www.spamtitan.com Open in urlscan Pro
75.119.211.125  Public Scan

7 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 36

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/735561996/?random=1667948716249&cv=11&fst=1667948716249&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&auid=2106283857.1667948716&uaw=0 HTTP 302
• https://www.google.com/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&is_vtc=1&random=3304472019 HTTP 302
• https://www.google.de/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&is_vtc=1&random=3304472019&ipr=y

Request Chain 77

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tm=gtmv2 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D21210%26time%3D1667948716541%26url%3Dhttps%253A%252F%252Fwww.spamtitan.com%252Fblog%252Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%252F%26tm%3Dgtmv2%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tm=gtmv2&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tm=gtmv2&liSync=true&e_ipv6=AQJcrMqiRqEFaAAAAYRZfaRVxzT52oUlx7HTx6AwU1PJPD_pJUui1NGYL29uUJ-IGvxWpYM

194 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/	49 KB 13 KB	1256ms 886ms	Document text/html	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash c8e70db4af823d4776d5760b16d73aa054231b09be7f5e080d0aeee3c19151af Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-type text/html; charset=UTF-8 date Tue, 08 Nov 2022 23:05:14 GMT expires Thu, 19 Nov 1981 08:52:00 GMT link <https://www.spamtitan.com/blog/wp-json/>; rel="https://api.w.org/", <https://www.spamtitan.com/blog/wp-json/wp/v2/posts/2671>; rel="alternate"; type="application/json", <https://www.spamtitan.com/blog/?p=2671>; rel=shortlink pragma no-cache server Apache strict-transport-security max-age=31536000;includeSubDomains; vary Accept-Encoding,User-Agent
GET H2	200	style.min.css www.spamtitan.com/blog/wp-includes/css/dist/block-library/	81 KB 12 KB	188ms 180ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.9.5 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Fri, 15 Apr 2022 12:23:49 GMT server Apache etag "145db-5dcb07b9aa086-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 11694 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	css fonts.googleapis.com/	5 KB 1 KB	72ms 25ms	Stylesheet text/css	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:400,700 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 910612fc65208677f4e2fff60558e0f1949138a3696402a17ed5582efe0d2649 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 08 Nov 2022 22:56:29 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 08 Nov 2022 23:05:15 GMT
GET H2	200	style.css www.spamtitan.com/blog/wp-content/plugins/monarch/css/	113 KB 13 KB	242ms 233ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.3.4 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash f820d93daf383e178bda2912f5bee00e90e56390597820622643fa8e5e487143 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 09:56:58 GMT server Apache etag "1c56d-5935dac79831d-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	public.css www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/css/	5 KB 2 KB	358ms 350ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/css/public.css?ver=1.9.3.8 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 37c558263ba695539d83e2b57c33595763d1b7b36e27e4d2b0a654ef00027690 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Mon, 06 Jan 2020 21:27:46 GMT server Apache etag "152d-59b7f549997c5-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 1542 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	css fonts.googleapis.com/	26 KB 1 KB	70ms 26ms	Stylesheet text/css	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 47a7dd0cada3c63b3d5981848b65973772a3f5ccc578d16ed90e3aa1b74056ab Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 08 Nov 2022 22:11:07 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 08 Nov 2022 23:05:15 GMT
GET H2	200	style.css www.spamtitan.com/blog/wp-content/themes/Divi-child/	3 KB 1 KB	356ms 349ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi-child/style.css?ver=3.0.40 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash ec990142aeb28d37a2a86d22713ac9b9e913539011a16102bce2bffdc9858bcb Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:02:05 GMT server Apache etag "ce7-5935dbec5bd63-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 1181 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	shortcodes.css www.spamtitan.com/blog/wp-content/themes/Divi/epanel/shortcodes/css/	35 KB 6 KB	357ms 351ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi/epanel/shortcodes/css/shortcodes.css?ver=3.0.40 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash f59665e3b24c9ea34f72a486ba7494555076e7b2b84016398d2310c82260b44b Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:00:52 GMT server Apache etag "8c8c-5935dba710f36-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 5920 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	shortcodes_responsive.css www.spamtitan.com/blog/wp-content/themes/Divi/epanel/shortcodes/css/	4 KB 898 B	354ms 349ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi/epanel/shortcodes/css/shortcodes_responsive.css?ver=3.0.40 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash cbe5066888bfd1ccdb3e39d2597f3462e531353c5648fe20d5e6ad3b9801c766 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:00:52 GMT server Apache etag "f6e-5935dba6da43a-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 818 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	magnific_popup.css www.spamtitan.com/blog/wp-content/themes/Divi/includes/builder/styles/	8 KB 2 KB	355ms 350ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi/includes/builder/styles/magnific_popup.css?ver=3.0.40 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 988d40aa4910579706cd9f80fad0428a3ac8a1b7bd067127da59a6e0b4aa86f0 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:01:39 GMT server Apache etag "1f6f-5935dbd37fb65-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes content-length 2029 expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	jquery.min.js Show response www.spamtitan.com/blog/wp-includes/js/jquery/	87 KB 31 KB	356ms 351ms	Script application/javascript	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Thu, 11 Nov 2021 16:42:10 GMT server Apache etag "15db1-5d086061dd485-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=2592000 accept-ranges bytes expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	zoa5hea.js Show response use.typekit.net/	17 KB 7 KB	231ms 175ms	Script text/javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/zoa5hea.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash ed580f4faacd427c90cd1dfdefed21238d4e62778552b7700ff3f7988772c2c8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Tue, 08 Nov 2022 23:05:15 GMT server nginx vary Accept-Encoding content-type text/javascript;charset=utf-8 access-control-allow-origin * cache-control public, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 6748
GET H2	200	spamtitan.png www.spamtitan.com/wp-content/uploads/2016/02/	4 KB 4 KB	178ms 177ms	Image image/png	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.spamtitan.com/wp-content/uploads/2016/02/spamtitan.png Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 6ee8197ec7fdc4bf629ac37a1dd6d67678dba7f680863dcdf3d4a2e348a20cc8 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 20:43:59 GMT server Apache etag "1028-59366b65e448d" vary User-Agent,Accept-Encoding content-type image/png cache-control max-age=31536000 accept-ranges bytes content-length 4136 expires Wed, 08 Nov 2023 23:05:16 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	314 KB 99 KB	80ms 38ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8f59c4d9a5943470892dfb21a0ec6e5b859845f04e1eb38671bb3d5c3959bc27 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 101162 x-xss-protection 0 last-modified Tue, 08 Nov 2022 22:08:45 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 08 Nov 2022 23:05:16 GMT
GET H2	200	wp-emoji-release.min.js Show response www.spamtitan.com/blog/wp-includes/js/	18 KB 5 KB	179ms 179ms	Script application/javascript	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.9.5 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Thu, 11 Nov 2021 16:42:10 GMT server Apache etag "4705-5d086061e41e5-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=2592000 accept-ranges bytes content-length 4998 expires Thu, 08 Dec 2022 23:05:16 GMT
GET H2	200	autoptimize_4cd09a397cb3e059617d92683f75c9f4.js Show response www.spamtitan.com/blog/wp-content/cache/autoptimize/js/	262 KB 63 KB	188ms 188ms	Script application/javascript	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/cache/autoptimize/js/autoptimize_4cd09a397cb3e059617d92683f75c9f4.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 8996a35f0dff7a22155ea620fba2efac9831b96ec8693f0310cd0c70d5446d76 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Thu, 22 Sep 2022 17:01:03 GMT server Apache etag "41846-5e94701a56f72-gzip" vary Accept-Encoding,User-Agent content-type application/javascript cache-control max-age=30672000, public, immutable accept-ranges bytes expires Sun, 29 Oct 2023 23:05:16 GMT
GET H2	200	style.css www.spamtitan.com/blog/wp-content/themes/Divi/	402 KB 51 KB	197ms 197ms	Stylesheet text/css	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi/style.css Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-content/themes/Divi-child/style.css?ver=3.0.40 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 22b2967e11440baaab8560b3f18760b122fe72c3aaa6120623cb976ed963d9cb Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/wp-content/themes/Divi-child/style.css?ver=3.0.40 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:15 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:02:06 GMT server Apache etag "6497a-5935dbed453af-gzip" vary Accept-Encoding,User-Agent content-type text/css cache-control max-age=2592000 accept-ranges bytes expires Thu, 08 Dec 2022 23:05:15 GMT
GET H2	200	modules.ttf www.spamtitan.com/blog/wp-content/themes/Divi/core/admin/fonts/	81 KB 82 KB	179ms 179ms	Font application/font-sfnt	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/themes/Divi/core/admin/fonts/modules.ttf Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-content/themes/Divi/style.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash c683211e591f2048ec4a840586e4f849894c8a57c147f23d7b5652d61c1260e2 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers Referer https://www.spamtitan.com/blog/wp-content/themes/Divi/style.css Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 10:00:30 GMT server Apache etag "143e8-5935db922a7a1" vary User-Agent content-type application/font-sfnt cache-control max-age=172800 accept-ranges bytes content-length 82920 expires Thu, 10 Nov 2022 23:05:16 GMT
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v34/	44 KB 44 KB	54ms 16ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:400,700 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 18:50:34 GMT x-content-type-options nosniff age 101682 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44856 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:20:18 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 07 Nov 2023 18:50:34 GMT
GET H2	200	S0OSwl1NQ1s Show response www.youtube.com/embed/ Frame 0B35	69 KB 28 KB	149ms 104ms	Document text/html	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/S0OSwl1NQ1s Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 871a62389aeb2052f6bb512951a42786566e3657b30d165621ab0a5956742c24 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" date Tue, 08 Nov 2022 23:05:16 GMT expires Mon, 01 Jan 1990 00:00:00 GMT p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H/1.1	200	form_embed.js Show response trust.titanhq.com/acton/content/	48 KB 14 KB	271ms 77ms	Script text/javascript	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://trust.titanhq.com/acton/content/form_embed.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash e6fa914aa4853db08878adf0994e27b6d67646269863a3cb9d93f60f72e1f026 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:05:16 GMT Content-Encoding gzip Last-Modified Wed, 02 Nov 2022 17:48:38 GMT ETag W/"48680-1667411318000" Vary Accept-Encoding Content-Type text/javascript;charset=UTF-8 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 13890
GET H2	200	monarch.ttf www.spamtitan.com/blog/wp-content/plugins/monarch/css/fonts/	15 KB 15 KB	180ms 180ms	Font application/font-sfnt	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/plugins/monarch/css/fonts/monarch.ttf Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.3.4 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 8c102baea959329be23bb8a5d6bc268ce1668484995f0d23c2f88b46d7653c4f Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers Referer https://www.spamtitan.com/blog/wp-content/plugins/monarch/css/style.css?ver=1.3.4 Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000;includeSubDomains; last-modified Wed, 25 Sep 2019 09:56:57 GMT server Apache etag "3af8-5935dac6a1212" vary User-Agent content-type application/font-sfnt cache-control max-age=172800 accept-ranges bytes content-length 15096 expires Thu, 10 Nov 2022 23:05:16 GMT
GET H2	200	hotjar-639570.js Show response static.hotjar.com/c/	4 KB 2 KB	125ms 44ms	Script application/javascript	18.66.97.10 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-639570.js?sv=5 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.97.10 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-97-10.fra56.r.cloudfront.net Software / Resource Hash ee58c9ae64bd4830a8ee9bb5d8dbd49779b546592f9e89bc155a1a051c1476d2 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=2592000; includeSubDomains content-encoding br x-content-type-options nosniff date Tue, 08 Nov 2022 23:05:16 GMT via 1.1 5d5481cfa85227a3fdd5ff0b03093c62.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P2 etag W/796b2f699c995976f9c4bd190e054712 vary Accept-Encoding x-cache RefreshHit from cloudfront content-type application/javascript; charset=UTF-8 access-control-allow-origin * x-cache-hit 1 cache-control max-age=60 cross-origin-resource-policy cross-origin x-amz-cf-id r4athMLshH6bbMTZ7ScB0sz6Fx3BaXWgknNZCojkYNuYCmk6SnF6XA==
GET H2	200	optimize.js Show response www.googleoptimize.com/	119 KB 46 KB	85ms 31ms	Script application/javascript	2a00:1450:4001:80b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleoptimize.com/optimize.js?id=OPT-K5SLD6Z Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 8acb7332fc4842bfc815d3bdc30f08072900f3ead7d3f2914ab6cbb17cb4f6bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 46701 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Tue, 08 Nov 2022 23:05:16 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	60ms 15ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 08 Nov 2022 21:24:49 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 6027 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Tue, 08 Nov 2022 23:24:49 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/995243620/	2 KB 1 KB	99ms 59ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/995243620/?random=1667948716242&cv=11&fst=1667948716242&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&auid=2106283857.1667948716&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e644180a58e1a602f0f50ac5cea4842bc6e1486e45a5d9a1b27859cd6998ec4e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 958 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	997 B 639 B	71ms 16ms	Script application/x-javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash bb16ee6fd17d39c404201dc8db250ddc46b29c963d4334b3952e9508eb1c4381 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip last-modified Tue, 08 Nov 2022 00:38:08 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=83866 accept-ranges bytes content-length 471
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/997357733/	2 KB 2 KB	67ms 29ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/997357733/?random=1667948716248&cv=11&fst=1667948716248&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&auid=2106283857.1667948716&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f16b7983c77fd9e8fcf8874daf555a734eab407e6a7f88e40cbff7b6de891dda Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 958 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/735561996/	2 KB 1 KB	68ms 32ms	Script text/javascript	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/735561996/?random=1667948716249&cv=11&fst=1667948716249&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&auid=2106283857.1667948716&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1248fb87d66d6daa8db784e92aa03574ea926c091411c3f799fda87e353be4bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 959 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	iframe_api Show response www.youtube.com/	992 B 2 KB	33ms 32ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 874e87fa935e7bccb5fa562bb4796cb9016ffda5fe036c748cd6458de421bf67 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff content-encoding br p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info." cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version server ESF x-frame-options SAMEORIGIN vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version content-type text/javascript; charset=utf-8 report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} cache-control private, max-age=0 permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=* cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" expires Tue, 08 Nov 2022 23:05:16 GMT
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	98ms 45ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 08 Nov 2022 23:05:15 GMT last-modified Thu, 28 Jul 2022 17:32:37 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: B523238A74754EA9BD577E8F2EB37A40 Ref B: FRAEDGE1922 Ref C: 2022-11-08T23:05:16Z etag "80a8697a8a2d81:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 11367
GET H/1.1	200	31047 Show response trust.titanhq.com/cdnr/202/acton/bn/tracker/	5 KB 5 KB	158ms 40ms	Script application/javascript	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://trust.titanhq.com/cdnr/202/acton/bn/tracker/31047 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash 4b05ddfe55c62d99082c48a3ccf6966c6bdbafb79e476747fc41191720e3a84c Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type application/javascript;charset=utf-8 Date Tue, 08 Nov 2022 23:05:16 GMT X-Cnection close Content-Length 4844 P3P CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	103 KB 28 KB	58ms 17ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f896040524443394b8b1ba4fbd1de94be74378ab901e53b3b40c1323d1735143 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 08 Nov 2022 23:05:16 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27337 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug YlYE3DnEj32Om+Hic12beoqG2464X8VJf8simJYM8qcD6JJiLj0Q+qgnQH1JhDOuw403W9w/50EE3Nz00HUhDA== x-fb-trip-id 686109401 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	2i729czdfm5i.js Show response js.driftt.com/include/1667949000000/	211 KB 60 KB	218ms 137ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1667949000000/2i729czdfm5i.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash c8c4fe0a0fd3177aa181f7ec62151009135434e18d7cbf9b053bcdffc1801372 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT x-amz-version-id OMD4EQ7agjfEu9cMUqcUMha2b0vh_9s. content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront last-modified Mon, 07 Nov 2022 15:34:03 GMT server nginx etag W/"53e85dfea0ff765a76f330d302091272" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id GuUExt6qJZGUYaZZGebZ5zRZJ59lqV403Pjbqnb_QNLhPnmY1CrIgA==
GET H/1.1	200 OK	mhct.min.js Show response www.dynamicnumbers.mediahawk.co.uk/	13 KB 5 KB	160ms 31ms	Script text/javascript	162.13.32.69 RACKSPACE-LON
General Check archive.org Show headers Download Go to Full URL https://www.dynamicnumbers.mediahawk.co.uk/mhct.min.js Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 162.13.32.69 , United Kingdom, ASN15395 (RACKSPACE-LON, GB), Reverse DNS app4.mediahawk.co.uk Software Apache / Resource Hash cec1108831dabacd48cfed0dbe9be3604cbb05fde73fd42a2ace4b3f0c00a177 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:05:16 GMT Content-Encoding gzip Last-Modified Tue, 30 Aug 2022 14:24:10 GMT Server Apache ETag "329c-5e776223af680-gzip" Vary Accept-Encoding Access-Control-Allow-Methods PUT, GET, POST, DELETE, OPTIONS Content-Type text/javascript Connection close Accept-Ranges bytes Access-Control-Allow-Headers origin, x-requested-with, content-type Content-Length 4873
GET H2	200	pixel.js Show response grow.clearbitjs.com/api/	2 KB 979 B	281ms 183ms	Script text/javascript	216.24.57.253 RENDER
General Check archive.org Show headers Download Go to Full URL https://grow.clearbitjs.com/api/pixel.js?v=1667948716257 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.24.57.253 , United States, ASN397273 (RENDER, US), Reverse DNS Software cloudflare / Resource Hash c3b832350962ac3ba8a6f89d76e744fdbcdf37d5f810b8ff1fc8cb3dc8f964c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status DYNAMIC content-encoding br server cloudflare vary Accept-Encoding content-type text/javascript cf-ray 7671f3d5a91d9a30-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	js Show response www.googletagmanager.com/gtag/	222 KB 77 KB	31ms 31ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-3WFW9VBZNR&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 909327e157da21da624c86c96a42edb9e46b1a958304cd10e24408593197864a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 78639 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Tue, 08 Nov 2022 23:05:16 GMT
GET H3	200	/ www.google.de/pagead/1p-user-list/735561996/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/735561996/?random=1667948716249&cv=11&fst=1667948716249&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googlead... https://www.google.com/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan... https://www.google.de/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan....	42 B 64 B	62ms 28ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&is_vtc=1&random=3304472019&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H3 Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" location https://www.google.de/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&fmt=3&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&is_vtc=1&random=3304472019&ipr=y content-type image/gif cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	www-widgetapi.js Show response www.youtube.com/s/player/c4225c42/www-widgetapi.vflset/	161 KB 53 KB	16ms 15ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-widgetapi.vflset/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6c64fcbaf5909fcab9ad263ef654d029a486aac70414f6504a0c7d3f04a93fcb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 21:10:42 GMT content-encoding br x-content-type-options nosniff age 6874 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 53867 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Wed, 08 Nov 2023 21:10:42 GMT
POST H2	204	collect region1.google-analytics.com/g/	0 348 B	61ms 22ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-3WFW9VBZNR&gtm=2oeb70&_p=1792138348&cid=1745326697.1667948716&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1667948716&sct=1&seg=0&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&dt=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-3WFW9VBZNR&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.spamtitan.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	www-player.css www.youtube.com/s/player/c4225c42/ Frame 0B35	359 KB 49 KB	16ms 16ms	Stylesheet text/css	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2bd4827c67760075ffaf32114b41d503da91ccc26f3cf43349607f7b2ff19a1d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:15 GMT content-encoding br x-content-type-options nosniff age 105181 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49779 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:15 GMT
GET H3	200	www-embed-player.js www.youtube.com/s/player/c4225c42/www-embed-player.vflset/ Frame 0B35	309 KB 0	29ms 29ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 98145 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET H3	200	base.js www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/ Frame 0B35	2 MB 0	37ms 36ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:53:13 GMT content-encoding br x-content-type-options nosniff age 105123 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 589644 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:53:13 GMT
GET H3	200	fetch-polyfill.js www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/ Frame 0B35	9 KB 0	36ms 35ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2786 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET		KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 0B35	0 0
GET		KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 0B35	0 0
GET H2	200	modules.ce71d14bfe39cbc54662.js Show response script.hotjar.com/	262 KB 67 KB	71ms 17ms	Script application/javascript	52.222.236.74 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.ce71d14bfe39cbc54662.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-639570.js?sv=5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.236.74 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-236-74.fra56.r.cloudfront.net Software / Resource Hash e6360da4384d9106c5bea21a1f7d34b03faa2f7017cfc67dcc2c356d84b931ac Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 14:40:07 GMT content-encoding br x-content-type-options nosniff strict-transport-security max-age=2592000; includeSubDomains via 1.1 34fdfb7c7c11559df7e622af2b62f5ca.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P4 age 30309 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin content-length 68393 last-modified Tue, 08 Nov 2022 14:39:45 GMT etag "da0f5482259a7f9bc23abb5a00fd3164" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control max-age=31536000 accept-ranges bytes x-robots-tag none x-amz-cf-id obAE4C1AR93EOQxmErieQmlFOyevUgmagS8kxoMgho7aIJYUV9FPIg==
GET H2	200	/ www.google.com/pagead/1p-user-list/997357733/	42 B 548 B	83ms 35ms	Image image/gif	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/997357733/?random=1667948716248&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=2303542120&rmt_tld=0&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/997357733/	42 B 108 B	68ms 28ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/997357733/?random=1667948716248&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=2303542120&rmt_tld=1&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/735561996/	42 B 108 B	78ms 36ms	Image image/gif	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=3193580565&rmt_tld=0&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/735561996/	42 B 548 B	41ms 27ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/735561996/?random=1667948716249&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=3193580565&rmt_tld=1&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	insight.beta.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	17ms 17ms	Script application/x-javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 3f50a1ccb55e595667f30077ae38364f5d3eab17837057fd32a0e2bc13cd9013 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip last-modified Thu, 03 Nov 2022 02:12:26 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=46228 accept-ranges bytes content-length 4611
GET H3	200	linkid.js Show response www.google-analytics.com/plugins/ua/	2 KB 884 B	47ms 16ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/plugins/ua/linkid.js Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:14 GMT content-encoding gzip x-content-type-options nosniff age 182 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 859 x-xss-protection 0 last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe vary Accept-Encoding report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type text/javascript cache-control public, max-age=3600 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Wed, 09 Nov 2022 00:02:14 GMT
GET H3	200	S0OSwl1NQ1s Show response www.youtube.com/embed/ Frame 0B35	69 KB 28 KB	63ms 63ms	Document text/html	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PGM4F3T Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash e733e23a0466b4a12c1050093aed59ba1149cec24f58490e9e277ab164fa7518 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" date Tue, 08 Nov 2022 23:05:16 GMT expires Mon, 01 Jan 1990 00:00:00 GMT p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H2	200	/ www.google.com/pagead/1p-user-list/995243620/	42 B 108 B	40ms 36ms	Image image/gif	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/995243620/?random=1667948716242&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=320901784&rmt_tld=0&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/995243620/	42 B 108 B	30ms 26ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/995243620/?random=1667948716242&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tiba=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&fmt=3&is_vtc=1&random=320901784&rmt_tld=1&ipr=y Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:16 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	4020354.js Show response bat.bing.com/p/action/	0 118 B	119ms 118ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4020354.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Tue, 08 Nov 2022 23:05:16 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: EB7A492C08834219B0ECBA8EC394F0C7 Ref B: FRAEDGE1922 Ref C: 2022-11-08T23:05:16Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 175 B	41ms 41ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4020354&Ver=2&mid=3564c100-df31-4a78-ae28-982457367fbc&sid=cefe45405fb911edb6d857e4c5a376de&vid=cefe6d805fb911ed95d879dd465900d0&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&p=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&r=&evt=pageLoad&sv=1&rn=448354 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 08 Nov 2022 23:05:16 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A43CF74781D644C99D0E979AD97A0794 Ref B: FRAEDGE1922 Ref C: 2022-11-08T23:05:16Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	www-player.css www.youtube.com/s/player/c4225c42/ Frame 0B35	359 KB 49 KB	16ms 15ms	Stylesheet text/css	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2bd4827c67760075ffaf32114b41d503da91ccc26f3cf43349607f7b2ff19a1d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:15 GMT content-encoding br x-content-type-options nosniff age 105181 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49779 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:15 GMT
GET H3	200	www-embed-player.js Show response www.youtube.com/s/player/c4225c42/www-embed-player.vflset/ Frame 0B35	309 KB 96 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 681b6bb35bf9ff8ce07733fe20795e241e59800b6319e6f4f6bf929147f36064 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 98145 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET H3	200	base.js Show response www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/ Frame 0B35	2 MB 576 KB	19ms 18ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 845343e662ab11d1fcfc4ad84465f007939cdcba32bc9a4d38a4d38070502f21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:53:13 GMT content-encoding br x-content-type-options nosniff age 105123 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 589644 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:53:13 GMT
GET H3	200	fetch-polyfill.js Show response www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/ Frame 0B35	9 KB 3 KB	27ms 26ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2786 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET H2	200	box-c6ca1c87e308a39aabb76b56ba54398b.html Show response vars.hotjar.com/ Frame D76E	2 KB 1 KB	76ms 17ms	Document text/html	18.66.147.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-c6ca1c87e308a39aabb76b56ba54398b.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-639570.js?sv=5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.113 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-113.fra60.r.cloudfront.net Software / Resource Hash a0084043f26a51ea743463b4a653e4850cbaae0868832e4471a199f753fc6b27 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes age 384190 cache-control max-age=31536000 content-encoding br content-length 1035 content-type text/html cross-origin-embedder-policy require-corp cross-origin-resource-policy cross-origin date Fri, 04 Nov 2022 12:22:06 GMT etag "b6d25d1350d6a014d80689f389e76f97" last-modified Fri, 04 Nov 2022 12:21:18 GMT strict-transport-security max-age=2592000; includeSubDomains vary Accept-Encoding via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) x-amz-cf-id y1E8h_tp9ijrOuHfvUV62loWE9SxiWratVT-U7wBg3j-Jg0-O2gX7A== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront x-robots-tag none
GET H3	200	1454429811480805 Show response connect.facebook.net/signals/config/	293 KB 84 KB	164ms 141ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1454429811480805?v=2.9.89&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash ddbe51a8516c0ff2157e5da74d529fb342fae953e39c9070beebfe02ac90bf86 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 08 Nov 2022 23:05:16 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug JCCk6gQ6y1x6vP29lNmwJGXO/y4peM9Q0uF6gd4Y9C3u13gx1IvU71HzMR7acFILKkmHhx8X91cWz4VAkII2CA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 0B35	15 KB 15 KB	19ms 18ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 19:21:27 GMT x-content-type-options nosniff age 13429 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Nov 2023 19:21:27 GMT
GET H3	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 0B35	15 KB 15 KB	19ms 19ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 18:59:48 GMT x-content-type-options nosniff age 14728 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15552 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:33:02 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 08 Nov 2023 18:59:48 GMT
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 377 B	25ms 19ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id sHmGjpmE0dTwDOVOXXOyDTJ_wqRWkkxQgjnNmLBHJBimLmikw_k0Hw==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	78ms 32ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id JMV2Wj_oSM_vhmAAhf8mfYbB0E_pq8qHsdFcMsm6qLwXAO_A-6xhcg== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	79ms 34ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id 0ElDnVSNTdLCwLRoZ_Y--5TGIZmPJDK2NSaMGwDzidWXCGmt0wQJuQ== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 375 B	21ms 19ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id lShkWbd9wtr75Af_aT6rrbi3J0Jg_yvf7jCF6xFOCZt8uZ8EDlIJPQ==
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 375 B	19ms 18ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id mlreGcoaYhJ-rAbryfjp9jDypXjyL6ZwZI1oSPd9Hxpan_DZAM5TEQ==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	77ms 35ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id WIg7HMkOnkYDRFNeQzVO-4U8j_lla2IR511eptm5uNvGMCUX9hiyqg== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 374 B	20ms 19ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id 07Zb08W6xPzQ-h8MV2YdfvFqhAQzikc4f6-UuhgugWdB_HSpam3AIg==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	76ms 35ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id dMLJZyCsjNVyjBFE5e8oc7ZLC4LWylXoUYlEm9Ms4YAudPQVYfWNoQ== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 440 B	85ms 27ms	XHR text/plain	2a00:1450:400c:c1b::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-127044973-1&cid=1745326697.1667948716&jid=1871220521&gjid=1529341761&_gid=147333058.1667948716&_u=aCDAgEAjQAAAAEAEK~&z=2073925277 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c1b::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Tue, 08 Nov 2022 23:05:16 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.spamtitan.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	17ms 16ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j98&a=1792138348&t=pageview&_s=1&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&ul=en-us&de=UTF-8&dt=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgEAjQAAAAAAEK~&jid=1871220521&gjid=1529341761&cid=1745326697.1667948716&tid=UA-127044973-1&_gid=147333058.1667948716&gtm=2wgb70PGM4F3T&cd4=1667948716239.zyrikjgo&cd3=1745326697.1667948716&z=52754725 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 03:42:32 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 69764 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 375 B	19ms 18ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id 8VO0QYCvFLBWAJDUIM5SGtJK_UDofya0GA6Go4dxO-Akv5HeapUj8Q==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	59ms 35ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id 2DycF6D55_WzTQP6qDKHRQbB6VgCmEA4pYctjkIr6TO80OWte3km6g== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D21210%26time%3D1667948716541%26url%3Dhttps%253A%252F%252Fwww.spamtitan.com%252Fbl... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infectio...	0 265 B	706ms 205ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tm=gtmv2&liSync=true&e_ipv6=AQJcrMqiRqEFaAAAAYRZfaRVxzT52oUlx7HTx6AwU1PJPD_pJUui1NGYL29uUJ-IGvxWpYM Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: D471EDD869304FF49990E0BE035CDA4D Ref B: FRAEDGE1509 Ref C: 2022-11-08T23:05:17Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAXs/ZLUeCMpwLXgEytgQw== Redirect headers date Tue, 08 Nov 2022 23:05:16 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 712094DEFE0F4CC1A473F9C292CEC3E8 Ref B: FRAEDGE1216 Ref C: 2022-11-08T23:05:17Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=21210&time=1667948716541&url=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&tm=gtmv2&liSync=true&e_ipv6=AQJcrMqiRqEFaAAAAYRZfaRVxzT52oUlx7HTx6AwU1PJPD_pJUui1NGYL29uUJ-IGvxWpYM x-li-proto http/2 content-length 0 x-li-uuid AAXs/ZLJyR16VruBvF01sA==
POST H2	200	/ Show response www.spamtitan.com/blog/	2 KB 911 B	353ms 353ms	XHR text/html	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/?spu_action=spu_load Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash dd1cafc25caaaec77bfc3d842936752e2c21965f3df0234f62373e59242ebb84 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers Accept text/html, */*; q=0.01 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip strict-transport-security max-age=31536000;includeSubDomains; server Apache vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8 cache-control max-age=600 content-length 846 expires Tue, 08 Nov 2022 23:15:16 GMT
GET H2	200	l use.typekit.net/af/a44b00/000000000000000000015d85/27/	31 KB 31 KB	64ms 16ms	Font application/font-woff2	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/a44b00/000000000000000000015d85/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i7&v=3 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash f650e69bc9dcdbdd16dcc9de8aeb4edad9c69020f0ae6b77dbd7f3fab3bfe706 Request headers Referer https://www.spamtitan.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT server nginx etag "af19d5e445a85c41b184057940ea6c59ad42f874" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 31396
GET H2	200	l use.typekit.net/af/e2496e/0000000000000000000173c7/27/	30 KB 31 KB	79ms 31ms	Font application/font-woff2	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/e2496e/0000000000000000000173c7/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=i4&v=3 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 62a543261d4bf1bd73556f82f628cfbdf94497acc8bf961706c3192151545c0a Request headers Referer https://www.spamtitan.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT server nginx etag "9646400c263b5a32003f555c63ba8fe6c7c02d5c" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 31072
GET H2	200	l use.typekit.net/af/171dea/000000000000000000015d84/27/	31 KB 31 KB	79ms 30ms	Font application/font-woff2	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/171dea/000000000000000000015d84/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1b8abdfd206751f052c8050b4dc9a98e900a5cfc40f32ad9e2b9c1ef8dfb02eb Request headers Referer https://www.spamtitan.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT server nginx etag "e065c3a0b50640ffe4143ae80efed0c7e1db876e" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 31260
GET H2	200	l use.typekit.net/af/2da40a/000000000000000000015d8d/27/	30 KB 30 KB	62ms 15ms	Font application/font-woff2	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/2da40a/000000000000000000015d8d/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 720883ebab1ae48d8904bb7b6080972a3bbbca0f960e4402717460d5bf821c5c Request headers Referer https://www.spamtitan.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT server nginx etag "b1721d429f11281988a95f575560f141c7571466" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 30692
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/	36 B 376 B	16ms 15ms	XHR application/json	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:01:07 GMT content-encoding gzip via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-pop FRA60-P4 age 249 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id O8jnFiNWy60-w0oEdKqnBM5EMYGToHABhu2LyUvqIP_PGZzup2MwyA==
OPTIONS H2	200	token cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/ Frame	0 0	16ms 15ms	Preflight	18.66.147.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/21210/domain/spamtitan.com/token Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.147.107 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-147-107.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method GET Origin https://www.spamtitan.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET access-control-allow-origin * access-control-max-age 1800 age 57575 allow GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH content-length 0 date Tue, 08 Nov 2022 07:05:41 GMT via 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront) x-amz-cf-id 8nJ2qeFBAfhH24fKnB7mT4Z4INGw1zr9fpLnjUzcxesLagnos3kliw== x-amz-cf-pop FRA60-P4 x-cache Hit from cloudfront
GET		S0OSwl1NQ1s www.youtube.com/embed/ Frame 9380	0 0
GET H3	200	S0OSwl1NQ1s Show response www.youtube.com/embed/ Frame 9380	70 KB 28 KB	57ms 57ms	Document text/html	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash f31509595fb04cab1b9bd67536d4f08fa5a64bfc1e6cf71c02d01c8390346946 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" cache-control no-cache, no-store, max-age=0, must-revalidate content-encoding br content-type text/html; charset=utf-8 cross-origin-opener-policy-report-only same-origin; report-to="youtube_main" date Tue, 08 Nov 2022 23:05:16 GMT expires Mon, 01 Jan 1990 00:00:00 GMT p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." permissions-policy ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=* pragma no-cache report-to {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]} server ESF strict-transport-security max-age=31536000 vary Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-content-type-options nosniff x-xss-protection 0
GET H3	200	c.gif grow.clearbitjs.com/api/	35 B 239 B	219ms 182ms	Image image/gif	216.24.57.253 RENDER
General Check archive.org Show headers Download Go to Show image Full URL https://grow.clearbitjs.com/api/c.gif?r=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&c=direct Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H3 Security QUIC, , AES_128_GCM Server 216.24.57.253 , United States, ASN397273 (RENDER, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT strict-transport-security max-age=31536000; includeSubDomains x-content-type-options nosniff cf-cache-status DYNAMIC server cloudflare vary Accept-Encoding content-type image/gif cf-ray 7671f3d81823902e-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	p.gif p.typekit.net/	35 B 214 B	115ms 22ms	Image image/gif	2a02:26f0:3500:16::215:148b AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://p.typekit.net/p.gif?s=1&k=zoa5hea&ht=tk&h=www.spamtitan.com&f=4664.4667.5199.5200&a=769099&js=1.21.0&app=typekit&e=js&_=1667948716786 Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 9b9265c69a5cc295d1ab0d04e0273b3677db1a6216ce2ccf4efc8c277ed84b39 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT last-modified Sat, 09 Oct 2021 02:10:03 GMT server nginx etag "6160f9fb-23" content-type image/gif access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 35
POST H2	200	visit-data Show response in.hotjar.com/api/v2/client/sites/639570/	147 B 322 B	139ms 42ms	XHR application/json	52.48.139.15 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://in.hotjar.com/api/v2/client/sites/639570/visit-data?sv=5 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.ce71d14bfe39cbc54662.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.48.139.15 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-48-139-15.eu-west-1.compute.amazonaws.com Software / Resource Hash 23084b00ffe368652957dcb8afc244c1c432069472e90048b07634fccd27440b Request headers Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain; charset=UTF-8 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding br vary Accept-Encoding access-control-max-age 86400 content-type application/json access-control-allow-origin * cache-control no-cache, no-store access-control-allow-credentials true
GET H3	200	www-player.css www.youtube.com/s/player/c4225c42/ Frame 9380	359 KB 49 KB	16ms 15ms	Stylesheet text/css	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-player.css Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 2bd4827c67760075ffaf32114b41d503da91ccc26f3cf43349607f7b2ff19a1d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:15 GMT content-encoding br x-content-type-options nosniff age 105181 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 49779 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/css cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:15 GMT
GET H3	200	www-embed-player.js Show response www.youtube.com/s/player/c4225c42/www-embed-player.vflset/ Frame 9380	309 KB 96 KB	17ms 16ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 681b6bb35bf9ff8ce07733fe20795e241e59800b6319e6f4f6bf929147f36064 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 98145 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET H3	200	base.js Show response www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/ Frame 9380	2 MB 576 KB	18ms 17ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 845343e662ab11d1fcfc4ad84465f007939cdcba32bc9a4d38a4d38070502f21 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:53:13 GMT content-encoding br x-content-type-options nosniff age 105123 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 589644 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:53:13 GMT
GET H3	200	fetch-polyfill.js Show response www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/ Frame 9380	9 KB 3 KB	22ms 21ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/fetch-polyfill.vflset/fetch-polyfill.js Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:52:22 GMT content-encoding br x-content-type-options nosniff age 105174 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2786 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:52:22 GMT
GET H2	200	/ www.facebook.com/tr/	0 185 B	60ms 17ms	Image text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1454429811480805&ev=PageView&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&rl=&if=false&ts=1667948716827&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=30&fbp=fb.1.1667948716826.842077803&it=1667948716505&coo=false&rqm=GET Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Tue, 08 Nov 2022 23:05:16 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H3	200	KFOmCnqEu92Fr1Mu4mxK.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 9380	15 KB 15 KB	16ms 16ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 19:21:27 GMT x-content-type-options nosniff age 13429 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15344 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:32:55 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Nov 2023 19:21:27 GMT
GET H3	200	KFOlCnqEu92Fr1MmEU9fBBc4.woff2 fonts.gstatic.com/s/roboto/v18/ Frame 9380	15 KB 15 KB	17ms 16ms	Font font/woff2	2a00:1450:4001:812::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.youtube.com/ Origin https://www.youtube.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 18:59:48 GMT x-content-type-options nosniff age 14728 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15552 x-xss-protection 0 last-modified Mon, 16 Oct 2017 17:33:02 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 08 Nov 2023 18:59:48 GMT
GET H2	200	email-flow-for-spam-prevention.jpg www.spamtitan.com/wp-content/uploads/2018/08/	127 KB 128 KB	187ms 187ms	Image image/jpeg	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.spamtitan.com/wp-content/uploads/2018/08/email-flow-for-spam-prevention.jpg Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash 11e456608fd34fe7580eec6c84422921bad51236f0c7b2c65348c9ef9743edd0 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:17 GMT strict-transport-security max-age=31536000;includeSubDomains; last-modified Thu, 27 Oct 2022 15:39:44 GMT server Apache etag "1fbb9-5ec05f349bd1c" vary User-Agent content-type image/jpeg cache-control max-age=31536000 accept-ranges bytes content-length 129977 expires Wed, 08 Nov 2023 23:05:17 GMT
GET H2	200	spufont.woff www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/fonts/	4 KB 4 KB	191ms 191ms	Font application/font-woff	75.119.211.125 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/fonts/spufont.woff?sze5my Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/css/public.css?ver=1.9.3.8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 75.119.211.125 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS ps613909.dreamhostps.com Software Apache / Resource Hash f977bbfe60485a85dd1622f29685463298de1e22044826895f1b631c1ac3de16 Security Headers Name Value Strict-Transport-Security max-age=31536000;includeSubDomains; Request headers Referer https://www.spamtitan.com/blog/wp-content/plugins/popups/public/assets/css/public.css?ver=1.9.3.8 Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:17 GMT strict-transport-security max-age=31536000;includeSubDomains; last-modified Mon, 06 Jan 2020 21:27:46 GMT server Apache etag "1090-59b7f549997c5" vary User-Agent content-type application/font-woff cache-control max-age=172800 accept-ranges bytes content-length 4240 expires Thu, 10 Nov 2022 23:05:17 GMT
GET H3	200	id Show response googleads.g.doubleclick.net/pagead/ Frame 9380	113 B 159 B	23ms 23ms	XHR application/json	2a00:1450:4001:831::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/id Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e283e8d7b33665cf97fa41cb65eb32f3c3154d089201841730e1586e0c7edeea Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:16 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 133 x-xss-protection 0 pragma no-cache server cafe content-type application/json; charset=UTF-8 access-control-allow-origin https://www.youtube.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ad_status.js Show response static.doubleclick.net/instream/ Frame 9380	29 B 588 B	61ms 16ms	Script text/javascript	2a00:1450:4001:812::2006 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://static.doubleclick.net/instream/ad_status.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 22:54:12 GMT x-content-type-options nosniff age 665 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29 x-xss-protection 0 last-modified Thu, 12 Dec 2013 23:40:16 GMT server sffe report-to {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=900 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-doubleclick-media" expires Tue, 08 Nov 2022 23:09:12 GMT
OPTIONS H2	200	Create jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	68ms 23ms	Preflight text/html	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 content-type text/html date Tue, 08 Nov 2022 23:05:17 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
POST H3	200	Create Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 9380	66 KB 30 KB	73ms 33ms	XHR application/json+protobuf	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 28a2d261ce634edfee8138433addca3b647f7bd127c5b19b05a9ae48eaed3a1d Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json+protobuf Response headers date Tue, 08 Nov 2022 23:05:17 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30853 x-xss-protection 0
GET H3	200	remote.js Show response www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/ Frame 9380	118 KB 36 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/remote.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e8a915755688273f134fd5d916936378831d5fb82c2846a1307b273a9efd4cae Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:53:14 GMT content-encoding br x-content-type-options nosniff age 105123 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37223 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:53:14 GMT
GET H3	200	4SYq0xIO-MK2Jr4OcNDxUBrGM44TY0h05pr7aY6Tf6c.js Show response www.google.com/js/th/ Frame 9380	36 KB 14 KB	16ms 15ms	Script text/javascript	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/js/th/4SYq0xIO-MK2Jr4OcNDxUBrGM44TY0h05pr7aY6Tf6c.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e1262ad3120ef8c2b626be0e70d0f1501ac6338e13634874e69afb698e937fa7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 19:18:25 GMT content-encoding br x-content-type-options nosniff age 13612 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14246 x-xss-protection 0 last-modified Thu, 20 Oct 2022 10:30:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 08 Nov 2023 19:18:25 GMT
GET H3	200	embed.js Show response www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/ Frame 9380	26 KB 8 KB	16ms 16ms	Script text/javascript	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/embed.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash a2bfd4599846e27f643dabf88775c33e8417236ae2ad1234299815d2e034cde6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 17:53:28 GMT content-encoding br x-content-type-options nosniff age 105109 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8304 x-xss-protection 0 last-modified Mon, 07 Nov 2022 01:22:49 GMT server sffe vary Accept-Encoding, Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Tue, 07 Nov 2023 17:53:28 GMT
GET DATA	200 OK	truncated / Frame 9380	175 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/png
GET H2	200	s8FvQF3-REhsHAYOCF8CoW3X5SsfJ550IjEQEz-7FAJYCIJ3OPGo9VR0tXSK99vEAVCJmHezJg=s68-c-k-c0x00ffffff-no-rj yt3.ggpht.com/ Frame 9380	1 KB 2 KB	81ms 24ms	Image image/jpeg	2a00:1450:4001:813::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://yt3.ggpht.com/s8FvQF3-REhsHAYOCF8CoW3X5SsfJ550IjEQEz-7FAJYCIJ3OPGo9VR0tXSK99vEAVCJmHezJg=s68-c-k-c0x00ffffff-no-rj Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 86502b6bf8ef64f5f662361968e85d9402ad4e951d745ca693874c651c824117 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 21:47:00 GMT x-content-type-options nosniff age 4697 content-disposition inline;filename="channels4_profile.jpg" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1182 x-xss-protection 0 server fife etag "v1" vary Origin content-type image/jpeg access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Sat, 29 Oct 2022 07:21:40 GMT
GET H2	200	hqdefault.webp i.ytimg.com/vi_webp/S0OSwl1NQ1s/ Frame 9380	16 KB 16 KB	92ms 35ms	Image image/webp	2a00:1450:4001:829::2016 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://i.ytimg.com/vi_webp/S0OSwl1NQ1s/hqdefault.webp Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 532af5e1a74fa1f435769aa10a2d050d54e9101eb5d8227b61d43d4cab5d1ae3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:17 GMT x-content-type-options nosniff server sffe etag "1561636995" vary Origin report-to {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]} content-type image/webp cache-control public, max-age=7200 cross-origin-resource-policy cross-origin accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16330 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="youtube" expires Wed, 09 Nov 2022 01:05:17 GMT
