg	35.169.154.38 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/packs/7bfc614b2b8cf39efbfb3b15da61c94a.mp3 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 35.169.154.38 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-169-154-38.compute-1.amazonaws.com Software nginx / Resource Hash 3814cdd9f44b721f9c1cb111462e040b4a885d07cb143ee37b680d871cbfa94e Request headers Referer https://redcanary.com/ Accept-Encoding identity;q=1, *;q=0 accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Range bytes=0- Response headers Date Fri, 06 Jan 2023 16:49:47 GMT Via 1.1 spaces-router (e13668ca8eb7) Last-Modified Fri, 06 Jan 2023 01:17:46 GMT Server nginx Content-Type audio/mpeg Content-Range bytes 0-5869/5870 Cache-Control max-age=315360000, public Content-Length 5870 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	87ms 86ms	Image image/gif	23.223.129.72 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=63d03f08-1f97-483c-8c0a-2af82b38426b&session=891e902d-d7a0-4a47-8dc9-a8fa7e1dbc9e&event=active_time_track&q=%7B%22currentTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Fri%2C%2006%20Jan%202023%2016%3A49%3A47%20GMT%22%2C%22timeSpent%22%3A%221030%22%2C%22totalTimeSpent%22%3A%225069%22%7D&isIframe=false&m=%7B%22description%22%3A%22SharePoint%20attacks%20are%20commonplace%2C%20so%20it%27s%20important%20that%20security%20teams%20know%20what%20to%20look%20for%20when%20adversaries%20target%20Web%20servers.%C2%A0%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Detecting%20SharePoint%20attacks%20via%20worker%20process%20activity%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fdetecting-sharepoint-attacks-via-worker-process-activity%2F&pageViewId=460d376a-e3d0-40c0-8113-6c390d123b22&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.223.129.72 Atlanta, United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-223-129-72.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Fri, 06 Jan 2023 16:49:48 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT