URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Submission: On July 17 via api from DE — Scanned from DE

Summary

This website contacted 55 IPs in 5 countries across 44 domains to perform 165 HTTP transactions. The main IP is 104.26.3.18, located in and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 199944.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 9th 2023. Valid for: a year.
This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
23 25 104.26.3.18 13335 (CLOUDFLAR...)
7 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 34 23.185.0.2 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 104.80.240.192 16625 (AKAMAI-AS)
7 104.17.73.206 13335 (CLOUDFLAR...)
14 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:303... 13335 (CLOUDFLAR...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
3 2a02:26f0:780... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 2a00:1450:400... 15169 (GOOGLE)
1 6 2a00:1450:400... 15169 (GOOGLE)
1 18.66.192.125 16509 (AMAZON-02)
2 4 142.250.185.166 15169 (GOOGLE)
4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a04:4e42:400... 54113 (FASTLY)
1 151.101.64.65 54113 (FASTLY)
2 104.102.38.132 16625 (AKAMAI-AS)
1 18.66.192.34 16509 (AMAZON-02)
1 162.159.152.17 13335 (CLOUDFLAR...)
1 2001:4860:480... 15169 (GOOGLE)
2 2600:9000:26d... 16509 (AMAZON-02)
9 95.101.111.170 20940 (AKAMAI-ASN1)
1 2600:9000:223... 16509 (AMAZON-02)
1 108.138.40.116 16509 (AMAZON-02)
1 146.75.116.157 54113 (FASTLY)
2 2600:9000:20e... 16509 (AMAZON-02)
7 7 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
1 52.222.236.74 16509 (AMAZON-02)
1 151.101.1.140 54113 (FASTLY)
6 9 52.209.55.66 16509 (AMAZON-02)
1 52.3.54.184 14618 (AMAZON-AES)
1 5 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
2 13.32.121.45 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.5 13414 (TWITTER)
2 104.244.42.131 13414 (TWITTER)
1 192.28.144.124 15224 (OMNITURE)
1 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 216.58.212.130 15169 (GOOGLE)
1 3.71.149.231 16509 (AMAZON-02)
1 35.244.159.8 15169 (GOOGLE)
1 69.173.144.139 26667 (RUBICONPR...)
1 1 142.250.186.130 15169 (GOOGLE)
1 2 185.89.210.90 29990 (ASN-APPNEX)
2 3.73.167.36 16509 (AMAZON-02)
1 3.127.196.46 16509 (AMAZON-02)
8 151.101.194.137 54113 (FASTLY)
1 15.197.193.217 16509 (AMAZON-02)
1 162.247.243.29 54113 (FASTLY)
165 55
Apex Domain
Subdomains
Transfer
66 sentinelone.com
www.sentinelone.com — Cisco Umbrella Rank: 199944
de.sentinelone.com
go.sentinelone.com — Cisco Umbrella Rank: 484441
816 KB
14 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 79
486 KB
10 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6369
c.6sc.co — Cisco Umbrella Rank: 9185
ipv6.6sc.co — Cisco Umbrella Rank: 6440
b.6sc.co — Cisco Umbrella Rank: 4176
17 KB
10 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
10466992.fls.doubleclick.net — Cisco Umbrella Rank: 914193
stats.g.doubleclick.net — Cisco Umbrella Rank: 130
13115870.fls.doubleclick.net — Cisco Umbrella Rank: 930705
cm.g.doubleclick.net — Cisco Umbrella Rank: 254
8 KB
9 prfct.co
pixel-geo.prfct.co — Cisco Umbrella Rank: 16823
4 KB
9 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 414
www.linkedin.com — Cisco Umbrella Rank: 544
px4.ads.linkedin.com — Cisco Umbrella Rank: 6544
9 KB
8 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 535
25 KB
7 google.com
www.google.com — Cisco Umbrella Rank: 10
adservice.google.com — Cisco Umbrella Rank: 113
1 KB
7 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 407
114 KB
6 onesignal.com
cdn.onesignal.com — Cisco Umbrella Rank: 3605
onesignal.com — Cisco Umbrella Rank: 1284
img.onesignal.com — Cisco Umbrella Rank: 7418
85 KB
5 google.de
www.google.de — Cisco Umbrella Rank: 4752
846 B
5 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 63
region1.google-analytics.com — Cisco Umbrella Rank: 1623
82 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 390
13 KB
4 gstatic.com
fonts.gstatic.com
79 KB
3 brightfunnel.com
munchkin.brightfunnel.com — Cisco Umbrella Rank: 54355
api.brightfunnel.com — Cisco Umbrella Rank: 58377
8 KB
3 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 914
6 KB
3 calibermind.com
cdn.calibermind.com — Cisco Umbrella Rank: 52290
e.calibermind.com — Cisco Umbrella Rank: 49758
60 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 10419
577 B
2 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 469
2 KB
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 732
943 B
2 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1031
732 B
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1592
insight.adsrvr.org — Cisco Umbrella Rank: 603
3 KB
2 abrankings.com
cdn.abrankings.com — Cisco Umbrella Rank: 72835
8 KB
2 quora.com
a.quora.com — Cisco Umbrella Rank: 9462
q.quora.com — Cisco Umbrella Rank: 4238
15 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3991
7 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 753
script.hotjar.com — Cisco Umbrella Rank: 1081
72 KB
2 youtube.com
www.youtube.com — Cisco Umbrella Rank: 91
65 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 331
409 B
1 clearbit.com
ga.clearbit.com — Cisco Umbrella Rank: 64675
1 KB
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 374
239 B
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 496
274 B
1 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 338
126 B
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 169
2 KB
1 mktoresp.com
327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 854301
318 B
1 t.co
t.co — Cisco Umbrella Rank: 511
380 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1562
638 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 768
15 KB
1 clickcease.com
www.clickcease.com — Cisco Umbrella Rank: 10783
54 KB
1 marinsm.com
tag.marinsm.com — Cisco Umbrella Rank: 44484
4 KB
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1396
8 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 678
317 B
1 typography.com
cloud.typography.com — Cisco Umbrella Rank: 7588
443 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88
1 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1191
48 KB
165 44
Domain Requested by
34 de.sentinelone.com 2 redirects www.sentinelone.com
de.sentinelone.com
25 www.sentinelone.com 23 redirects www.sentinelone.com
14 www.googletagmanager.com www.sentinelone.com
www.googleoptimize.com
www.googletagmanager.com
9 pixel-geo.prfct.co 6 redirects www.sentinelone.com
8 js-agent.newrelic.com www.sentinelone.com
7 b.6sc.co www.sentinelone.com
7 go.sentinelone.com www.sentinelone.com
go.sentinelone.com
7 cdn.cookielaw.org www.sentinelone.com
cdn.cookielaw.org
5 www.google.de www.sentinelone.com
5 www.google.com 1 redirects www.sentinelone.com
5 px.ads.linkedin.com 5 redirects
4 bat.bing.com www.googletagmanager.com
bat.bing.com
www.sentinelone.com
4 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
4 www.google-analytics.com www.googletagmanager.com
munchkin.brightfunnel.com
www.sentinelone.com
4 fonts.gstatic.com fonts.googleapis.com
3 onesignal.com cdn.onesignal.com
3 snap.licdn.com www.sentinelone.com
snap.licdn.com
2 epsilon.6sense.com munchkin.brightfunnel.com
2 secure.adnxs.com 1 redirects www.sentinelone.com
2 13115870.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 analytics.twitter.com www.sentinelone.com
2 adservice.google.com 10466992.fls.doubleclick.net
13115870.fls.doubleclick.net
2 api.brightfunnel.com munchkin.brightfunnel.com
2 px4.ads.linkedin.com www.sentinelone.com
2 www.linkedin.com 2 redirects
2 cdn.linkedin.oribi.io snap.licdn.com
2 cdn.abrankings.com www.googletagmanager.com
munchkin.brightfunnel.com
2 munchkin.marketo.net www.sentinelone.com
munchkin.marketo.net
2 10466992.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 www.youtube.com www.sentinelone.com
www.youtube.com
2 cdn.onesignal.com www.sentinelone.com
cdn.onesignal.com
2 cdn.calibermind.com www.sentinelone.com
1 bam.nr-data.net munchkin.brightfunnel.com
1 insight.adsrvr.org js.adsrvr.org
1 img.onesignal.com www.sentinelone.com
1 ga.clearbit.com www.googletagmanager.com
1 cm.g.doubleclick.net 1 redirects
1 pixel.rubiconproject.com www.sentinelone.com
1 us-u.openx.net www.sentinelone.com
1 ups.analytics.yahoo.com www.sentinelone.com
1 www.googleadservices.com www.googletagmanager.com
1 ipv6.6sc.co munchkin.brightfunnel.com
1 c.6sc.co munchkin.brightfunnel.com
1 327-mnm-087.mktoresp.com munchkin.marketo.net
1 t.co www.sentinelone.com
1 stats.g.doubleclick.net munchkin.brightfunnel.com
1 q.quora.com www.sentinelone.com
1 alb.reddit.com www.sentinelone.com
1 script.hotjar.com static.hotjar.com
1 static.ads-twitter.com www.sentinelone.com
1 js.adsrvr.org www.googletagmanager.com
1 www.clickcease.com www.sentinelone.com
1 j.6sc.co www.sentinelone.com
1 region1.google-analytics.com www.googletagmanager.com
1 a.quora.com www.sentinelone.com
1 munchkin.brightfunnel.com www.sentinelone.com
1 tag.marinsm.com www.sentinelone.com
1 www.redditstatic.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 e.calibermind.com cdn.calibermind.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cloud.typography.com 1 redirects
1 fonts.googleapis.com www.sentinelone.com
1 www.googleoptimize.com www.sentinelone.com
165 64
Subject Issuer Validity Valid
sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-09 -
2024-04-08
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2023-04-01 -
2024-03-31
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
go.sentinelone.com
Cloudflare Inc ECC CA-3
2023-04-22 -
2024-04-21
a year crt.sh
calibermind.com
E1
2023-06-26 -
2023-09-24
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-05-03 -
2024-05-02
a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-12-13 -
2023-12-13
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
attivonetworks.com
R3
2023-06-09 -
2023-09-07
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
*.google.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
*.hotjar.com
Amazon ECDSA 256 M01
2023-03-09 -
2024-04-06
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2023-02-16 -
2023-08-16
6 months crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-04-12 -
2023-10-08
6 months crt.sh
tag.marinsm.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-01 -
2024-08-01
a year crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
*.brightfunnel.com
Amazon RSA 2048 M02
2023-02-28 -
2024-02-12
a year crt.sh
quora.com
R3
2023-06-21 -
2023-09-19
3 months crt.sh
cdn.abrankings.com
Amazon RSA 2048 M02
2023-03-19 -
2024-04-16
a year crt.sh
6sc.co
R3
2023-05-25 -
2023-08-23
3 months crt.sh
clickcease.com
Amazon RSA 2048 M02
2022-10-27 -
2023-11-25
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
*.quora.com
R3
2023-07-12 -
2023-10-10
3 months crt.sh
www.google.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
www.google.de
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
*.prfct.co
GlobalSign RSA OV SSL CA 2018
2022-10-28 -
2023-11-29
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
clearbit.com
Amazon RSA 2048 M02
2023-03-17 -
2024-04-14
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-04-13 -
2024-05-14
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-11-18 -
2023-12-19
a year crt.sh

This page contains 5 frames:

Primary Page: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Frame ID: 174FEF832F38EA75B465DED27F13E1EF
Requests: 162 HTTP requests in this frame

Frame: https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Frame ID: E39833C56CC12AC2053F89F2C65FF3B2
Requests: 2 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: EA91E6E59A52CDB35D44103FEBF4ED48
Requests: 2 HTTP requests in this frame

Frame: https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Frame ID: D533552D0A7DE5B92154F295B0C6CAF6
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&upid=jskiafk&upv=1.1.0
Frame ID: A60B4693E93228F202B9713A1E4907EE
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP - SentinelOneBack ButtonSearch IconFilter Icon

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • clipboard(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.onesignal\.com

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

165
Requests

79 %
HTTPS

42 %
IPv6

44
Domains

64
Subdomains

55
IPs

5
Countries

2127 kB
Transfer

6159 kB
Size

49
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818 HTTP 302
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
Request Chain 3
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 HTTP 302
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Request Chain 5
  • https://cloud.typography.com/7197018/6979812/css/fonts.css HTTP 302
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css HTTP 302
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Request Chain 6
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Request Chain 7
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Request Chain 9
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955
Request Chain 11
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Request Chain 12
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Request Chain 13
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Request Chain 14
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Request Chain 15
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Request Chain 16
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Request Chain 17
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
Request Chain 18
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg
Request Chain 20
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
Request Chain 21
  • https://www.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
Request Chain 22
  • https://www.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
Request Chain 24
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11 HTTP 302
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Request Chain 25
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955 HTTP 302
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
Request Chain 44
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Request Chain 45
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg; HTTP 301
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Request Chain 53
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg
Request Chain 54
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
Request Chain 55
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
Request Chain 56
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg HTTP 302
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
Request Chain 71
  • https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F HTTP 302
  • https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Request Chain 92
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1689584317655%26url%3Dhttps%253A%252F%252Fwww.sentinelone.com%252Flabs%252Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&cookiesTest=true&liSync=true&e_ipv6=AQKj_0E70uHViwAAAYljEreioi-iDv5v5AiiahOs9U_hwOI6zIFNvDSRTJw97foJWngR__U
Request Chain 97
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag HTTP 302
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Request Chain 125
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F HTTP 302
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Request Chain 126
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D432890%26conversionId%3D2402852%26fmt%3Dgif%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true&e_ipv6=AQIhiPbjsd1gSQAAAYljErfHEdSc06WsrH5fLzDTyRew7E19YcSdQAu6MTqbzwvgIx2F7vI
Request Chain 134
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_oKPCsn2LHW5LpETEy
Request Chain 135
  • https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_oKPCsn2LHW5LpETEy&_origin=1
Request Chain 136
  • https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_oKPCsn2LHW5LpETEy
Request Chain 137
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_oKPCsn2LHW5LpETEy
Request Chain 138
  • https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfb0tQQ3NuMkxIVzVMcEVURXk HTTP 302
  • https://pixel-geo.prfct.co/cb?partnerId=goo
Request Chain 140
  • https://secure.adnxs.com/seg?t=2&add=4530935 HTTP 307
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Request Chain 148
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&auid=868522072.1689584317&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=vgK1ZJ64C8eh9u8PkJ6I8AY&sscte=1&crd=&eitems=ChEI8M3TpQYQ97iVwPi3pcbhARIdAKMROOA-oXiBnl9Snfffnji19RvMtxbjf6dFHi4&pscrd=Ek5DaEVJOE0zVHBRWVFoTGJIM00tRGo5R3ZBUklsQUNVemhIZ0FjaEc5eVJSX0xYUWdBQzlPbVdGRzJvTFZJZ2UySlI2R2ZodmU5MW5RMFEaV0NoQUk4TTNUcFFZUXdfdkZ1dEMtamY4aUVpMEEwV2c5VkpSR09vRDdic1FLN1dHSkJzVGhsRnJ4aFVUcHBIZmFkcnB5dHA3QXpocnVlNGxJUmw0VC1wMCITCJ6P6oiwlYADFceQ_QcdEA8Cbg HTTP 302
  • https://www.google.com/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&auid=868522072.1689584317&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE0zVHBRWVFoTGJIM00tRGo5R3ZBUklsQUNVemhIZ0FjaEc5eVJSX0xYUWdBQzlPbVdGRzJvTFZJZ2UySlI2R2ZodmU5MW5RMFEaV0NoQUk4TTNUcFFZUXdfdkZ1dEMtamY4aUVpMEEwV2c5VkpSR09vRDdic1FLN1dHSkJzVGhsRnJ4aFVUcHBIZmFkcnB5dHA3QXpocnVlNGxJUmw0VC1wMCITCJ6P6oiwlYADFceQ_QcdEA8Cbg&is_vtc=1&ocp_id=vgK1ZJ64C8eh9u8PkJ6I8AY&cid=CAQSKQBpAlJWDimpuIlu47Hhrp1-9Hl-YP0c7IAChobSyJsfedesqeWP8hbR&eitems=ChEI8M3TpQYQ97iVwPi3pcbhARIdAKMROOBg3sLALsu0VoTOje97eLS2-sL7aoLf9zY&random=3166919005 HTTP 302
  • https://www.google.de/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&auid=868522072.1689584317&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE0zVHBRWVFoTGJIM00tRGo5R3ZBUklsQUNVemhIZ0FjaEc5eVJSX0xYUWdBQzlPbVdGRzJvTFZJZ2UySlI2R2ZodmU5MW5RMFEaV0NoQUk4TTNUcFFZUXdfdkZ1dEMtamY4aUVpMEEwV2c5VkpSR09vRDdic1FLN1dHSkJzVGhsRnJ4aFVUcHBIZmFkcnB5dHA3QXpocnVlNGxJUmw0VC1wMCITCJ6P6oiwlYADFceQ_QcdEA8Cbg&is_vtc=1&ocp_id=vgK1ZJ64C8eh9u8PkJ6I8AY&cid=CAQSKQBpAlJWDimpuIlu47Hhrp1-9Hl-YP0c7IAChobSyJsfedesqeWP8hbR&eitems=ChEI8M3TpQYQ97iVwPi3pcbhARIdAKMROOBg3sLALsu0VoTOje97eLS2-sL7aoLf9zY&random=3166919005&ipr=y

165 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
113 KB
36 KB
Document
General
Full URL
https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b58f75e6c6145ed7f6e19a4c2f32996ecb830577f1e06ef5f247ff21f998e734
Security Headers
Name Value
Content-Security-Policy script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=60
cf-cache-status
EXPIRED
cf-ray
7e8148b899532c5d-FRA
content-encoding
br
content-security-policy
script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
content-type
text/html; charset=UTF-8
date
Mon, 17 Jul 2023 08:58:36 GMT
expect-ct
enforce; max-age=2592000;
last-modified
Mon, 17 Jul 2023 08:57:38 GMT
link
<https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/labs/82546>; rel="alternate"; type="application/json", <https://www.sentinelone.com/?p=82546>; rel=shortlink
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zUZ0wAP7wU9JPwN8%2FwZT9H3av6%2Bcu0ZCA9c6KiWJe8JlNccv9HmCFHexASegcK3HFHSZ6Sl4PBVKF9Wm0UA56iiY2IimXfStxDKOiSncrDaVseHZvIb82u78YmnVSwh1A%2FV%2FVkE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding, Cookie, Cookie
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
x-cache
HIT, HIT, MISS, MISS
x-cache-hits
2, 22, 0, 0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-pantheon-styx-hostname
styx-fe2-b-579886598f-cswjm
x-served-by
cache-chi-kigq8000072-CHI, cache-fra-eddf8230104-FRA, cache-fra-eddf8230074-FRA, cache-fra-eddf8230074-FRA
x-styx-req-id
055dd1ea-247f-11ee-8d75-26f3159c13ad
x-timer
S1689584316.291333,VS0,VE12
x-xss-protection
1; mode=block
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
7 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffc79feebdfe105c3de8840c2a5814b3fae59d3529463fdf9329080967ed92ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Ss3gfiwT9vXTSvNlfc+4JQ==
age
42760
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6820
x-ms-lease-status
unlocked
last-modified
Thu, 13 Jul 2023 02:45:40 GMT
server
cloudflare
etag
0x8DB834B3F1108FD
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
1f8a20f3-f01e-00ad-23c2-b5f88c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148b9c9461ad4-FRA
optimize.js
www.googleoptimize.com/
121 KB
48 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a6260b7c10e561ba217fb95a89cf0f829e7c566d038bab15fdcb7a1a67d6ebaa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48265
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 Jul 2023 08:58:36 GMT
classic-themes.min.css
de.sentinelone.com/wp-includes/css/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
  • https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
291 B
456 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 15393, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-4bszt
content-length
211
x-served-by
cache-chi-kigq8000094-CHI, cache-fra-etou8220053-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:19 GMT
server
nginx
x-timer
S1689584317.827159,VS0,VE11
etag
W/"64ad06eb-123"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
bed9f2b6-1fc1-11ee-9605-c238e3266a0d
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2XfIWMNK%2F8%2BZvZEzBGBhUlXszVry5nnKaoO%2FxwvuU%2BzBfp5IOtx%2Fpflf0ncCwMFX8D2gPzZ86Mam1jI8GVEiVdqXRRBYtEdYBXf%2Fuk34D6Qw0oXYOK%2F7h5ZE8%2BeDEY4fbHabfZo%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/css/classic-themes.min.css?ver=12c9789c4528a9431963b4b52733d818
cf-ray
7e8148b94abb2c5d-FRA
content-length
0
tp_twitter_plugin.css
de.sentinelone.com/wp-content/plugins/recent-tweets-widget/
Redirect Chain
  • https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
  • https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
529 B
680 B
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 4174, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-fnt6g
content-length
286
x-served-by
cache-chi-klot8100145-CHI, cache-fra-eddf8230066-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:17 GMT
server
nginx
x-timer
S1689584317.827910,VS0,VE5
etag
W/"64ad06e9-211"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
bed9f2a2-1fc1-11ee-8d15-fa29b1107d35
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2BF11yVyuJLL86eJ%2B0ihvMszqUP0Xsr98%2Fwv%2BjDRw9mcc%2Fu43HodKWJ9srAQ96j0bzhPsPtzeKmXM3OtHE84qNCQbSW3JN1JediNtY%2FDdvANne07ZFsLiqPbZNDL%2F0Uov28gv7s%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
cf-ray
7e8148b94abc2c5d-FRA
content-length
0
css
fonts.googleapis.com/
12 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 17 Jul 2023 08:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 08:45:56 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 17 Jul 2023 08:58:36 GMT
2EC96BA1F5C4837D6.css
de.sentinelone.com/fonts/804059/
Redirect Chain
  • https://cloud.typography.com/7197018/6979812/css/fonts.css
  • https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
  • https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
104 KB
80 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
1, 325, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
521521
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-fnt6g
content-length
81369
x-served-by
cache-chi-klot8100164-CHI, cache-fra-eddf8230112-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:17 GMT
server
nginx
x-timer
S1689584317.827891,VS0,VE3
etag
W/"64ad06e9-1a12c"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
da9f011c-1fc1-11ee-8d15-fa29b1107d35
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:06:35 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pm52RUHnY8ERpCo9C41qAQRXB6grNYe6L1m7nmUfQhRwcZ7BR%2BwllHj7W05rIh68ET3f1794zYeOrVgMajwlCdH6pVLJPnzc%2BWbEUn9uomvadE97jGOJ9ojLzFUmhXEo0Nz0Rog%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
cf-ray
7e8148b9fb812c5d-FRA
content-length
0
style.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
770 KB
123 KB
Stylesheet
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6cc7aa1d0e20765408f1a5f78d55f9f366eb1f910fe4da807ccb1cd5ab66c8f9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 2413, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
164085
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-465qx
content-length
125583
x-served-by
cache-chi-kigq8000040-CHI, cache-fra-eddf8230020-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Sat, 15 Jul 2023 11:19:15 GMT
server
nginx
x-timer
S1689584317.828501,VS0,VE2
etag
W/"64b280b3-c08f8"
vary
Accept-Encoding
content-type
text/css
x-styx-req-id
1355f621-2302-11ee-964a-a26e735dc5ed
cache-control
max-age=31622400
accept-ranges
bytes
expires
Mon, 15 Jul 2024 11:23:51 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IIi61TS1kuHfc90L0e7bnlCiH7%2FMOM1BFi25%2FBUj127BYYXnbFE%2Bt%2Fyd6TGXO%2BE3HE9sagUnc1LU1YbD8%2BObQQdKJXMXVuSorzjkU%2FqrFMZGbWzNXWsigZWYlE6ATyCv%2BPj4%2FA0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
cf-ray
7e8148b94abf2c5d-FRA
content-length
0
jquery-3.5.1.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
87 KB
36 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 15344, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
521562
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-465qx
content-length
36067
x-served-by
cache-chi-kigq8000169-CHI, cache-fra-etou8220113-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:21 GMT
server
nginx
x-timer
S1689584317.827873,VS0,VE12
etag
W/"64ad06ed-15d84"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
c2bb067a-1fc1-11ee-a315-a26e735dc5ed
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:55 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eKAmhNaWk9rQp9nJjDyO%2FFSU%2BOhAxNTWz4qgW%2BRA%2FYABWVadyaz9NZnljR72nu6A7nnnakEsou%2BTgMI0mqz%2F0J4eKPDfdhZoyz%2FW5KhraVG6UyZchT6pD8NPymmURjm3JDstFX0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/components/jquery/jquery-3.5.1.min.js
cf-ray
7e8148b94ac02c5d-FRA
content-length
0
forms2.min.js
go.sentinelone.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 05 May 2023 17:50:04 GMT
server
cloudflare
age
2011
etag
"1520cbc-33e51-5faf5eb3b0b00"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7e8148b9db689be0-FRA
expires
Mon, 17 Jul 2023 12:58:36 GMT
header.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955
164 KB
52 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0da08befe5a68eec43e1e5598ae8f09c574234a20c164c52c16ed0938712ca5e
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 2985, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:36 GMT
age
164085
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-wl4b7
content-length
52657
x-served-by
cache-chi-kigq8000061-CHI, cache-fra-etou8220027-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Sat, 15 Jul 2023 11:19:15 GMT
server
nginx
x-timer
S1689584317.827870,VS0,VE3
etag
W/"64b280b3-2903b"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
1354bca3-2302-11ee-abfd-96f65b0a56bc
cache-control
max-age=31622400
accept-ranges
bytes
expires
Mon, 15 Jul 2024 11:23:51 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qRm0EDd5zJ9msiy3ytIpbFeFQYvbO5kLvRkf06zeFxZzYhV5hIC4kXAFNfIXz%2FnzWY1Lxbmqzg5L%2FswiyPdtdt5QZ9QcIwPFrB1HzoGlMVZzTufI5%2FldbaVtHjHDFoKSczrb52A%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1689419955
cf-ray
7e8148b94ac22c5d-FRA
content-length
0
js
www.googletagmanager.com/gtag/
255 KB
86 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a083171a710f259df776baf46a4822350eea47635a1bf05a8931bf6609d12848
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
87777
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 17 Jul 2023 08:58:37 GMT
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
681 B
703 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
2, 1, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521569
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.134663,VS0,VE47
etag
W/"64ad06ea-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee4bb48-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FScCH6UhaaXv%2FT7D1m8XDtirVqkxpdbX3OKik88UpUay%2Fu5H9F8VzBQlEuuCqA1DMhY1vIEcMjOtWhWHS5jOv4Tea%2FLf9IuxSAfuuYx%2BuIcJEKqVsNmCL4KU%2B29KKeuxkZaTzuI%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
cf-ray
7e8148bd8f572c5d-FRA
content-length
0
search-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
681 B
661 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 7449, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-qm47g
content-length
385
x-served-by
cache-chi-klot8100085-CHI, cache-fra-eddf8230085-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:21 GMT
server
nginx
x-timer
S1689584317.142063,VS0,VE5
etag
W/"64ad06ed-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee7f16c-1fc1-11ee-a6b6-7e6e366531f9
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oh1ELbDk4SRrYRlt%2FRqGSi410nlNZePxPc9zOp4jM4BHBapwYC4rFXIEWTN63X%2BHI2aithKdvEOSIKXN6ARqyHGAacnJKG48djvmtGetdKuysXWELaS0hvFz2iV2tdmYH28dISw%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
cf-ray
7e8148bd8f582c5d-FRA
content-length
0
navigation-close.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
667 B
727 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 7441, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-gfh5t
content-length
339
x-served-by
cache-chi-klot8100133-CHI, cache-fra-etou8220049-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.141548,VS0,VE3
etag
W/"64ad06ea-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee48bf1-1fc1-11ee-90e4-46fceb4fc8f1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FYqmu4gWcHGDQkpgkQNTjaMnvDxkZAh7NPox3PNdJFk5L%2F%2BZLYTzi7Zg%2Bvjqdr4z7R4Dw3ElXf2yEeWwmnSRZ4Zis9P7yut5%2FN63eLU9Jv3qM4C7CXwMo5ouecp1ojN8Xfq6%2FTY%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
cf-ray
7e8148bd8f592c5d-FRA
content-length
0
navigation-close-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
667 B
643 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 7368, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
339
x-served-by
cache-chi-kigq8000142-CHI, cache-fra-eddf8230133-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:21 GMT
server
nginx
x-timer
S1689584317.141647,VS0,VE3
etag
W/"64ad06ed-29b"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee55e17-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WhE8P1tJ%2B8xVI56g8uAQDkzuo%2BbV075%2FcihGMjszHAUFn8isFw%2BrAtDCdYrNAvzcMXp5PG3f%2BsntY8ewmlRaIngPhQFV440YDYAd0IhUvd%2FK4R6KvarPjkqnfOh9%2FPxxrJa%2Biqk%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
cf-ray
7e8148bd8f5a2c5d-FRA
content-length
0
SentinelLabs_Logo_RGB_WhitePurp.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
2 KB
3 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 65, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
3877724
x-cache
MISS, HIT, HIT, MISS
fastly-io-info
ifsz=5631 idim=566x102 ifmt=png ofsz=2400 odim=566x102 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-85879b7d89-2tnmq
fastly-stats
io=1
content-length
2400
x-served-by
cache-ams21047-AMS, cache-ams21060-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.152841,VS0,VE2
etag
"SRS0kzf1x5kotIn7/dZ8GXxF+ylXldJZB2aoWhpqVWs"
vary
Accept
content-type
image/webp
x-styx-req-id
96235d9b-013b-11ee-941e-d6613c0f5080
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sun, 02 Jun 2024 11:49:52 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qVjl1VRoI7rWYdK14YrD7UOeeHhYTZLbRL7j%2FW7tQTpugj42YWWTVBLEheUvh6CDB35vlUAh7jiqd0F5wA%2BGkO7FnEWFw3eDxX4gzr%2BiNTei3%2FovE1bMLYt8Sw3Kfc%2FYx3%2BnadM%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/SentinelLabs_Logo_RGB_WhitePurp.png
cf-ray
7e8148bd8f5c2c5d-FRA
content-length
0
navigation-arrow-left.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
566 B
549 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 7359, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-wl4b7
content-length
326
x-served-by
cache-chi-kigq8000073-CHI, cache-fra-eddf8230097-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.114173,VS0,VE3
etag
W/"64ad06ea-236"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee4c23b-1fc1-11ee-9c69-96f65b0a56bc
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x4xfK%2BZh6Bj3qXwKvPz8r3m%2FaV1tHCSoHQCvpbj14%2F40U5jD%2BgSLDB9kifP8w44JAq2K84mXyr3IdfQA4MNcfpoVpbOXocyynyQba%2BBeuRO6a0NZHALJAAfdLv3gsVbSljWVixY%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
cf-ray
7e8148bd8f5d2c5d-FRA
content-length
0
Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
de.sentinelone.com/wp-content/uploads/2023/07/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
60 KB
61 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fe94c281d83caa56e37f5c2d904f813327778a6dcd9857baa3df3058317781a3
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
330965
x-cache
MISS, MISS, HIT, MISS
fastly-io-info
ifsz=66953 idim=1200x628 ifmt=jpeg ofsz=61578 odim=1200x628 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-gfh5t
fastly-stats
io=1
content-length
61578
x-served-by
cache-ams21054-AMS, cache-ams12752-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.133924,VS0,VE4
etag
"ijAEsZ3IP+w5c6cD50FASw2QohqOT086SkfZPXnpdS8"
vary
Accept
content-type
image/webp
x-styx-req-id
875cc6f2-217d-11ee-bbc8-46fceb4fc8f1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 13 Jul 2024 13:02:32 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FhTwtGt0rFfcwN3xtyfeIPUjTYFKa4XoSEsQ%2BjvUCcUgfh6znwiLe4t5fJuS%2BwhCD1KeGpjxzXYkeVCAEGFWVmFa9vJdNr381lzQeYMHJmAwSqRLx1rNXXyOG1oEvE1sX3RXGGw%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloudy-With-a-Chance-of-Credentials-AWS-Targeting-Cred-Stealer-Expands-to-Azure-GCP-9.jpg
cf-ray
7e8148bd8f5f2c5d-FRA
content-length
0
Cloud_Credentials_Stealer_5.jpg
de.sentinelone.com/wp-content/uploads/2023/07/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg
41 KB
41 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
972ef704c969142982239fb4c433ca38a069701e60d1443d7b6bad1d82378e6d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 5, 7, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
335778
x-cache
MISS, HIT, HIT, MISS
fastly-io-info
ifsz=74848 idim=999x314 ifmt=jpeg ofsz=41692 odim=999x314 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-wl4b7
fastly-stats
io=1
content-length
41692
x-served-by
cache-ams21063-AMS, cache-ams21069-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.141505,VS0,VE1
etag
"kw05auJ3Xom4rf7kK4+TOBVJ6anH9NKbz/Pwnc3zUEs"
vary
Accept
content-type
image/webp
x-styx-req-id
5277e92a-2172-11ee-ae15-96f65b0a56bc
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 13 Jul 2024 11:42:18 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IJwBV8WjxLOnral%2FCf40K5BguAN42pm6w5%2FmMZswLOsrz%2B6OinQSNoAQDDHV62zonlMEWrAlHLXajB1jlUWGr5g8EircPfPF3s%2BULrONFBS7L3Xwt%2BuOE4Cx4a%2BWm83xd%2Fu9UYs%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_5.jpg
cf-ray
7e8148bd8f602c5d-FRA
content-length
0
email-decode.min.js
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
1 KB
Script
General
Full URL
https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.3.18 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Tue, 11 Jul 2023 16:27:41 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
content-encoding
gzip
etag
W/"64ad82fd-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RqIR4sDdN1PUogQ0HAhSYE1lZMJPTDneYEKTr1eB4ZlSmDgWYhhPc4nwB1sNVaw1IcJeowWY8I4p5Vf8D1Okk5YYuE3fHm7kOzgl%2Fq3yyEBz9ZKhio%2ByqZcROxJ5hAALuuIQp%2B8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
7e8148bd4f202c5d-FRA
expires
Wed, 19 Jul 2023 08:58:37 GMT
Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/05/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
4 KB
5 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
b3835be0df2f7515cdd23362cfa62c70b247f0cf7b50a8d20daff104d71d2a26
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
1, 0, 2, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
519957
x-cache
HIT, MISS, HIT, HIT, MISS
fastly-io-info
ifsz=6642 idim=300x157 ifmt=jpeg ofsz=4376 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-gfh5t
fastly-stats
io=1
content-length
4376
x-served-by
cache-chi-kigq8000174-CHI, cache-ams21024-AMS, cache-ams12766-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.135065,VS0,VE2
etag
"M4yqjm9X4qeoaKsWw9i+BzjGRKFjIPQIQy/W2hOVyNU"
vary
Accept
content-type
image/webp
x-styx-req-id
7f2844c1-1fc5-11ee-90e4-46fceb4fc8f1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:32:39 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GUssmTciwgP%2FU3mHN7e%2FLy7I6piFgNcJoHk5e6KvTu1cXlF5pe9g%2BwmNMP7SAEFIfCNjUgmQHwvxxl0qd5XD6NchFkVEe77El9dYNl%2BnWsbTNt6wkd9kYDWTFEBcSTpLRh9R7Rg%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/05/Hypervisor-Ransomware-Multiple-Threat-Actor-Groups-Hop-on-Leaked-Babuk-Code-to-Build-ESXi-Lockers-300x157.jpg
cf-ray
7e8148bd8f612c5d-FRA
content-length
0
IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/03/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
5 KB
6 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
43fd687a5599e7289ed7452b0e2b4dd62e8a2b2bc616dc994b598cbbb0642b56
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 7, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
1724653
x-cache
MISS, MISS, HIT, HIT, MISS
fastly-io-info
ifsz=11001 idim=300x157 ifmt=jpeg ofsz=5444 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-7f4f4c4f48-vh46f
fastly-stats
io=1
content-length
5444
x-served-by
cache-chi-klot8100040-CHI, cache-ams21025-AMS, cache-ams12768-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.134430,VS0,VE2
etag
"LnWq36vQovNh2AcsdbHRJFY1pqEHpYveFxvHxoffDiI"
vary
Accept
content-type
image/webp
x-styx-req-id
98322e08-14d0-11ee-8037-ae4ff55ce73a
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 27 Jun 2024 09:54:23 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVgN8jyr8AKsmBMaIcMcZJVVQXGuaWoCTXAfHbZte3m0fIAdWCsCPF%2BGM3aCDECia6oGkHW2EaAh79XIJq1S67XH%2FRFXWVZDxm8SWEgH3Azi3fDFaT1zSlom7UAqlxiyI6eeGck%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/03/IceFire-Ransomware-Returns-Now-Targeting-Linux-Enterprise-Networks-8-300x157.jpg
cf-ray
7e8148bd8f622c5d-FRA
content-length
0
Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
de.sentinelone.com/wp-content/uploads/2023/02/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
6 KB
7 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a65b319d23a224339d6bb2d40f4fb6f43d9cdcdb41bdda00869cd9a88477a171
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 22, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
2126341
x-cache
MISS, MISS, HIT, HIT, MISS
fastly-io-info
ifsz=11353 idim=300x157 ifmt=jpeg ofsz=6362 odim=300x157 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-5b95b845bd-dtn94
fastly-stats
io=1
content-length
6362
x-served-by
cache-chi-klot8100062-CHI, cache-ams21082-AMS, cache-ams12747-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.134378,VS0,VE2
etag
"+hXdw0ASonaTMkVISZYEBu8guB3o1FLyRvoEPwECUig"
vary
Accept
content-type
image/webp
x-styx-req-id
577d1ef6-1129-11ee-987b-7e490cb7696a
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 22 Jun 2024 18:19:35 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZgU%2BY0zLjDaCxoJZmiX%2BHiAe9UbN67YH4FyAKxxx%2FRzuylqYfkAhY8erISh0iZaZGCISJI%2Fdvou%2FP0aCaZjq3%2BPR%2FjKxtmoIMLLhM%2FppbJn3kwmBxK7HEU60%2Fd2%2FwKMzBRPTEU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/02/Cl0p-Ransomware-Targets-Linux-Systems-with-Flawed-Encryption-Decryptor-Available-9-300x157.jpg
cf-ray
7e8148bd8f632c5d-FRA
content-length
0
identifyEmail.latest.js
cdn.calibermind.com/js/
838 B
1 KB
Script
General
Full URL
https://cdn.calibermind.com/js/identifyEmail.latest.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
28219
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 30 Jun 2023 17:07:12 GMT
server
cloudflare
etag
W/"649f0bc0-346"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BBPHmal7n9BE4CibPGm9qvgBvWk4aR57NRuraYw9kvwoQ7KpDjxXlGlfDKQKOnzjjHvdIhSDglE21q3HlHMvSve1qIje%2BNQ3IXg1wX9RklyPjqz%2B3mSKoQ7NaxnNmdAvK42vRH9tsCu%2BFPkCULwb8BQv"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7e8148bdf87b9bb0-FRA
clipboard.min.js
de.sentinelone.com/wp-includes/js/
Redirect Chain
  • https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
  • https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
9 KB
4 KB
Script
General
Full URL
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
2, 796, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521562
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-crzrh
content-length
3466
x-served-by
cache-chi-klot8100072-CHI, cache-fra-eddf8230071-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:19 GMT
server
nginx
x-timer
S1689584317.134906,VS0,VE3
etag
W/"64ad06eb-2331"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
c3048517-1fc1-11ee-9b77-8a0dba694792
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:55 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wDMETb5MSrECU5mcNZN6kYl3MkflvPUmXw7R2ooLcXELmVY4kNxoLxrsHrcJniJVQGYSBzbprKkcX3OOTFEL%2Blac2vxFz6bk7T%2BQFW5SS46ZwxL5zyGkXNOGaKQWVBVINjP75xU%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=2.0.11
cf-ray
7e8148bd8f542c5d-FRA
content-length
0
footer.min.js
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain
  • https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
127 KB
49 KB
Script
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
1f1b053798feca0d6310c9f463fa883f374d4ad73d5cc54e4d1160762a87ca96
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 2873, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
164085
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-wl4b7
content-length
50152
x-served-by
cache-chi-kigq8000065-CHI, cache-fra-etou8220022-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Sat, 15 Jul 2023 11:19:15 GMT
server
nginx
x-timer
S1689584317.134921,VS0,VE11
etag
W/"64b280b3-1fc80"
vary
Accept-Encoding
content-type
application/x-javascript
x-styx-req-id
13549cbb-2302-11ee-abfd-96f65b0a56bc
cache-control
max-age=31622400
accept-ranges
bytes
expires
Mon, 15 Jul 2024 11:23:51 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cYm0ZRfsBcwsLN9g4T0GrHR7H5LwfZFA%2Fzvq6r2Y9%2F%2FkxaycDNJQvrLcoC%2FxIkf%2BQrpusvfNcyLQ1XWNNbqFV%2FdYPRMxpmRIibLcmIiy%2FW%2FbYxISc0blHE6GmqeRt3j58Q3snyA%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
cf-ray
7e8148bd8f562c5d-FRA
content-length
0
OneSignalSDK.js
cdn.onesignal.com/sdks/
9 KB
3 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=12c9789c4528a9431963b4b52733d818
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22a799158fe74ae3e802bb4708fa9b5888b3553ca8296ae1f4a23799a006d1ba
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
414
etag
W/"841a8834d1e8a6a8a6de9933a13d2b34"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7e8148be0c52194b-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Thu, 20 Jul 2023 08:58:37 GMT
02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
41266
content-md5
CqPSDQgRayZT5/dw1EENjQ==
content-length
1450
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:19 GMT
server
cloudflare
etag
0x8D97490BA2F1567
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
2e907f89-801e-00a2-5be1-5a157a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148baa8362c3d-FRA
expires
Tue, 18 Jul 2023 08:58:36 GMT
a.js
cdn.calibermind.com/
213 KB
59 KB
Script
General
Full URL
https://cdn.calibermind.com/a.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:d595 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
Security Headers
Name Value
Content-Security-Policy default-src 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-security-policy
default-src 'self'
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
23792
content-encoding
br
alt-svc
h3=":443"; ma=86400
last-modified
Fri, 30 Jun 2023 17:05:30 GMT
server
cloudflare
etag
W/"649f0b5a-354c2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fvxH2JE668sWhMFHrLZfVF%2BXONaTTss4xAC8V7%2BRHfaISK3QItXrvW7OKMtW0zC8uhpkC0KXPoN7Hzd5Y0y9IxOGzNKYb%2BuouAUlDojXnbtZ43zhh91oPg1pLn0PJrxpGjYi7bVVrzbCaqioKSGwkqbC"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
public, max-age=86400, stale-if-error=3600
cf-ray
7e8148bdf8829bb0-FRA
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
78 B
317 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1d26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
792074561f2d94442c8648916f41fc6016817b61d554daa9c67301aeecca14bb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:36 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
7e8148bbafcf68eb-FRA
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.23.0/
312 KB
75 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
joMckLq8BtEunD8NH/4XVA==
age
52892
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
76366
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:58 GMT
server
cloudflare
etag
0x8D96DBF6CBEE741
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
90828af6-301e-00d6-58e1-5a933c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148bd8d5f1ad4-FRA
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sat, 15 Jul 2023 02:22:06 GMT
x-content-type-options
nosniff
age
196591
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19156
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 14 Jul 2024 02:22:06 GMT
js
www.googletagmanager.com/gtag/
255 KB
86 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP&l=dataLayer&cx=c
Requested by
Host: www.googleoptimize.com
URL: https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b921cf7c75254a91b0094a74466fa6efe7919c919e280ffc31e3c01c72d4561b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
87875
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 17 Jul 2023 08:58:37 GMT
gtm.js
www.googletagmanager.com/
440 KB
116 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
14e22ee71d78a987b58d848362620b45e567735952281ef301e92e9e56b7c3f1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
118016
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 Jul 2023 08:58:37 GMT
labs-bg-light.png
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/
34 KB
35 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/img/labs-bg-light.png
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cc079836abe496d8cc3a3e2b5ec355195b2dc1cde665b6d1ea5996e04b930720
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 3, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
2186656
x-cache
MISS, MISS, HIT, HIT, MISS
fastly-io-info
ifsz=77240 idim=700x951 ifmt=png ofsz=35184 odim=700x951 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-7f4f4c4f48-jvdhl
fastly-stats
io=1
content-length
35184
x-served-by
cache-chi-kigq8000105-CHI, cache-ams21070-AMS, cache-ams21077-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.043245,VS0,VE3
etag
"415RmH+qY7y0pO9WtlNuUfXiFHiiLrKd2zwZaTNOyZg"
vary
Accept
content-type
image/webp
x-styx-req-id
e926e01a-109c-11ee-913e-c2c66469d3ff
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 22 Jun 2024 01:34:20 GMT
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&callback=jQuery112408823964543234839_1689584317001&_=1689584317002
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
af7942c0849d53ac33209a400329eab0816c7dc133d085537b5b4eb167d6ff0d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
x-form-service-request-id
4c56#1896312b2d7
x-marketo-source
Form Service
cf-ray
7e8148bd9f919be0-FRA
cached
false
getForm
go.sentinelone.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2673&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&callback=jQuery112408823964543234839_1689584317003&_=1689584317004
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
322215fdcb5e286389111a5bac2077cf8baba59c6b26fc05ff3c0832b339ad4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
server
cloudflare
cf-ray
7e8148bd9f939be0-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
703 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a423 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ddb06e7a4aa617032f2bdebe1845d4d69010eaf90b19be754fe8985b594e1c47
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 17 Jul 2023 08:18:47 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=84414
accept-ranges
bytes
content-length
491
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
user-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
1 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/user-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
1, 89, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521567
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
775
x-served-by
cache-chi-kigq8000178-CHI, cache-fra-eddf8230079-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:21 GMT
server
nginx
x-timer
S1689584317.062029,VS0,VE3
etag
W/"64ad06ed-556"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bfbf6c5c-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:50 GMT
calendar-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 89, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521567
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
847
x-served-by
cache-chi-klot8100128-CHI, cache-fra-eddf8230068-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.062183,VS0,VE3
etag
W/"64ad06ea-7ae"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bfbdd405-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:50 GMT
arrow-left-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
835 B
856 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/arrow-left-dark.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 88, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521567
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-fnt6g
content-length
489
x-served-by
cache-chi-klot8100114-CHI, cache-fra-eddf8230121-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.065694,VS0,VE4
etag
W/"64ad06ea-343"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bfbdb127-1fc1-11ee-8d15-fa29b1107d35
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:50 GMT
search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
681 B
703 B
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 7601, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521568
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
385
x-served-by
cache-chi-kigq8000120-CHI, cache-fra-eddf8230131-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.066429,VS0,VE14
etag
W/"64ad06ea-2a9"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bee4bb48-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:48 GMT
calendar-icon-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/calendar-icon-light.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
1, 91, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521567
x-cache
HIT, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-465qx
content-length
842
x-served-by
cache-chi-klot8100021-CHI, cache-fra-etou8220119-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.066405,VS0,VE3
etag
W/"64ad06ea-798"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
bfbe3828-1fc1-11ee-a315-a26e735dc5ed
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:50 GMT
social-twitter-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 10705, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521562
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-4bszt
content-length
1036
x-served-by
cache-chi-kigq8000103-CHI, cache-fra-eddf8230061-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.141097,VS0,VE3
etag
W/"64ad06ea-7e1"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
c24e7cb6-1fc1-11ee-9605-c238e3266a0d
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:54 GMT

Redirect headers

x-cache-hits
0, 57, 0, 0
content-security-policy
script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age
717
x-redirect-by
WordPress
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-7bp6c
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100133-CHI, cache-fra-etou8220087-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1689584317.067157,VS0,VE3
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
x-styx-req-id
726c4d2a-247e-11ee-ad4a-7652746bf7b5
cache-control
max-age=3600
accept-ranges
bytes
expires
Mon, 17 Jul 2023 09:46:40 GMT
social-linkedin-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg;
  • https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
2 KB
1 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 745, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
content-encoding
gzip
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521567
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-zv6b2
content-length
993
x-served-by
cache-chi-klot8100083-CHI, cache-fra-eddf8230096-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
last-modified
Tue, 11 Jul 2023 07:38:21 GMT
server
nginx
x-timer
S1689584317.141518,VS0,VE3
etag
W/"64ad06ed-90f"
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-styx-req-id
c00136fb-1fc1-11ee-a714-f6d7e4d4666c
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:05:50 GMT

Redirect headers

x-cache-hits
0, 57, 0, 0
content-security-policy
script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com;
strict-transport-security
max-age=31622400; includeSubDomains; preload
x-content-type-options
nosniff
date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
age
716
x-redirect-by
WordPress
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-gtbj5
content-length
0
x-xss-protection
1; mode=block
x-served-by
cache-chi-klot8100131-CHI, cache-fra-eddf8230139-FRA, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
referrer-policy
origin-when-cross-origin
server
nginx
x-timer
S1689584317.066790,VS0,VE3
expect-ct
enforce; max-age=2592000;
x-frame-options
ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com
vary
Cookie, Cookie
content-type
text/html; charset=UTF-8
location
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
x-styx-req-id
726c4c90-247e-11ee-bb24-0a5d302d9f4d
cache-control
max-age=3600
accept-ranges
bytes
expires
Mon, 17 Jul 2023 09:46:40 GMT
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
19 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 14 Jul 2023 18:19:08 GMT
x-content-type-options
nosniff
age
225569
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
19440
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:08:34 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 13 Jul 2024 18:19:08 GMT
zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
20 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sat, 15 Jul 2023 06:11:02 GMT
x-content-type-options
nosniff
age
182855
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20352
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:04:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 14 Jul 2024 06:11:02 GMT
zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
fonts.gstatic.com/s/ibmplexsans/v19/
20 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v19/zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sat, 15 Jul 2023 00:58:49 GMT
x-content-type-options
nosniff
age
201588
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20880
x-xss-protection
0
last-modified
Tue, 02 May 2023 16:19:17 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 14 Jul 2024 00:58:49 GMT
Socicon.woff2
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/
63 KB
63 KB
Font
General
Full URL
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/Socicon.woff2?87visu
Requested by
Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

Referer
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1689419955
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 350, 0, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
521555
x-cache
MISS, HIT, MISS, MISS
x-pantheon-styx-hostname
styx-fe2-b-579886598f-crzrh
content-length
64512
x-served-by
cache-chi-klot8100177-CHI, cache-fra-eddf8230038-FRA, cache-fra-eddf8230031-FRA, cache-fra-eddf8230031-FRA
last-modified
Tue, 11 Jul 2023 07:38:18 GMT
server
nginx
x-timer
S1689584317.457183,VS0,VE4
etag
"64ad06ea-fc00"
content-type
font/woff2
access-control-allow-origin
*
x-styx-req-id
c73b426a-1fc1-11ee-9b77-8a0dba694792
cache-control
max-age=31622400
accept-ranges
bytes
expires
Thu, 11 Jul 2024 08:06:02 GMT
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
truncated
/
4 KB
4 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Referer
Origin
https://www.sentinelone.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
application/x-font-woff2
Cloud_Credentials_Stealer_6.jpg
de.sentinelone.com/wp-content/uploads/2023/07/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg
35 KB
35 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
91ca6512df8dbf62bfa5c05723905b52d5c39a12f254c731d066c3aabfd5327f
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 6, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
330987
x-cache
MISS, HIT, HIT, MISS
fastly-io-info
ifsz=68015 idim=819x474 ifmt=jpeg ofsz=35574 odim=819x474 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-gfh5t
fastly-stats
io=1
content-length
35574
x-served-by
cache-ams21033-AMS, cache-ams12772-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.247662,VS0,VE3
etag
"dQ31f93nKRyaa7RJS/ji5wFrbnnXaNf1TE0IDP7C8WI"
vary
Accept
content-type
image/webp
x-styx-req-id
7a7a31e9-217d-11ee-bbc8-46fceb4fc8f1
cache-control
max-age=31622400
accept-ranges
bytes
expires
Sat, 13 Jul 2024 13:02:10 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ppSPwy6JMjhW%2BUg%2B4lVDRA5D6oMIzuAc0sdCTOCD6m9BerVjYY0kjRVYkImq9tHzw1gnz61m3pC6p761xbbVF49C1Pg3ZrbBcq3s90thNfYOBABMxVfziXt6sifQ4PGCPYGUl3I%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/07/Cloud_Credentials_Stealer_6.jpg
cf-ray
7e8148bdffde2c5d-FRA
content-length
0
Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/06/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
4 KB
4 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f4e392aa498ce82dc20c138d1d212e496861c34f0b7f04551f212fa04e51486d
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 23, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
433248
x-cache
MISS, MISS, HIT, HIT, MISS
fastly-io-info
ifsz=4605 idim=150x150 ifmt=jpeg ofsz=3612 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-5f7f6dfd6c-wl4b7
fastly-stats
io=1
content-length
3612
x-served-by
cache-chi-klot8100136-CHI, cache-ams21067-AMS, cache-ams21067-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.191455,VS0,VE2
etag
"lKKKo4O07O3++pOlYcXuCia5JHX81m9lyebn4h+Vcg4"
vary
Accept
content-type
image/webp
x-styx-req-id
6248d857-208f-11ee-ae15-96f65b0a56bc
cache-control
max-age=31622400
accept-ranges
bytes
expires
Fri, 12 Jul 2024 08:37:49 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ai8SgYOEWcVbNzN%2BK3SWJbSDb2rtBI3BeMHYH3c27hpcCLm7l1%2FfTD5fqKj2GRmlv%2FLe7738nDz1k%2BpRtJRn%2F7vs%2B9Ol4NaLDpYTOuEdpCFaJeCuBfqbrtN%2B2%2FZ5VkIrjnj8t1o%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/06/Quiver-%E2%80%93-Using-Cutting-Edge-ML-to-Detect-Interesting-Command-Lines-for-Hunters-2-150x150.jpg
cf-ray
7e8148bdffe02c5d-FRA
content-length
0
Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/06/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
2 KB
2 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
8ae35f96358f1b70d18cf16c45761c444ba700312c70bcbdb6c07327842f7679
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 0, 2, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
2226990
x-cache
MISS, MISS, HIT, MISS
fastly-io-info
ifsz=3034 idim=150x150 ifmt=jpeg ofsz=1950 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-b-5b95b845bd-p86zt
fastly-stats
io=1
content-length
1950
x-served-by
cache-ams21021-AMS, cache-ams12736-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.212542,VS0,VE1
etag
"j36vT9d6X8XbnrytsKIxMvsk3QXwL0l5BKeCMoj1hbg"
vary
Accept
content-type
image/webp
x-styx-req-id
00755e25-103f-11ee-97d2-ce52b5a74158
cache-control
max-age=31622400
accept-ranges
bytes
expires
Fri, 21 Jun 2024 14:22:07 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GyZvaGAPDhx2D2cBq2kC7%2FB3niss4lxV3eJv6A3XcaQ0uOtucjkZNKbpbSifyl5KCV3DhyzHspJCdYD9aAidFndJOErWMj2gl5o2XVLQSjRaU3N%2BQbDHsGnPs5vT53%2FaosEFhsw%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/06/Automating-String-Decryption-and-Other-Reverse-Engineering-Tasks-in-radare2-With-r2pipe-By-Phil-Stokes-1-150x150.jpg
cf-ray
7e8148bdffe12c5d-FRA
content-length
0
Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
de.sentinelone.com/wp-content/uploads/2023/06/
Redirect Chain
  • https://www.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
  • https://de.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
3 KB
4 KB
Image
General
Full URL
https://de.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
23.185.0.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4c939a7c5dd7f97c9b29e9041b1d944c465bd990b5294c4d3761217c69a7cc41
Security Headers
Name Value
Strict-Transport-Security max-age=31622400; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-cache-hits
0, 1, 1, 1, 0
strict-transport-security
max-age=31622400; includeSubDomains; preload
via
1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish, 1.1 varnish
date
Mon, 17 Jul 2023 08:58:37 GMT
age
1803334
x-cache
MISS, HIT, HIT, HIT, MISS
fastly-io-info
ifsz=4488 idim=150x150 ifmt=jpeg ofsz=3408 odim=150x150 ofmt=webp
x-pantheon-styx-hostname
styx-fe2-a-59f5cb9b5b-v9wnn
fastly-stats
io=1
content-length
3408
x-served-by
cache-chi-klot8100128-CHI, cache-ams21064-AMS, cache-ams12736-AMS, cache-fra-eddf8230116-FRA, cache-fra-eddf8230116-FRA
server
nginx
x-timer
S1689584317.191565,VS0,VE2
etag
"lvWMDvnSueKJNALkkyxmtQMAvxpSdDwupZVFT0P2OOw"
vary
Accept
content-type
image/webp
x-styx-req-id
bed73ce7-0e20-11ee-ad9c-7240bd3d0b6f
cache-control
max-age=31622400
accept-ranges
bytes
expires
Tue, 18 Jun 2024 21:40:29 GMT