GET H3	204	generate_204 www.youtube.com/ Frame 9380	0 10 B	15ms 15ms	Image text/plain	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.youtube.com/generate_204?-ICZJQ Requested by Host: www.youtube.com URL: https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:17 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0
POST H3	200	GenerateIT Show response jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 9380	90 B 134 B	26ms 25ms	XHR application/json+protobuf	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ecea3f112475b3cd5df5f574e977059348465c338da1e10272570405e7e50d01 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers X-User-Agent grpc-web-javascript/0.1 Referer https://www.youtube.com/ X-Goog-Api-Key AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json+protobuf Response headers date Tue, 08 Nov 2022 23:05:17 GMT content-encoding gzip x-content-type-options nosniff server ESF vary Origin, X-Origin, Referer x-frame-options SAMEORIGIN content-type application/json+protobuf; charset=UTF-8 access-control-allow-origin https://www.youtube.com access-control-expose-headers vary,vary,vary,content-encoding,date,server,content-length cache-control private access-control-allow-credentials true alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 110 x-xss-protection 0
GET H2	200	cast_sender.js Show response www.gstatic.com/cv/js/sender/v1/ Frame 9380	4 KB 3 KB	546ms 30ms	Script text/javascript	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/cv/js/sender/v1/cast_sender.js Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/player_ias.vflset/de_DE/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:17 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2007 x-xss-protection 0 last-modified Tue, 16 Feb 2021 23:57:06 GMT server sffe cross-origin-opener-policy same-origin; report-to="cloudview" vary Accept-Encoding report-to {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Tue, 08 Nov 2022 23:05:17 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame D37A	0 18 B	35ms 16ms	Document text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: www.spamtitan.com URL: https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://www.spamtitan.com Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://www.spamtitan.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Tue, 08 Nov 2022 23:05:17 GMT priority u=0 server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
OPTIONS H3	200	GenerateIT jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame	0 0	22ms 22ms	Preflight text/html	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,x-goog-api-key,x-user-agent Access-Control-Request-Method POST Origin https://www.youtube.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-goog-api-key,x-user-agent access-control-allow-methods DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT access-control-allow-origin https://www.youtube.com access-control-max-age 3600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 content-type text/html date Tue, 08 Nov 2022 23:05:17 GMT server ESF vary origin referer x-origin x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 0
GET H3	200	cast_sender.js Show response www.gstatic.com/eureka/clank/107/ Frame 9380	52 KB 15 KB	47ms 15ms	Script text/javascript	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/eureka/clank/107/cast_sender.js Requested by Host: www.gstatic.com URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c12337c132fc5b05766adf8806c16a2950c0591708c0c45263bc1496979c1870 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.youtube.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 12:01:48 GMT content-encoding gzip x-content-type-options nosniff age 39809 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15116 x-xss-protection 0 last-modified Mon, 05 Sep 2022 15:03:58 GMT server sffe cross-origin-opener-policy same-origin; report-to="cloudview-release" vary Accept-Encoding report-to {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]} content-type text/javascript cache-control public, max-age=86400 accept-ranges bytes expires Wed, 09 Nov 2022 12:01:48 GMT
GET H2	200	core Show response js.driftt.com/ Frame 15C2	2 KB 1 KB	120ms 118ms	Document text/html	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1667949000000/2i729czdfm5i.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 1f1c64bd06e335b8b5c1ce6a80e77a31492ebdaebcae21b9a7239e2f2b1747f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 08 Nov 2022 23:05:18 GMT etag W/"043744249289cce946efa1c885e0b88d" last-modified Mon, 07 Nov 2022 15:33:54 GMT server nginx strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-id Cu5XZJeh4Tz--kWJ2zakIBTkWAkcvXl8vRgkEpjwDYE38HNmh9Meng== x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-amz-version-id 2tBbqtTYuk2rRkOLDANqS_MOz2Btjcdv x-cache RefreshHit from cloudfront
GET H2	200	chat Show response js.driftt.com/core/ Frame 92D9	2 KB 1 KB	120ms 119ms	Document text/html	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1667949000000/2i729czdfm5i.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 1f1c64bd06e335b8b5c1ce6a80e77a31492ebdaebcae21b9a7239e2f2b1747f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.spamtitan.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 08 Nov 2022 23:05:18 GMT etag W/"043744249289cce946efa1c885e0b88d" last-modified Mon, 07 Nov 2022 15:33:54 GMT server nginx strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-id We6kOMtTsKrcm2WcTefOyoHyZ8Zc0NcPA4OkO-eIaDsBXlpMJvnvbA== x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-amz-version-id 2tBbqtTYuk2rRkOLDANqS_MOz2Btjcdv x-cache RefreshHit from cloudfront
GET H/1.1	200	form_flattener.css trust.titanhq.com/acton/content/	8 KB 2 KB	39ms 38ms	Stylesheet text/css	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://trust.titanhq.com/acton/content/form_flattener.css Requested by Host: trust.titanhq.com URL: https://trust.titanhq.com/acton/content/form_embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash d8654bb4dce6dcc5993a7604141dab13d86c061ea7441897426d4f61e9d13c85 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:05:17 GMT Content-Encoding gzip Last-Modified Wed, 02 Nov 2022 17:53:14 GMT ETag W/"8569-1667411594000" Vary Accept-Encoding Content-Type text/css;charset=UTF-8 Connection keep-alive Accept-Ranges bytes Keep-Alive timeout=10 Content-Length 1762
GET H/1.1	200	ac7228c3-c0dc-43a6-8e67-755731ad722b:d-0001 Show response trust.titanhq.com/acton/openapi/form/v1/31047/	13 KB 3 KB	157ms 156ms	XHR application/json	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://trust.titanhq.com/acton/openapi/form/v1/31047/ac7228c3-c0dc-43a6-8e67-755731ad722b:d-0001?ts=1667948717953&noStyle=1 Requested by Host: trust.titanhq.com URL: https://trust.titanhq.com/acton/content/form_embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash 69100eb6478f158d0ed4d5d6dd95da42efd80bda11cf5f5cf0b6bce575d72e45 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:05:17 GMT Content-Encoding gzip Vary Accept-Encoding Transfer-Encoding chunked Content-Type application/json;charset=UTF-8 Access-Control-Allow-Origin https://www.spamtitan.com Cache-Control private Access-Control-Allow-Credentials true Connection keep-alive Keep-Alive timeout=10 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200	b8e20052-9853-49b4-a03b-e900a9837361:d-0001 Show response trust.titanhq.com/acton/openapi/form/v1/31047/	12 KB 2 KB	156ms 116ms	XHR application/json	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://trust.titanhq.com/acton/openapi/form/v1/31047/b8e20052-9853-49b4-a03b-e900a9837361:d-0001?ts=1667948717953&noStyle=1 Requested by Host: trust.titanhq.com URL: https://trust.titanhq.com/acton/content/form_embed.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash 3644ad20c5ebb88ab77902811351506261b138c2396267bda3f874f908c2225d Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:05:17 GMT Content-Encoding gzip Vary Accept-Encoding Transfer-Encoding chunked Content-Type application/json;charset=UTF-8 Access-Control-Allow-Origin https://www.spamtitan.com Cache-Control private Access-Control-Allow-Credentials true Connection keep-alive Keep-Alive timeout=10 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H/1.1	200	31047 trust.titanhq.com/acton/bn/	43 B 482 B	159ms 41ms	Image image/gif	54.76.54.113 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://trust.titanhq.com/acton/bn/31047?target=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&ref=&v=2&ts=1667948716254&nc=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.76.54.113 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-76-54-113.eu-west-1.compute.amazonaws.com Software / Resource Hash 2188414d64d2930eb54f4731b6eb9a931358ba625d1cd7535a889409218609d2 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/gif Date Tue, 08 Nov 2022 23:05:17 GMT X-Cnection close Content-Length 43 Vary Accept-Encoding P3P CP="Act-On does not have a P3P policy. Learn why here: https://act-on.com/p3p-policy/"
POST H/1.1	200 OK	mhct.php Show response www.dynamicnumbers.mediahawk.co.uk/	211 B 531 B	178ms 67ms	XHR text/plain	162.13.32.69 RACKSPACE-LON
General Check archive.org Show headers Download Go to Full URL https://www.dynamicnumbers.mediahawk.co.uk/mhct.php Requested by Host: www.dynamicnumbers.mediahawk.co.uk URL: https://www.dynamicnumbers.mediahawk.co.uk/mhct.min.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 162.13.32.69 , United Kingdom, ASN15395 (RACKSPACE-LON, GB), Reverse DNS app4.mediahawk.co.uk Software Apache / Resource Hash a174b2b35f1e9ddc6386809fd20c494378f6353d1834847c7aa3a37a53856004 Request headers Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers Date Tue, 08 Nov 2022 23:05:18 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding Access-Control-Allow-Methods PUT, GET, POST, DELETE, OPTIONS Content-Type text/plain;charset=UTF-8 Access-Control-Allow-Origin * Connection close Access-Control-Allow-Headers origin, x-requested-with, content-type Content-Length 167
GET H3	200	collect www.google-analytics.com/	35 B 55 B	16ms 15ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j98&a=1792138348&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&ul=en-us&de=UTF-8&dt=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&el=10&_u=aDDAgEAjQAAAAEAEK~&jid=&gjid=&cid=1745326697.1667948716&tid=UA-127044973-1&_gid=147333058.1667948716&gtm=2wgb70PGM4F3T&cd4=1667948717982.ggshrgdt&cd3=1745326697.1667948716&z=131074084 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 03:42:32 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 69766 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	16ms 16ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j98&a=1792138348&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&ul=en-us&de=UTF-8&dt=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scroll%20Depth&ea=%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&el=25&_u=aDDAgEAjQAAAAEAEK~&jid=&gjid=&cid=1745326697.1667948716&tid=UA-127044973-1&_gid=147333058.1667948716&gtm=2wgb70PGM4F3T&cd4=1667948717990.fx54ha94&cd3=1745326697.1667948716&z=1131735974 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 03:42:32 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 69766 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	runtime~main.b81d0aa3.js Show response js.driftt.com/core/assets/js/ Frame 15C2	6 KB 3 KB	16ms 15ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash faf60401ebbede455af7ea597d3a1e46d1ec82ab347d25e0c9411eb36f910553 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:53 GMT x-amz-version-id fzmxtdDOgz00wae8QB7XmgyiJkrhVaPt content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113485 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:09 GMT server nginx etag W/"0cb20af1e879a0d008136dec2adb9760" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id STG4XICzjmmJJW4tQFfTnRdBLJVwSbUZ_UXG8ZkAiWDJxmFFeEpUow==
GET H2	200	8.611ead2e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	35 KB 13 KB	16ms 16ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 09 Jun 2022 19:59:49 GMT x-amz-version-id _RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 13143929 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 09 Jun 2022 14:58:14 GMT server nginx etag W/"6aa29962f34a8e117268142c7cc1cc3d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id iC6oZyJiKT1sZZEzZvSiZw392FkbMKfR4CtHjTkPSGHOflz2cN4EsQ==
GET H2	200	main~493df0b3.d3ac7d8e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	7 KB 3 KB	17ms 17ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.d3ac7d8e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 7ad9ef3a4bc35c8e26b515b58bfa16be478746a7716c91b69c5d53222986f959 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:47 GMT x-amz-version-id 1PMN2YZru9S0WwHo36rIqDOML6PItZQh content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974071 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:23 GMT server nginx etag W/"f953d4d3bced33e843c6d5f9a6da145f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id FKLyPwmby6DErTshKXi1aU0or2UHw4gp6tCZmH_CZSYwBGv4dYXWyw==
GET H2	200	runtime~main.b81d0aa3.js Show response js.driftt.com/core/assets/js/ Frame 92D9	6 KB 3 KB	16ms 16ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash faf60401ebbede455af7ea597d3a1e46d1ec82ab347d25e0c9411eb36f910553 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:53 GMT x-amz-version-id fzmxtdDOgz00wae8QB7XmgyiJkrhVaPt content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113485 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:09 GMT server nginx etag W/"0cb20af1e879a0d008136dec2adb9760" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _dUdKJ8xQE_JIIJZpoEGJl1pyssnamjcXXccP3_k9rN04i8d0wApGQ==
GET H2	200	8.611ead2e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	35 KB 13 KB	18ms 17ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 09 Jun 2022 19:59:49 GMT x-amz-version-id _RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 13143929 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 09 Jun 2022 14:58:14 GMT server nginx etag W/"6aa29962f34a8e117268142c7cc1cc3d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id XHJy-gT2yrFQtfTP4IFpxrASnq10PFfOguo1XIiEYNxSwSk8lRNa4A==
GET H2	200	main~493df0b3.d3ac7d8e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	7 KB 3 KB	18ms 18ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.d3ac7d8e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 7ad9ef3a4bc35c8e26b515b58bfa16be478746a7716c91b69c5d53222986f959 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:47 GMT x-amz-version-id 1PMN2YZru9S0WwHo36rIqDOML6PItZQh content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974071 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:23 GMT server nginx etag W/"f953d4d3bced33e843c6d5f9a6da145f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 4HmrAyCIknSJ81Ma7WtCA1Av1jVTiQuq2L3BnNJSJnbX_7Y0A4oIQw==
GET H2	200	49.b6336d11.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	23 KB 8 KB	24ms 16ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 1cb2a3ed712d8fcfa64505237ae54ffe9f2f5d293f371f40871d830891568b88 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id tFkawZ7Fd.jveKk2Q_grwX_qW9zyzYsf content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:30 GMT server nginx etag W/"8004ba5ba9fc99e5c559490658a3863f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id nZdsTvFRcz0L6UjoghkviqGhhtIFlmaBtGTlAKDRldEJYaLZrh07XQ==
GET H2	200	33.ae4de0a0.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	36 KB 10 KB	27ms 18ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.ae4de0a0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id HixqumxK82A.kHDuHBPfmn6VAN6aPH4h content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:30 GMT server nginx etag W/"db0cd5b66c52523e10b87a0c8a2db182" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id R95nOur8F2gFML8aQGiLJQ9G-DkobK_7K_D0uWK93iRMuF4oZyxriQ==
GET H2	200	23.60057654.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	32 KB 11 KB	27ms 19ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.60057654.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 489eb2769765657c9325f65117f5c7b87ffc4eab547622608c12c8f6fd60df1b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id A.jwRfFHKkUyhAxHnaTtscpVGcKmzGah content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:29 GMT server nginx etag W/"0e963aeeee70e63f5078955e6db860f3" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 5rW8xsRd0t9VkezIDagRXsxEY8kB3OxwcbGiPhpQNjQ1GeNwSZWmDA==
GET H2	200	18.2ab31195.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	17 KB 5 KB	28ms 20ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.2ab31195.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash a0da3cdc4c400e5e5030c733b68bff8fddc8c4c82c2432330fa8cb858b16bd85 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sat, 29 Oct 2022 01:24:42 GMT x-amz-version-id j4jJT.0DNiEfhPFz6.1hx2AtFTUpNBZz content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 942036 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:20 GMT server nginx etag W/"09e4a870348ecb960c5807c49bbf0c16" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id _2152V8KmqH6Ti_s0wMUTPxOcDVylTPAd0g1J0yKUUWGUQU5WJiKcg==
GET H2	200	40.5fa801cd.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	25 KB 8 KB	28ms 21ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.5fa801cd.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 759a08226cc8d5a5a89c64b7f814457ee6191384f30e4dc9cd123aaf279003fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sun, 30 Oct 2022 00:24:39 GMT x-amz-version-id ZGtJfEWa_xLDh.3_Sm0.6L8ahZc2GhtT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 859239 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:21 GMT server nginx etag W/"e7d37d5ffc01767c10d8677c65ead60b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id a3dEU-_Y-ciohjSKNGuStR7S-WVJ8s_rLsQQvjslQu9dLLKobhKGeA==
GET H2	200	20.8c21ea18.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	74 KB 23 KB	30ms 22ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Wed, 06 Jul 2022 11:53:35 GMT x-amz-version-id DvU1VknvadEMM0li2kjSs2rGEgsC.2zC content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 10840303 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 01 Jul 2022 20:20:56 GMT server nginx etag W/"6d77a76055d81227033363af2f18caf8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id fKUNHsHfGJOUWUmWGH9PeR9EeZH31ZcjeVpGqwsLSkPTc5pur_TiMg==
GET H2	200	25.8f107198.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	59 KB 19 KB	31ms 25ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.8f107198.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 27 Jun 2022 07:26:46 GMT x-amz-version-id eI68DKvvjxiDbX_K1dX4xe2PNV6BS0F2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 11633912 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 17 Jun 2022 14:39:27 GMT server nginx etag W/"e2511c69e5bdc03467952abaccdb5383" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QpwzzfN2ucuNBrKNeyQ24gGVAD_pbjbXuqEoZAyUGf0c8Ha9OjgeEw==
GET H2	200	13.3e86f1f6.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	91 KB 28 KB	32ms 27ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 27 Jun 2022 07:26:46 GMT x-amz-version-id 2rH9Vw5zwyFjPSSMs.YwDeMiE5sBqg4r content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 11633912 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 17 Jun 2022 14:39:26 GMT server nginx etag W/"fdee1a560ca08e3d3702e14d8f1f0b82" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id V5rAGVnW3tlFHli5_wHaWC6WcmRYh36lSOU2Q_LcLwY_OpZB4Ho92g==
GET H2	200	11.639238ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	23 KB 7 KB	33ms 28ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/11.639238ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sun, 18 Sep 2022 01:32:02 GMT x-amz-version-id 41Rj_7QKP59w2WnODlMWAa6QFTo_5uBY content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4483996 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 16 Sep 2022 16:12:57 GMT server nginx etag W/"4049f38c00add1738dc4806148ff8829" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id B0_dY6Ec_34ZbbbZWcKJ8AhwG04cr1AjVU_mqzZzyf6u_YaRYnL9fA==
GET H2	200	16.fde6fa28.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	62 KB 20 KB	34ms 29ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 30 Aug 2022 01:42:02 GMT x-amz-version-id 4419YFPoRA1JyzCepHPPe9MgW2odb2j5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6124995 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 25 Aug 2022 21:13:15 GMT server nginx etag W/"90795af8c950a50300cf801b300db7ab" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ShiVzZNsq4sR5BqJMjXRAvB3oEIUYhCA3ySjPImdnOx3eonkdra-2g==
GET H2	200	47.9d4808ed.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	105 KB 34 KB	36ms 32ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/47.9d4808ed.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 20997bd3984886e845f5a5e0d036f9808a5e30051f219705ef4e6ef1ef1b0f55 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 01 Nov 2022 03:29:14 GMT x-amz-version-id 5.qlQZugXZmIeUzMQ5iuiZuCWncn2USj content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 675364 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 31 Oct 2022 16:19:37 GMT server nginx etag W/"dfc66008c702c40fea0587f735010013" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id la9aGbJySogHJybatUruSnFjSQsG5lB95vvt5InHUx6t4zqZGosV0g==
GET H2	200	38.5941b51c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	12 KB 4 KB	40ms 36ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/38.5941b51c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 62eb2106959f57e67d6a5209dc51af437b7b61a4256fd93b1a822e4d606ef9ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 02:07:00 GMT x-amz-version-id d8TIPZmWDWO9Yh1PxV831Dnon8d0661F content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 421098 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 00:27:55 GMT server nginx etag W/"aa24724b97a516c589a05bc577d15db9" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id edP-jaljdrBZvz7CEBqh5eia3IoDu-cGuaM_D-E9ttHBh48O_r4hNA==
GET H2	200	28.190877b8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	13 KB 6 KB	41ms 37ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/28.190877b8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 01:21:41 GMT x-amz-version-id XNe27IyH0CuVErKbmWDfSMo019HBMs8f content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 423817 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 00:27:54 GMT server nginx etag W/"94c7e7cb2f40e10abeee8e28c0f68eb7" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tYSfV6p0yMREf4Fs2NdEXN-3k9JIi4ty5MArpyPQYSvDZhuqueDN5A==
GET H2	200	21.b8c41db9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	17 KB 7 KB	41ms 37ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 27 Oct 2022 05:08:55 GMT x-amz-version-id EYZ7uhLGB_IusLdu9MjAoVbxz3x8SiAp content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1101383 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Wed, 26 Oct 2022 23:22:49 GMT server nginx etag W/"65e5c965272e021ae33ff8bc39565ef5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tsUbasStN0unlmFEZXb6oK54Gv8au6pEt7anbP6cXkI1FrG9WWcDNA==
GET H2	200	9.7980313a.chunk.css js.driftt.com/core/assets/css/ Frame 15C2	14 KB 3 KB	20ms 17ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/9.7980313a.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 30 Sep 2022 08:00:43 GMT x-amz-version-id pYz13ynN1RmHsYVNLJx0AFxc0UfReNe_ content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3423875 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 29 Sep 2022 20:45:23 GMT server nginx etag W/"97ab5d7bf24ef1c4f1e14801b9a510ed" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id P-_BEB1mPBMO1ph073aHcSM0SmUEbovQYeaG_D2d8rISWuWxMbNAcQ==
GET H2	200	9.76f0925b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	77 KB 24 KB	41ms 38ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.76f0925b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 21cc357e7984034b068f839893fdc78ecb5aa0f8035f7b62f4da2b3aecbe294b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 15:39:09 GMT x-amz-version-id RflLcTQby9HYfz3hCLliagik4TL9seb5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 372369 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 15:28:41 GMT server nginx etag W/"307b6673b71da7fd9880cf5a03f2c832" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id MpTwYYYOcxkzHiAP8gHYAzsUEiFPABFTaffl89caEBXox6CMzaPIvw==
GET H2	200	15.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 15C2	24 B 667 B	20ms 17ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 03 Oct 2022 11:02:35 GMT x-amz-version-id 4HaliywZLTbWidTr9jxerhwMhVKcNAWE via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 3153763 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Wed, 08 Jun 2022 17:19:34 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Wjls5qjATSLcO4DE67y0oc7m0VRmS2zxY2axMrexzXMZTkd28fnpxw==
GET H2	200	15.4347f92d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	82 KB 21 KB	43ms 40ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.4347f92d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash e58a78ea88dc248a596a6680651391ee8418eef40fde0b3e8e466d659ab190b2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:48 GMT x-amz-version-id EMu1dIpDioM6SDhyv4Sa85gFBFJgnVsp content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974070 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:20 GMT server nginx etag W/"931cd204b6b8fc7f22a553a45d651d5b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id S5bH6wyIqRHIOUAKNOyP3zHH3HhUq4vAyoVDuWbBg55RZxuiCwQ_IA==
GET H2	200	24.5d131ad4.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	49 KB 13 KB	45ms 42ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.5d131ad4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash f93d1c9c148ff1b9dabf8b9e5a31725bc67f399c2bcda36fe2a51120d249366f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:54 GMT x-amz-version-id YwVatK0tF831EYS_xzFElTvOR_qUPBjG content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113484 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:07 GMT server nginx etag W/"eb794aec4227f4563e32c26e3b39cf2a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id wwUs4QURE2DdBrLH1xrYbSZbqU90yBZw2gYBuexJfUqKFClgYZa_FQ==
GET H2	200	17.0e8fce4e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	39 KB 13 KB	46ms 43ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.0e8fce4e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 24627453d7a9e7b63bdd10a8d7e79ee1826249f5dab53974f8f69b982fba1d47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:54 GMT x-amz-version-id M_ALUX9R3QPhe6ss8HQU3cj8wYIXg71L content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113484 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:06 GMT server nginx etag W/"9a276118dad90f50059587aa1d99006d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id jVIURS3wGdUqyTKjhDubeAzZ_aqgQSWEzYNJ3RMcFctUqzT_Sh85Qg==
GET H2	200	webfont.js Show response ajax.googleapis.com/ajax/libs/webfont/1.5.18/	16 KB 7 KB	81ms 16ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/webfont/1.5.18/webfont.js Requested by Host: trust.titanhq.com URL: https://trust.titanhq.com/acton/content/form_embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 03:23:04 GMT content-encoding gzip x-content-type-options nosniff age 157334 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6490 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 07 Nov 2023 03:23:04 GMT