Redirect headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6bLrAMqnvxAbrHAMrzV0sEPpiKUSTidBUIVfTH6Z7HWlU9zt%2BB9WD7rB8Rf%2BbHa3wC9Ht8fl1fm9FHtCVrbgZfBEQs7FrkBl9WQEwgcFbFvqHBal%2FkMZZVSbhOP7YfV6sx6MgW0%3D"}],"group":"cf-nel","max_age":604800}
location
https://de.sentinelone.com/wp-content/uploads/2023/06/Star-Gazing-Using-a-Full-Galaxy-of-YARA-Methods-to-Pursue-an-Apex-Actor-150x150.jpg
cf-ray
7e8148bdffe22c5d-FRA
content-length
0
en.json
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/
54 KB
11 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
39730
content-md5
g3u/cB4L4tfTQx7Hp+ONEQ==
content-length
11065
x-ms-lease-status
unlocked
last-modified
Fri, 10 Sep 2021 19:25:24 GMT
server
cloudflare
etag
0x8D97490BD2F4CA7
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
4b382f98-d01e-0076-2ee1-5a5c5a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148be5c332c3d-FRA
expires
Tue, 18 Jul 2023 08:58:37 GMT
forms2.css
go.sentinelone.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 05 May 2023 17:50:03 GMT
server
cloudflare
age
6437
etag
"1520cb3-3437-5faf5eb2bc8c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7e8148be58749be0-FRA
content-length
2623
expires
Mon, 17 Jul 2023 12:58:37 GMT
forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/
828 B
335 B
Stylesheet
General
Full URL
https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 05 May 2023 17:50:03 GMT
server
cloudflare
age
3602
etag
"5e00d3-33c-5faf5eb2bc8c0"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7e8148be58779be0-FRA
content-length
246
expires
Mon, 17 Jul 2023 12:58:37 GMT
iframe_api
www.youtube.com/
1006 B
2 KB
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1689419955
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c4d97de65cd9e6bf5ee2724452b46b314480d7d6649f53ee771df32271422b86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
content-encoding
br
content-security-policy-report-only
require-trusted-types-for 'script';report-uri /cspreport, base-uri 'self';default-src 'self' https: blob:;font-src https: data:;img-src https: data: android-webview-video-poster:;media-src blob: https:;object-src 'none';script-src 'report-sample' 'nonce-SdCUJfIH_maQol6BO5fROA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';style-src https: 'unsafe-inline';report-uri /cspreport
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server
ESF
x-frame-options
SAMEORIGIN
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-type
text/javascript; charset=utf-8
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
cache-control
private, max-age=0
origin-trial
AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Mon, 17 Jul 2023 08:58:37 GMT
OneSignalPageSDKES6.js
cdn.onesignal.com/sdks/
284 KB
68 KB
Script
General
Full URL
https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151603
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=12c9789c4528a9431963b4b52733d818
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0eda55ec47640c00aa84096fabdb63c66f5e456f7b141e1ba1d153c2b6ebceb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
560
etag
W/"22f7e3545bf8cba3cac43d34db3357ed"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=259200
cf-ray
7e8148bf7e4f194b-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Thu, 20 Jul 2023 08:58:37 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
13 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
r7t3xbAZ3QK/7lQuu5X7ww==
age
39730
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2950
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:51 GMT
server
cloudflare
etag
0x8D96DBF68EC8D5B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0e75d206-d01e-00b1-14e1-5a209b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148bf8d7a2c3d-FRA
otPcPanel.json
cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/
47 KB
11 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/otPcPanel.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
57AUyP21eMxOiwzpGGh99A==
age
932
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
11457
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:11:53 GMT
server
cloudflare
etag
0x8D96DBF6A0C163B
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
526a64c6-301e-007c-14e1-5a45d3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
7e8148bf8d7e2c3d-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/6.23.0/assets/
20 KB
4 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a972 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Ye6OeZcNyuFoWog7CYs00A==
age
494
x-ms-lease-status
unlocked
last-modified
Thu, 02 Sep 2021 03:12:05 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
960abd06-f01e-0180-53e1-5a3d19000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
7e8148bf8d812c3d-FRA
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a423 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 11 Jul 2023 13:00:15 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=35388
accept-ranges
bytes
content-length
4807
p
e.calibermind.com/v1/
16 B
630 B
Fetch
General
Full URL
https://e.calibermind.com/v1/p
Requested by
Host: cdn.calibermind.com
URL: https://cdn.calibermind.com/a.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::6815:2d74 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type
text/plain

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
access-control-max-age
900
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EmTxLbhoudyXVT6C6KDhnH97O7dxT2u9RWu%2Bq6MDTL8e4nSC0GsdfTlQMeQuxGuoFZnBtLi8UFmn%2Biiw5a5QMeuQk90lEsjputS4EehNoJ%2FviVOatfP1NokKpbl%2FJpJSSd4Gj5J9ValN%2FlmjppI%2FFw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
7e8148c09a681c1e-FRA
alt-svc
h3=":443"; ma=86400
access-control-allow-headers
Content-Type,Authorization
content-length
16
x-request-id
4ae0fbd3-2a7f-49ef-808c-e9281fd74475
optimize.js
www.google-analytics.com/gtm/
166 KB
61 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-K9ZDGR4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
38fb72b9d6d50b1b5ba8f5c222d3c31966b672cd5fd7f3454f881d7020011118
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
62241
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Mon, 17 Jul 2023 08:58:37 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 17 Jul 2023 07:04:37 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
6840
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 17 Jul 2023 09:04:37 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1689584317491&cv=11&fst=1689584317491&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&auid=868522072.1689584317&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30ca408ce84116fb6e43580f7e1a6e7dea9b1cd86bbdd50ccd307e1b94b70b0f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1422
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
hotjar-2714452.js
static.hotjar.com/c/
9 KB
4 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.192.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-192-125.muc50.r.cloudfront.net
Software
/
Resource Hash
26f2c0ed462cfc22a4e8ee8b49647b8e17e022a8cddb63d17604d7cb29f0d2d2
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 fb542039f97bb702c0e68d2142c449aa.cloudfront.net (CloudFront)
x-amz-cf-pop
MUC50-P1
age
16
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/952cb26aa3e4180031b439559ddde551
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
lr4DFNetsQA93ysJjCsS7BjpQa0LT54wMcHS-dsy-TRTB9j_eCPeyQ==
activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-c...
10466992.fls.doubleclick.net/ Frame E398
Redirect Chain
  • https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-o...
  • https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.c...
678 B
675 B
Document
General
Full URL
https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
cafe /
Resource Hash
452706c0ab7786a68c8c124f5ecf4652bada979632dc366a5ea54ed620cd967c
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
334
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 17 Jul 2023 08:58:37 GMT
expires
Mon, 17 Jul 2023 08:58:37 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 17 Jul 2023 08:58:37 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
bat.js
bat.bing.com/
40 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Mon, 17 Jul 2023 08:58:36 GMT
last-modified
Thu, 11 May 2023 18:08:27 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E4925471815E49689CFE59841E3ECF33 Ref B: FRA31EDGE0813 Ref C: 2023-07-17T08:58:37Z
etag
"80df77953384d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12183
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
56a667965d8d21035d00000d.js
tag.marinsm.com/serve/
12 KB
4 KB
Script
General
Full URL
https://tag.marinsm.com/serve/56a667965d8d21035d00000d.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.64.65 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cowboy /
Resource Hash
f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 08:58:37 GMT
Via
1.1 vegur, 1.1 varnish
X-Content-Type-Options
nosniff
Content-Encoding
gzip
Age
543
X-Cache
HIT
Connection
keep-alive
Content-Length
3894
X-Served-By
cache-fra-eddf8230083-FRA
Server
Cowboy
X-Timer
S1689584318.638411,VS0,VE1
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=1800
Accept-Ranges
bytes
X-Cache-Hits
1
munchkin.js
munchkin.marketo.net/
1 KB
2 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 08:58:37 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
bf-munchkin.min.js
munchkin.brightfunnel.com/js/build/
20 KB
7 KB
Script
General
Full URL
https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.66.192.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-192-34.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
Via
1.1 28e56b9ddced4ed414e75f87cbd0d976.cloudfront.net (CloudFront)
Date
Mon, 17 Jul 2023 08:58:37 GMT
X-Amz-Cf-Pop
MUC50-P1
Age
11
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Last-Modified
Wed, 16 Jun 2021 18:10:10 GMT
Server
AmazonS3
ETag
W/"20317c42053d4a6e5ba388544778b12a"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=300
X-Amz-Cf-Id
Yn9B9qNoEP-X8Y2qx7VTvVE9O4BFjdH9ak6U6y1tEfhsy5MZWXGiJw==
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
703 B
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:780::210:a423 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ddb06e7a4aa617032f2bdebe1845d4d69010eaf90b19be754fe8985b594e1c47
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 17 Jul 2023 08:18:47 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=84414
accept-ranges
bytes
content-length
491
qevents.js
a.quora.com/
40 KB
14 KB
Script
General
Full URL
https://a.quora.com/qevents.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.152.17 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
x-amz-version-id
VqBO7svKfismDjrOf54BMqOIARlRLNs7
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
EFHR3G5GTGQA71CH
age
7105780
x-amz-server-side-encryption
AES256
alt-svc
h3=":443"; ma=86400
x-amz-id-2
BK/ROoScV68EuoV+02aoVjqhDqCbCQRyRQBXfzSS4mZCsmdX+tx3ckGhVazbLNyeb4CIhuyj9tNuPBfbUdnPpWM5v2t9D1znTtGlu4SQxBA=
last-modified
Sat, 22 Apr 2023 01:03:41 GMT
server
cloudflare
x-amz-meta-s3cmd-attrs
md5:47078e63380c6b0cbbfb6d8508b25ee7
etag
W/"47078e63380c6b0cbbfb6d8508b25ee7"
vary
Accept-Encoding
content-type
text/plain
cache-control
public, max-age=14400
cf-ray
7e8148c13a26924a-FRA
expires
Mon, 17 Jul 2023 12:58:37 GMT
collect
region1.google-analytics.com/g/
0
249 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-KJPGLC9EVP&gtm=45je37c0&_p=173164196&cid=1752860504.1689584318&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1689584317&sct=1&seg=0&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&dt=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-KJPGLC9EVP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
client.js
cdn.abrankings.com/js/
35 KB
8 KB
Script
General
Full URL
https://cdn.abrankings.com/js/client.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:cc00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
public
date
Wed, 17 May 2023 03:45:24 GMT
content-encoding
gzip
via
1.1 94313a5530517e71f4769858ce013d58.cloudfront.net (CloudFront)
last-modified
Tue, 14 Jun 2022 17:44:33 GMT
server
nginx/1.20.1
x-amz-cf-pop
MUC50-P3
age
5289193
etag
W/"62a8c901-8d68"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
max-age=15552000, public
x-amz-cf-id
xHtPUoSIq_c8ArLuk24VpKhGYBPa49IyXXP0FnOZUp9_X81VhCpXRw==
expires
Mon, 13 Nov 2023 03:45:24 GMT
js
www.googletagmanager.com/gtag/
175 KB
63 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-10604934
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e852245c2645727c8023e6f242a17a9206f53ec0376b54080d121216f77606e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64779
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 Jul 2023 08:58:37 GMT
6si.min.js
j.6sc.co/
43 KB
13 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b906ad2354f2fda9f508a0cd7c7d57ecf61cb7a47974ce212d6588e07c3efa53
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 14 Jul 2023 19:07:24 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64b19cec-ab6f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
13449
expires
Mon, 17 Jul 2023 08:58:37 GMT
stat.js
www.clickcease.com/monitor/
171 KB
54 KB
Script
General
Full URL
https://www.clickcease.com/monitor/stat.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:223e:d600:15:a0d3:77c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
6Er2d0GJvgnFniPQXIH7h8kzG7dJBNJf
content-encoding
gzip
via
1.1 803246727539350977d724c9e4a027c6.cloudfront.net (CloudFront)
date
Mon, 17 Jul 2023 08:58:33 GMT
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self' https://clickcease.com https://*.clickcease.com; upgrade-insecure-requests;
x-amz-cf-pop
FRA56-P4
age
6
x-amz-server-side-encryption
AES256
strict-transport-security
max-age=31536000; includeSubDomains
x-cache
Hit from cloudfront
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 22 Nov 2022 11:31:37 GMT
server
AmazonS3
etag
W/"1c27f449b067550681f23ad3e53988fa"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
application/javascript
permissions-policy
microphone 'none'; camera 'none';
x-amz-cf-id
p-VpU69Y381xx4r_t68AeceiByFjLJUapn90CDy36e6TV3S58AU4LQ==
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
2 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.40.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-40-116.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 02:44:22 GMT
Content-Encoding
gzip
Via
1.1 210c8ad3e752d602af05a2de06eb2ff8.cloudfront.net (CloudFront)
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
X-Amz-Cf-Pop
MUC50-P2
Age
22456
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
grLcwxVc_CDkXUpMDAwVOhTdaSYMLr_kh9KPOItm3-rS2i2m-qETrQ==
js
www.googletagmanager.com/gtag/
175 KB
63 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-13115870
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d67eedcc15f788685857f9d24dbe627698a1e118bfb9903fd244b80a576f301a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64781
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 Jul 2023 08:58:37 GMT
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230041-FRA
js
www.googletagmanager.com/gtag/
201 KB
71 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c43e933b9d6cd7f80c7eacd3a7e347199d64c3a9827d982552fd480b72948e78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
72881
x-xss-protection
0
last-modified
Mon, 17 Jul 2023 06:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 17 Jul 2023 08:58:37 GMT
XDFrame
go.sentinelone.com/index.php/form/ Frame EA91
2 KB
858 B
Document
General
Full URL
https://go.sentinelone.com/index.php/form/XDFrame
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7e8148c0eb119be0-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Mon, 17 Jul 2023 08:58:37 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/svg+xml
www-widgetapi.js
www.youtube.com/s/player/4cc5d082/www-widgetapi.vflset/
203 KB
63 KB
Script
General
Full URL
https://www.youtube.com/s/player/4cc5d082/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5de4b128a933b726d8b2987bb31607134c187abf301c5e288f6e232de26fe925
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:51:25 GMT
content-encoding
br
x-content-type-options
nosniff
age
432
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
64262
x-xss-protection
0
last-modified
Wed, 12 Jul 2023 02:37:44 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Tue, 16 Jul 2024 08:51:25 GMT
token
cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/
36 B
366 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:55:32 GMT
content-encoding
gzip
via
1.1 adb1b226e6965f6206603ba087bd4a0a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
185
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
1XPImgjUEBLfco7NpbyhRqAlPO1Kyt9gyTuptAu-OKJWVDneaS5ZrA==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D432890%26time%3D1689584317655%26url%3Dhttps%253A%252F%252Fwww.sentinelone.com%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-t...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&cookiesTest=true&liSync=true&e_ipv6=AQKj_0E70uHViwAAAYljEreioi-iDv5v5AiiahOs9U_hwOI6zIFNvDSRTJw97foJWngR__U
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: B1F0D3A3EE4143F9B3DEA015746DE444 Ref B: FRAEDGE1211 Ref C: 2023-07-17T08:58:38Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYAqwEgzlylmjPvs4a0GA==

Redirect headers

date
Mon, 17 Jul 2023 08:58:38 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: AEF0E5C45A924635BCC4B1C78B091C0B Ref B: DUS30EDGE0408 Ref C: 2023-07-17T08:58:38Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=432890&time=1689584317655&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&cookiesTest=true&liSync=true&e_ipv6=AQKj_0E70uHViwAAAYljEreioi-iDv5v5AiiahOs9U_hwOI6zIFNvDSRTJw97foJWngR__U
x-li-proto
http/2
content-length
0
x-li-uuid
AAYAqwEdOm6u8jvwwOQYNg==
web
onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/
3 KB
2 KB
Script
General
Full URL
https://onesignal.com/api/v1/sync/acaf2329-c613-4dbe-a651-1ed5a45c3762/web?callback=__jp0
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151603
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0a1d3ca28aa25ee5a441e3ac2b2b1396424994f26550a49d36fab35b7050f65
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
age
933
cf-polished
origSize=3460
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
29f4abe2-faca-4680-bcb6-7d816c08b6b7
x-runtime
0.038983
referrer-policy
strict-origin-when-cross-origin
cf-bgj
minify
server
cloudflare
etag
W/"ac6b95cab5dec28f0d9b9c9224b8f476"
x-download-options
noopen
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=3600
cf-ray
7e8148c1aa46194b-FRA
access-control-allow-headers
SDK-Version
expires
Mon, 17 Jul 2023 09:58:37 GMT
token
cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/
36 B
366 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/432890/domain/sentinelone.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:9e00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:55:32 GMT
content-encoding
gzip
via
1.1 adb1b226e6965f6206603ba087bd4a0a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
185
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
HSaNR9D_LWbHl9QtXf-aM7MzMFeb40zSx_hhKZQnL0cYmZbzLHTrZw==
modules.5957fbf26d1b525b5a12.js
script.hotjar.com/
274 KB
67 KB
Script
General
Full URL
https://script.hotjar.com/modules.5957fbf26d1b525b5a12.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-74.fra56.r.cloudfront.net
Software
/
Resource Hash
e1a95fe6d4be6f16467a0a7a04c51110a66f610b7d59cf9b716fa34f1543c42a
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 14 Jul 2023 11:14:07 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=2592000; includeSubDomains
via
1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
age
251070
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
68492
last-modified
Fri, 14 Jul 2023 11:14:02 GMT
etag
"d66c5115c5512ad428cd30462d44ee4f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
ROA2l7yx1Oav6h_L7sbQ90IQCuoETANA731DRIwbhc_BWEs_uUNXXA==
rp.gif
alb.reddit.com/
42 B
638 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1689584317707&id=undefined&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=97a9646b-1a68-4151-8401-fb93b8cfa5c9&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
tagjs
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag
  • https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
125 B
454 B
Script
General
Full URL
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Server
52.209.55.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-55-66.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
187ace26442461a0e81a59bac6d66b83984d1fe7c5e6bb674a442421699f1f43

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
125
Content-Type
text/javascript

Redirect headers

Location
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
munchkin.js
munchkin.marketo.net/163/
11 KB
6 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-38-132.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 08:58:37 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Content-Type
application/x-javascript
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Wed, 25 Oct 2023 08:58:37 GMT
pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/
43 B
421 B
Image
General
Full URL
https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&tag=ViewContent&ts=1689584317715
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.3.54.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-3-54-184.compute-1.amazonaws.com
Software
nginx /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 08:58:38 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains; preload
Server
nginx
Connection
keep-alive
Content-Length
43
X-Q-Stat
,cf4305873ec8715e4a99c3009645560e,10.0.0.162,32234,80.255.7.105,,138736696230,1,1689584318.239,0.002,,.,0,0,0.000,0.004,-,0,0,197,177,88,10,34729,,,,,,-,
Content-Type
image/gif
/
www.google.com/pagead/1p-user-list/970186784/
42 B
456 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/970186784/?random=1689584317491&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&fmt=3&is_vtc=1&random=1444516013&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/970186784/
42 B
456 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/970186784/?random=1689584317491&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&fmt=3&is_vtc=1&random=1444516013&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sd
api.brightfunnel.com/v1/
4 B
542 B
XHR
General
Full URL
https://api.brightfunnel.com/v1/sd
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-45.fra60.r.cloudfront.net
Software
/
Resource Hash
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

Date
Mon, 17 Jul 2023 08:58:39 GMT
Via
1.1 c80fd33b8f8c4dff5488cc52ba797aa6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Amzn-Trace-Id
Root=1-64b502bf-45b4858e49d95ade7753a7f9;Sampled=0;lineage=9409b995:0
x-amzn-RequestId
29adfa7f-0de0-4236-8602-457f72dc3472
X-Cache
Miss from cloudfront
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
keep-alive
x-amz-apigw-id
IM1d5E0CoAMFXrg=
Content-Length
4
X-Amz-Cf-Id
XEPNKmcxBWMDSTbj1C1Umh578ePDdvX1_pOdua8X4FvSD0i8oYB5Ug==
sd
api.brightfunnel.com/v1/
4 B
542 B
XHR
General
Full URL
https://api.brightfunnel.com/v1/sd
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-45.fra60.r.cloudfront.net
Software
/
Resource Hash
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept
application/json
Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type
application/x-www-form-urlencoded