GET H3	200	api.js Show response www.google.com/recaptcha/	850 B 578 B	25ms 25ms	Script text/javascript	2a00:1450:4001:801::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: trust.titanhq.com URL: https://trust.titanhq.com/acton/content/form_embed.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash a30f9c9098db492124f51f094cec56735a8c3acd0dce707142a1c2edb569b8b4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.spamtitan.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:05:18 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 557 x-xss-protection 1; mode=block expires Tue, 08 Nov 2022 23:05:18 GMT
GET H2	200	49.b6336d11.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	23 KB 8 KB	32ms 21ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 1cb2a3ed712d8fcfa64505237ae54ffe9f2f5d293f371f40871d830891568b88 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id tFkawZ7Fd.jveKk2Q_grwX_qW9zyzYsf content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:30 GMT server nginx etag W/"8004ba5ba9fc99e5c559490658a3863f" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 4PcMhYkPhNwDWVYwaBCCqng9sTyGQfZR_AqRHYQHsCEStDQtIbrqLw==
GET H2	200	33.ae4de0a0.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	36 KB 10 KB	34ms 22ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/33.ae4de0a0.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash e12404ccb0492da0a89fbda8db0ddb3c2358fcbd6d29b0c106ba840ca5f5e8ab Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id HixqumxK82A.kHDuHBPfmn6VAN6aPH4h content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:30 GMT server nginx etag W/"db0cd5b66c52523e10b87a0c8a2db182" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tuVmP8lBknzdyuMgOyL4hk1qj7hDi8jqTpsnTFCXwZSYzTfIsyq6Gw==
GET H2	200	23.60057654.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	32 KB 11 KB	34ms 22ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/23.60057654.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 489eb2769765657c9325f65117f5c7b87ffc4eab547622608c12c8f6fd60df1b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 14 Oct 2022 15:00:24 GMT x-amz-version-id A.jwRfFHKkUyhAxHnaTtscpVGcKmzGah content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2189094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 14 Oct 2022 14:29:29 GMT server nginx etag W/"0e963aeeee70e63f5078955e6db860f3" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id CndEeXthzsXQ79X0_EXfGr6HTT0j0hqXzDjM0pNKWj3yngVYqg1WVw==
GET H2	200	18.2ab31195.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	17 KB 5 KB	34ms 23ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.2ab31195.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash a0da3cdc4c400e5e5030c733b68bff8fddc8c4c82c2432330fa8cb858b16bd85 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sat, 29 Oct 2022 01:24:42 GMT x-amz-version-id j4jJT.0DNiEfhPFz6.1hx2AtFTUpNBZz content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 942036 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:20 GMT server nginx etag W/"09e4a870348ecb960c5807c49bbf0c16" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id DS0fl-HYz6DzbtS7GLoLl83AMZmxnO9-f1p9YbtT5hW8E-v56PEvZA==
GET H2	200	40.5fa801cd.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	25 KB 8 KB	35ms 23ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.5fa801cd.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 759a08226cc8d5a5a89c64b7f814457ee6191384f30e4dc9cd123aaf279003fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sun, 30 Oct 2022 00:24:39 GMT x-amz-version-id ZGtJfEWa_xLDh.3_Sm0.6L8ahZc2GhtT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 859239 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:21 GMT server nginx etag W/"e7d37d5ffc01767c10d8677c65ead60b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Ey1GDNVVTPCdGQYVPEcivGC-tlYOeEn6U5r0o2sCklDu25o7Nv9ZiA==
GET H2	200	20.8c21ea18.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	74 KB 23 KB	35ms 24ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Wed, 06 Jul 2022 11:53:35 GMT x-amz-version-id DvU1VknvadEMM0li2kjSs2rGEgsC.2zC content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 10840303 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 01 Jul 2022 20:20:56 GMT server nginx etag W/"6d77a76055d81227033363af2f18caf8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id E66lYrZk2G--lfs--JFzmFdKUMuWzZoItrEYAhfViM8JJxlT3DnedA==
GET H2	200	25.8f107198.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	59 KB 19 KB	36ms 25ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.8f107198.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 27 Jun 2022 07:26:46 GMT x-amz-version-id eI68DKvvjxiDbX_K1dX4xe2PNV6BS0F2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 11633912 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 17 Jun 2022 14:39:27 GMT server nginx etag W/"e2511c69e5bdc03467952abaccdb5383" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id mFi6LFBKOXRCn5T3i8tWCjGIZLq2PalEKSDVQfP6Zl4ee3A5iLzCmg==
GET H2	200	13.3e86f1f6.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	91 KB 28 KB	36ms 26ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 27 Jun 2022 07:26:46 GMT x-amz-version-id 2rH9Vw5zwyFjPSSMs.YwDeMiE5sBqg4r content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 11633912 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 17 Jun 2022 14:39:26 GMT server nginx etag W/"fdee1a560ca08e3d3702e14d8f1f0b82" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ZhWyJSXaLuvR4ESWXnSuniT5xPmp_4QKRY_5qNf-ph50TnE5zViDFA==
GET H2	200	11.639238ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	23 KB 7 KB	37ms 27ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/11.639238ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sun, 18 Sep 2022 01:32:02 GMT x-amz-version-id 41Rj_7QKP59w2WnODlMWAa6QFTo_5uBY content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4483996 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 16 Sep 2022 16:12:57 GMT server nginx etag W/"4049f38c00add1738dc4806148ff8829" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NCi7lJnaKISbqhcmyc1CSX32IpP0h5bUHkQCzlhjwwKdQ5qot6lrcw==
GET H2	200	16.fde6fa28.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	62 KB 20 KB	38ms 27ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 30 Aug 2022 01:42:02 GMT x-amz-version-id 4419YFPoRA1JyzCepHPPe9MgW2odb2j5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6124995 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 25 Aug 2022 21:13:15 GMT server nginx etag W/"90795af8c950a50300cf801b300db7ab" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tljOW1Nj3yzPqIN6lVWCNuZNZfpsB7v62HA_vIQANsiXb3WKakS9lQ==
GET H2	200	47.9d4808ed.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	105 KB 34 KB	39ms 29ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/47.9d4808ed.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 20997bd3984886e845f5a5e0d036f9808a5e30051f219705ef4e6ef1ef1b0f55 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 01 Nov 2022 03:29:14 GMT x-amz-version-id 5.qlQZugXZmIeUzMQ5iuiZuCWncn2USj content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 675364 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 31 Oct 2022 16:19:37 GMT server nginx etag W/"dfc66008c702c40fea0587f735010013" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id IIqIhsrYqzMPUQl68gZrFVQ44z2VF_wxHzbB1pZEkSxiUWg04lwzqw==
GET H2	200	38.5941b51c.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	12 KB 4 KB	40ms 30ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/38.5941b51c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 62eb2106959f57e67d6a5209dc51af437b7b61a4256fd93b1a822e4d606ef9ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 02:07:00 GMT x-amz-version-id d8TIPZmWDWO9Yh1PxV831Dnon8d0661F content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 421098 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 00:27:55 GMT server nginx etag W/"aa24724b97a516c589a05bc577d15db9" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id jXwneCcFVQejVwEHzkYZfBwLDCMkX6xLr0y12nJkI_X2aiwrS7I7tg==
GET H2	200	28.190877b8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	13 KB 6 KB	40ms 31ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/28.190877b8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 01:21:41 GMT x-amz-version-id XNe27IyH0CuVErKbmWDfSMo019HBMs8f content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 423817 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 00:27:54 GMT server nginx etag W/"94c7e7cb2f40e10abeee8e28c0f68eb7" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id P0-d0qnXGubKDdAu1adfU42cGwGVCgo_p_U8JjLnBhHkp1gU-MW9DQ==
GET H2	200	21.b8c41db9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	17 KB 7 KB	41ms 31ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 27 Oct 2022 05:08:55 GMT x-amz-version-id EYZ7uhLGB_IusLdu9MjAoVbxz3x8SiAp content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1101383 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Wed, 26 Oct 2022 23:22:49 GMT server nginx etag W/"65e5c965272e021ae33ff8bc39565ef5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QvFf9Upw9s3WZc2KqXW3gUqqIPLdB3E7daNwYOOtmVXWkRq3J9Bhcg==
GET H2	200	9.7980313a.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	14 KB 3 KB	29ms 20ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/9.7980313a.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 30 Sep 2022 08:00:43 GMT x-amz-version-id pYz13ynN1RmHsYVNLJx0AFxc0UfReNe_ content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3423875 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 29 Sep 2022 20:45:23 GMT server nginx etag W/"97ab5d7bf24ef1c4f1e14801b9a510ed" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id VtDSjVdmbQaqmxkbASnuOYTVCi3avdTofOrmDSYHVArG4E7P0Xy71w==
GET H2	200	9.76f0925b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	77 KB 24 KB	42ms 34ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.76f0925b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 21cc357e7984034b068f839893fdc78ecb5aa0f8035f7b62f4da2b3aecbe294b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 15:39:09 GMT x-amz-version-id RflLcTQby9HYfz3hCLliagik4TL9seb5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 372369 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 15:28:41 GMT server nginx etag W/"307b6673b71da7fd9880cf5a03f2c832" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tW11imUSlLl6nfkE2p_9Ln8rPtDSH2TtBVioXabDcbo80l3pis1KnQ==
GET H2	200	15.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	24 B 667 B	29ms 21ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 03 Oct 2022 11:02:35 GMT x-amz-version-id 4HaliywZLTbWidTr9jxerhwMhVKcNAWE via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 3153763 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 24 last-modified Wed, 08 Jun 2022 17:19:34 GMT server nginx etag "0c5dad92482d9a7c7c253510f5082465" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Hw6OuFC0XrqXl43cRme21GL0Nj-12e-1t9qksrX9K3jXIWHsOk5SRQ==
GET H2	200	15.4347f92d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	82 KB 21 KB	42ms 34ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/15.4347f92d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash e58a78ea88dc248a596a6680651391ee8418eef40fde0b3e8e466d659ab190b2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:48 GMT x-amz-version-id EMu1dIpDioM6SDhyv4Sa85gFBFJgnVsp content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974070 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:20 GMT server nginx etag W/"931cd204b6b8fc7f22a553a45d651d5b" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id SOUQrJl07mFddIO81fCssRtWhFdXQwa9ltX33ISOMvhyyJBeLuGs3w==
GET H2	200	24.5d131ad4.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	49 KB 13 KB	43ms 36ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.5d131ad4.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash f93d1c9c148ff1b9dabf8b9e5a31725bc67f399c2bcda36fe2a51120d249366f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:54 GMT x-amz-version-id YwVatK0tF831EYS_xzFElTvOR_qUPBjG content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113484 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:07 GMT server nginx etag W/"eb794aec4227f4563e32c26e3b39cf2a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id jUq8sMlHUJSBILWRIdo8lRNQLPH1-h3PwgklFtdeUgvQYTJzhx1tFg==
GET H2	200	17.0e8fce4e.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	39 KB 13 KB	44ms 36ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.0e8fce4e.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 24627453d7a9e7b63bdd10a8d7e79ee1826249f5dab53974f8f69b982fba1d47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 07 Nov 2022 15:33:54 GMT x-amz-version-id M_ALUX9R3QPhe6ss8HQU3cj8wYIXg71L content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 113484 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 07 Nov 2022 15:08:06 GMT server nginx etag W/"9a276118dad90f50059587aa1d99006d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id I_TKJvXijWIBSXe22okQGWqIt77OtovjLZLFqRTHP0CDbFDj2dL3Cg==
GET H3	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/Ixi5IiChXmIG6rRkjUa1qXHT/	401 KB 160 KB	47ms 15ms	Script text/javascript	2a00:1450:4001:813::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/Ixi5IiChXmIG6rRkjUa1qXHT/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 66b80bb60358d7df2363a820db30ee5123741da3e4c60b1c5a9bb9fb8b7f520c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.spamtitan.com/ Origin https://www.spamtitan.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 22:29:05 GMT content-encoding gzip x-content-type-options nosniff age 2173 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 163409 x-xss-protection 0 last-modified Mon, 31 Oct 2022 04:02:45 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Wed, 08 Nov 2023 22:29:05 GMT
GET H2	200	0.0b2ebd4a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	9 KB 3 KB	19ms 17ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 06 Sep 2022 00:41:02 GMT x-amz-version-id E.Le1HHD6dXp1z9JLSdA8U2RMDD.dyV2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5523856 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 01 Sep 2022 13:18:43 GMT server nginx etag W/"c5efcdc9e465604f32cf24af10fd6c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 0r7L7DFS8Y91Dyb1bjz4mgFpeD9yXm3jAA6S3kptl3OUPp0B8Oc6Zw==
GET H2	200	26.2d4cdbd1.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	34 KB 10 KB	43ms 41ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/26.2d4cdbd1.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 71e905aff9bad1d3b5a783336fcdd013cc97beb8985e4cd2cf7d195925a48211 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 10 Oct 2022 09:56:45 GMT x-amz-version-id JuVNKY1uQxqC7oXb2J_bVtt2v4y2Pl_2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2552913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 07 Oct 2022 18:34:45 GMT server nginx etag W/"c55d27c90bd5affbf7c7047151ac3b6a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id qPKHiDMzqR3jMVEqH-EyAYPiaTyig_dyMlbr3MhaZRFxMBWEjB1Dzw==
GET H2	200	27.9bf46b67.chunk.css js.driftt.com/core/assets/css/ Frame 15C2	8 KB 2 KB	39ms 37ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/27.9bf46b67.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 30 Aug 2022 01:42:04 GMT x-amz-version-id o6Mn8iWshgmcy2o5f_hocRiRC01jfiMI content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6124994 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 25 Aug 2022 21:13:13 GMT server nginx etag W/"4f21faf2ba450e5fcdf7eda90813e185" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id QQ9bMlKdzhVThzBr8OOzBzF_-EuiphZz94Ge22QLC07E5ZhVYsKf0Q==
GET H2	200	27.7659dd6f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	14 KB 6 KB	44ms 43ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/27.7659dd6f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 08d58eea55ad5fe4d16a05e54bf4d5a6c7039ded3276585ed2c8d0d6e4e3118a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 15:39:10 GMT x-amz-version-id K9i7o4s1sMuY5Mge2dc4_5UfBKvGpyZH content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 372368 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 15:28:39 GMT server nginx etag W/"d7b61d1b01a22d82018c40d322ce7053" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id uPwwd9Hw4hAFAgaA_48d09o7UFfQccxOlAPqYi7ElXo-0gHGPm8cew==
GET H2	200	19.c695453b.chunk.css js.driftt.com/core/assets/css/ Frame 15C2	365 B 1008 B	39ms 38ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/19.c695453b.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 01 Nov 2022 03:29:14 GMT x-amz-version-id y7iWOn0R1U7aQ4DsTKf7rZV8hg.t2xRd via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 675364 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront content-length 365 last-modified Mon, 31 Oct 2022 16:19:34 GMT server nginx etag "06b2963b029c0824382815165bfea73e" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id y3gqchkd6QctO1ZzmwCvBbHKL3fcIQHOpbSxgqV5KhMbpqm4jlwbKw==
GET H2	200	19.e282959d.chunk.js Show response js.driftt.com/core/assets/js/ Frame 15C2	91 KB 26 KB	44ms 43ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.e282959d.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 14b1387a04f18b3807a637d7b856207b0a7188e9fff311474dd2b8ce486a28c0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=2i729czdfm5i&eId=2i729czdfm5i&region=US&forceShow=false&skipCampaigns=false&sessionId=1a3c3415-2192-48fb-9e14-5b697a4cf455&sessionStarted=1667948717.942&campaignRefreshToken=45eaa75a-4309-4e23-9dda-9ae41ebc0542&hideController=false&pageLoadStartTime=1667948715671&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:48 GMT x-amz-version-id i7BVGECSOaxVW7P0zWoxr8Q70YyB9.h7 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974070 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:20 GMT server nginx etag W/"e769e6a1f3a8bd1b184c977ffa6e3e9a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ImbrSo7GtKxWMVZEGAUQBmt0hRWIKy6j7HDaZr4uc-bRu0PyNcDU0w==
GET H2	200	35.11d2b6a7.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	3 KB 1 KB	16ms 15ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/35.11d2b6a7.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 03 Nov 2022 01:01:28 GMT x-amz-version-id qsoPY7qY.tFlw1iANXIl3P5I7WdRk.n7 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 511430 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Tue, 01 Nov 2022 17:39:35 GMT server nginx etag W/"87532c4db85f1429fa6d759bc3332f36" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id qAxyDV7FbAU_jje5v0VUKdCz-W1ttauV62WNno3Timw49qqO3REcLQ==
GET H2	200	35.438351b2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	3 KB 2 KB	16ms 16ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.438351b2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash d3c4b1d1abee7af1529758460c464a8721f281dfc899159dc36f521534d53fc6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Sun, 30 Oct 2022 00:39:09 GMT x-amz-version-id xVEA6.mBYLNccsk04bE2Abd9MjoHoh38 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 858369 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:21 GMT server nginx etag W/"6d42b26d199471df6876d34dd3714424" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id g8_DQTNMsJnWkTLjzFOI1HT2casJKLyL1UnlITzMR4UzGeRnsde7Pg==
GET H2	200	0.0b2ebd4a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	9 KB 3 KB	17ms 16ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 06 Sep 2022 00:41:02 GMT x-amz-version-id E.Le1HHD6dXp1z9JLSdA8U2RMDD.dyV2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5523856 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Thu, 01 Sep 2022 13:18:43 GMT server nginx etag W/"c5efcdc9e465604f32cf24af10fd6c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id YSy_rbZZ6oNqXgWFxq12coX_2-RZ8Lbvpxbint0eL8hqxplyyyvBvQ==
GET H2	200	3.07aa08a5.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	7 KB 2 KB	18ms 17ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 18 Oct 2022 08:31:03 GMT x-amz-version-id xMSMnV9tWwYbYK5vcAWtWMQdbuElelpe content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1866855 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Mon, 17 Oct 2022 19:19:17 GMT server nginx etag W/"189aeffd571884559dababa22c66d75a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 10jq7EB0_JNZRkZpgPAZcmCdlHWH7YaY5XK7OidSVNBznIE2eKdxxQ==
GET H2	200	3.f50b964b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	54 KB 15 KB	22ms 21ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Thu, 27 Oct 2022 01:16:23 GMT x-amz-version-id k62GB09BT0igkSmfE6Ijm4pRrmboxEaf content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1115335 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Wed, 26 Oct 2022 23:22:49 GMT server nginx etag W/"1ac37bf2b93050f29058b66a9ad43e10" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 8GCgJWGDQSHXVPoopVsC-xNZlcg24uKH2zbeaCzaVb50N4-XK7_GGA==
GET H2	200	1.fbdab3a3.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	43 KB 7 KB	18ms 17ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/1.fbdab3a3.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash b22a1ebdf9aecea6f73860db0e9d184d96d28d85196efd42cfae5d8d0f103571 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 17:43:15 GMT x-amz-version-id 9uUmxdQgGw3P_n0CkITQMBgU8ZLNWJXU content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 364923 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 15:44:30 GMT server nginx etag W/"6eae9d8917505f7858dc56cf0731728a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Bzu__GXKWXJwMX4WP9afjfh1XPRFOn3-a_q7URg64MG3xtu3VSJO8Q==
GET H2	200	1.850e66da.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	73 KB 25 KB	24ms 23ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.850e66da.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 721c262f4a94e7285dc57669e73dfcc1da0b33608e9d4815f4a061ae3dd98754 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 04 Nov 2022 15:39:10 GMT x-amz-version-id Y3ZhhRYltwWjTI8W3oU7gUPsiebH8sGz content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 372368 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 04 Nov 2022 15:28:38 GMT server nginx etag W/"3598824ae2c8be769415b4f4aeaa0a4a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 10pSAp6o0xQQc-Qpnt0pQbUjkWYTLQuqKzcOj2oC72iHPVT76tU12Q==
GET H2	200	32.a3318c5e.chunk.css js.driftt.com/core/assets/css/ Frame 92D9	14 KB 3 KB	23ms 22ms	Stylesheet text/css	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/32.a3318c5e.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Wed, 21 Sep 2022 13:41:58 GMT x-amz-version-id Tq0yzJUum5RyM1Vf648gx8d4gVPONjH2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4180999 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Wed, 21 Sep 2022 13:23:51 GMT server nginx etag W/"b06e02b360914b25e58305b1b9b954dc" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ZXGLBNraWKNVDDYTPwtq7aN6oj14fbjD-YvxKk9Psv-abERkUGLvyg==
GET H2	200	32.fc2654b9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 92D9	12 KB 5 KB	24ms 24ms	Script application/javascript	18.66.112.55 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/32.fc2654b9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.b81d0aa3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.55 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-55.fra56.r.cloudfront.net Software nginx / Resource Hash 968aa77906b12777060a2d8c5794c27a2642ae106bda2363c9a868749d83bc6f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1667948715671 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 28 Oct 2022 16:30:48 GMT x-amz-version-id a2rjHHc92tyOe6txDFKoMvWHDPh3GgQU content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 55107fc1be09ed1afcf3154ed9bd93cc.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 974070 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront last-modified Fri, 28 Oct 2022 15:57:21 GMT server nginx etag W/"6e002280f8027b708a93eadf26041ce7" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 0Y7-ss15Hg8ZwUZUna_LusxZ4V1BQKtKTaoLIDNcscdKJg7LyFODRw==
POST H2	200	ping Show response bootstrap.api.drift.com/widget_bootstrap/ Frame 15C2	147 B 245 B	108ms 108ms	XHR application/json	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash deb3cf2311b3c9c700333492bfb340d93bf5dda51dc5e8283e9cb5bdb638855e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:05:18 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid a37a686f1321bb68 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 147
OPTIONS H2	200	ping bootstrap.api.drift.com/widget_bootstrap/ Frame	0 0	354ms 108ms	Preflight text/plain	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 08 Nov 2022 23:05:18 GMT requestid drift86d718b48d38420a29996f5d4af server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 0
POST H3	200	log_event Show response www.youtube.com/youtubei/v1/ Frame 9380	28 B 54 B	35ms 33ms	XHR application/json	2a00:1450:4001:82a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 Requested by Host: www.youtube.com URL: https://www.youtube.com/s/player/c4225c42/www-embed-player.vflset/www-embed-player.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software scaffolding on HTTPServer2 / Resource Hash d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 X-Goog-Request-Time 1667948719831 Content-Type application/json X-YouTube-Utc-Offset 0 X-YouTube-Client-Name 56 Referer https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com&amp;wmode=opaque X-YouTube-Client-Version 1.20221106.00.00 X-YouTube-Time-Zone Etc/Unknown X-Goog-Visitor-Id CgszZVM1TVltbGhrbyiswaubBg%3D%3D X-YouTube-Ad-Signals dt=1667948716858&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C687%2C387&vis=1&wgl=true&ca_type=image&bid=ANyPxKpR0I7q7rgGNIE8ZKNY6BlH2iMv3RkMSD5t9l3mBVj1ihLYxSRyBR2C2UXwjaOkqdH7gj6Wm7VyoZxwTw3sI9iPCDWCwQ Response headers date Tue, 08 Nov 2022 23:05:19 GMT content-encoding br x-content-type-options nosniff server scaffolding on HTTPServer2 x-frame-options SAMEORIGIN vary Origin, X-Origin, Referer content-type application/json; charset=UTF-8 p3p CP="This is not a P3P policy! See g.co/p3phelp for more info." cache-control private alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31 x-xss-protection 0 expires Tue, 08 Nov 2022 23:05:19 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/event2/ Frame 15C2	25 B 112 B	119ms 119ms	XHR application/json	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/49.b6336d11.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 Authorization User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/json Response headers date Tue, 08 Nov 2022 23:05:21 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid e98ab7815a9a43ce access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 12 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25
OPTIONS H2	200	bulk metrics.api.drift.com/monitoring/metrics/event2/ Frame	0 0	125ms 107ms	Preflight text/plain	3.94.218.138 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event2/bulk Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-94-218-138.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 08 Nov 2022 23:05:20 GMT requestid drift96c930f4ea4b2bab1e1c950745c server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 0
POST H3	204	collect region1.google-analytics.com/g/	0 17 B	61ms 22ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-3WFW9VBZNR&gtm=2oeb70&_p=1792138348&cid=1745326697.1667948716&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAE&sid=1667948716&sct=1&seg=0&dl=https%3A%2F%2Fwww.spamtitan.com%2Fblog%2Femotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates%2F&dt=Emotet%20Malware%20Revives%20Old%20Email%20Conversations%20Threads%20to%20Increase%20Infection%20Rates%20-%20SpamTitan&_s=2 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-3WFW9VBZNR&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.spamtitan.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Tue, 08 Nov 2022 23:05:22 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.spamtitan.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

fonts.gstatic.com

URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Domain

fonts.gstatic.com

URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Domain

www.youtube.com

URL

https://www.youtube.com/embed/S0OSwl1NQ1s?enablejsapi=1&origin=https%3A%2F%2Fwww.spamtitan.com