Response headers

Date
Mon, 17 Jul 2023 08:58:38 GMT
Via
1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA60-P1
X-Amzn-Trace-Id
Root=1-64b502be-2850180b008f60a57d8b8a61;Sampled=0;lineage=9409b995:0
x-amzn-RequestId
02ad3570-f840-42ee-ae2f-85f48adb9666
X-Cache
Miss from cloudfront
Content-Type
application/json
Access-Control-Allow-Origin
*
Connection
keep-alive
x-amz-apigw-id
IM1dvEG0oAMFl0g=
Content-Length
4
X-Amz-Cf-Id
99yoRhmOqlobADZnLC3a0iR6yOHHmLXYCjZdaMGmAaq1SljjOYkWTw==
forms2.min.js
go.sentinelone.com/js/forms2/js/ Frame EA91
208 KB
69 KB
Script
General
Full URL
https://go.sentinelone.com/js/forms2/js/forms2.min.js
Requested by
Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://go.sentinelone.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 05 May 2023 17:50:04 GMT
server
cloudflare
age
2012
etag
"1520cbc-33e51-5faf5eb3b0b00"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7e8148c22d129be0-FRA
expires
Mon, 17 Jul 2023 12:58:37 GMT
134618848.js
bat.bing.com/p/action/
0
119 B
Script
General
Full URL
https://bat.bing.com/p/action/134618848.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Mon, 17 Jul 2023 08:58:36 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 3D97F7FB783742899D31817374236948 Ref B: FRA31EDGE0813 Ref C: 2023-07-17T08:58:37Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/
0
288 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=c990eb30-a20b-4439-b543-13ddaddc57ff&sid=1e4b0790248011eea272918820725325&vid=1e4b1830248011eea31e37a45fb105e1&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure,%20GCP%20-%20SentinelOne&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&r=&lt=1190&evt=pageLoad&sv=1&rn=732479
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 17 Jul 2023 08:58:36 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: C4820C85C2384FC39BE52005C5A7C2E7 Ref B: FRA31EDGE0813 Ref C: 2023-07-17T08:58:37Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
4 B
186 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=173164196&t=pageview&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&ul=en-us&de=UTF-8&dt=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABQAAAACAAI~&jid=748311134&gjid=1615235462&cid=1752860504.1689584318&tid=UA-38175129-1&_gid=188145197.1689584318&_r=1&_slc=1&gtm=45He37c0n71KGGXSJ&z=389699943
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=*;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred...
adservice.google.com/ddm/fls/z/ Frame E398
42 B
402 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=*;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Requested by
Host: 10466992.fls.doubleclick.net
URL: https://10466992.fls.doubleclick.net/activityi;dc_pre=CMnMyYiwlYADFdpXkQUdV0oJ3w;src=10466992;type=sitew0;cat=sitew0;ord=3832156868257;auiddc=868522072.1689584317;u1=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F;gtm=45He37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10466992.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10940107324/?random=1689584317910&cv=11&fst=1689584317910&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&auid=868522072.1689584317&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c1a3d20f10ccb380e3acd058e949abdb32d40455c2e8ccf56f140584cde5c8c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1442
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/
3 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/462891735/?random=1689584317923&cv=11&fst=1689584317923&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&auid=868522072.1689584317&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10940107324
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef678c966f2d7de1944fbed459455023b93bc657fc82d5a1a7b7a2f2f4bc1183
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1441
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&tdp=AW-10940107324;71166715;0;0;0&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
td
www.googletagmanager.com/
0
15 B
Image
General
Full URL
https://www.googletagmanager.com/td?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=www.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&tdp=AW-10940107324;71166715;0;0;0&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:37 GMT
server
Golfe2
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtm.init&eid=0&h=Ag&tr=1ogtadsdatatos.1ogtgasend.1ogt1pdatav2.1ccdadsfirst.1ccdpreautopii.1ccdadsfirst.1ccdadslast.1ccdadslast&ti=2ogtadsdatatos.2ogtgasend.2ogt1pdatav2.2ccdadsfirst.2ccdpreautopii.2ccdadsfirst.2ccdadslast.2ccdadslast&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtm.js&eid=1&h=Ag&tr=1rep.1rep&ti=1rep.1rep&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtag.config&eid=3&h=Ag&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=*&eid=5&h=Ag&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
collect
stats.g.doubleclick.net/j/
4 B
353 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-38175129-1&cid=1752860504.1689584318&jid=748311134&gjid=1615235462&_gid=188145197.1689584318&_u=aADAAEAAQAAAACAAI~&z=1316269573
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/1/i/
43 B
380 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fd53db2e-592f-4358-a15a-ce3ff9ae9e52&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cd974851-4c11-45fa-96f3-41ec28e54e7e&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-response-time
186
date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
e0557e3e9714f28e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
7f14ee64485ab3f5bedf13fe7691d9dd529b9e0b7cddbb43a07b96f0166d1845
content-length
43
adsct
analytics.twitter.com/1/i/
43 B
728 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=fd53db2e-592f-4358-a15a-ce3ff9ae9e52&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=cd974851-4c11-45fa-96f3-41ec28e54e7e&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&tw_iframe_status=0&txn_id=nv1yw&type=javascript&version=2.3.29
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-response-time
102
date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
3b1f9fd6cffbe7c0
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
3a38e1d44de71c46ad1aff4ee55828b930c8956535899782847d39e6062e8d90
content-length
43
visitWebPage
327-mnm-087.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1689584317970&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1689584317969-12771&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Mon, 17 Jul 2023 08:58:38 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
8a8ea9d9-31df-4be0-8987-f775ce59cc36
/
c.6sc.co/
7 B
197 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
19 B
306 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.sentinelone.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a01:4a0:1338:92::5
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="469328_388391900_17297533_20_856_39_0_-";dur=1
content-length
19
expires
Mon, 17 Jul 2023 08:58:38 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%223576c97e67a9b7f8553a44ff1cc54791%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%228ba4c5a3fa178cfadac2b61291295db2874be830%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.googleadservices.com/pagead/conversion/970186784/
3 KB
2 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion/970186784/?random=1689584318038&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&bttype=purchase&auid=868522072.1689584317&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.212.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams15s21-in-f130.1e100.net
Software
cafe /
Resource Hash
00bfd3137d2072d85b3a5ab1d9933273a09dd4a0aecd6a3e26e5d524e22d128d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1742
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~o...
13115870.fls.doubleclick.net/ Frame D533
Redirect Chain
  • https://13115870.fls.doubleclick.net/activityi;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2...
  • https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;ua...
547 B
356 B
Document
General
Full URL
https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-13115870
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s51-in-f6.1e100.net
Software
cafe /
Resource Hash
5ba7cabc016f8cf4a7bdcf49242a8717422360ed3d617a2f1e3bc838220e7c80
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
333
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 17 Jul 2023 08:58:38 GMT
expires
Mon, 17 Jul 2023 08:58:38 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 17 Jul 2023 08:58:38 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect/?pid=432890&conversionId=2402852&fmt=gif
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fpid%3D432890%26conversionId%3D2402852%26fmt%3Dgif%26liSync%3Dtrue
  • https://px.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true
  • https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true&e_ipv6=AQIhiPbjsd1gSQAAAYljErfHEdSc06WsrH5fLzDTyRew7E19YcSdQAu6MTqbzwvgIx2F7vI
43 B
248 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true&e_ipv6=AQIhiPbjsd1gSQAAAYljErfHEdSc06WsrH5fLzDTyRew7E19YcSdQAu6MTqbzwvgIx2F7vI
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
content-encoding
gzip
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 6C66BBA28A614145B1E4CB5FD55CD58F Ref B: FRAEDGE1211 Ref C: 2023-07-17T08:58:38Z
linkedin-action
1
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
content-type
image/gif
x-li-proto
http/2
content-length
65
x-li-uuid
AAYAqwEgzz3W+j0jFX3tmw==

Redirect headers

date
Mon, 17 Jul 2023 08:58:38 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 4C864C65D0854A0081A232C9EC855398 Ref B: DUS30EDGE0408 Ref C: 2023-07-17T08:58:38Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?pid=432890&conversionId=2402852&fmt=gif&liSync=true&e_ipv6=AQIhiPbjsd1gSQAAAYljErfHEdSc06WsrH5fLzDTyRew7E19YcSdQAu6MTqbzwvgIx2F7vI
x-li-proto
http/2
content-length
0
x-li-uuid
AAYAqwEdx0EyBQSNqGv2Cg==
0
bat.bing.com/action/
0
123 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=c990eb30-a20b-4439-b543-13ddaddc57ff&sid=1e4b0790248011eea272918820725325&vid=1e4b1830248011eea31e37a45fb105e1&vids=0&msclkid=N&el=Submit%20lead%20form&gc=USD&tpp=1&ea=resource_lead&en=Y&p=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&sw=1600&sh=1200&sc=24&evt=custom&rn=430158
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Mon, 17 Jul 2023 08:58:37 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: EF891E09BFFD499986B0F69D999BD366 Ref B: FRA31EDGE0813 Ref C: 2023-07-17T08:58:38Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/10940107324/
42 B
109 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/10940107324/?random=1689584317910&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3756142634&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/10940107324/
42 B
109 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/10940107324/?random=1689584317910&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3756142634&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/462891735/
42 B
109 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/462891735/?random=1689584317923&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1478144800&rmt_tld=0&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/462891735/
42 B
109 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/462891735/?random=1689584317923&cv=11&fst=1689580800000&bg=ffffff&guid=ON&async=1&gtm=45be37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1478144800&rmt_tld=1&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
108 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-38175129-1&cid=1752860504.1689584318&jid=748311134&_u=aADAAEAAQAAAACAAI~&z=536639843
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
108 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-38175129-1&cid=1752860504.1689584318&jid=748311134&_u=aADAAEAAQAAAACAAI~&z=536639843
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
analytics.twitter.com/i/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=twtr
  • https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_oKPCsn2LHW5LpETEy
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_oKPCsn2LHW5LpETEy
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
104.244.42.131 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-response-time
181
date
Mon, 17 Jul 2023 08:58:37 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
50316486d6864045
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
3a38e1d44de71c46ad1aff4ee55828b930c8956535899782847d39e6062e8d90
content-length
43

Redirect headers

Location
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_oKPCsn2LHW5LpETEy
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=yah
  • https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_oKPCsn2LHW5LpETEy&_origin=1
0
126 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_oKPCsn2LHW5LpETEy&_origin=1
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-71-149-231.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.10.64 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.64
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Location
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_oKPCsn2LHW5LpETEy&_origin=1
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=opx
  • https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_oKPCsn2LHW5LpETEy
43 B
274 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_oKPCsn2LHW5LpETEy
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_oKPCsn2LHW5LpETEy
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=rbcn
  • https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_oKPCsn2LHW5LpETEy
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_oKPCsn2LHW5LpETEy
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
f5982f4f9cc79eb2b489dda8b92e3144
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

Location
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_oKPCsn2LHW5LpETEy
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
cb
pixel-geo.prfct.co/
Redirect Chain
  • https://pixel-geo.prfct.co/cs/?partnerId=goo
  • https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfb0tQQ3NuMkxIVzVMcEVURXk
  • https://pixel-geo.prfct.co/cb?partnerId=goo
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Server
52.209.55.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-55-66.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://pixel-geo.prfct.co/cb?partnerId=goo
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
240
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
pixel-geo.prfct.co/seg/
43 B
365 B
Image
General
Full URL
https://pixel-geo.prfct.co/seg/?add=4530935&source=js_tag&a_id=56252
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.209.55.66 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-55-66.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

P3P
CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Length
43
Content-Type
image/gif
bounce
secure.adnxs.com/
Redirect Chain
  • https://secure.adnxs.com/seg?t=2&add=4530935
  • https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
43 B
842 B
Image
General
Full URL
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Server
185.89.210.90 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
an-x-request-uuid
2bb02e8a-61d7-4cbc-bdc7-ca8e74a3446f
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
80.255.7.105; 80.255.7.105; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
43
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
an-x-request-uuid
b4aa3a7f-e242-4947-854b-8aa3d825f082
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
x-proxy-origin
80.255.7.105; 80.255.7.105; 941.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
OneSignalSDKStyles.css
onesignal.com/sdks/
82 KB
9 KB
Stylesheet
General
Full URL
https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151603
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
via
1.1 google
content-encoding
br
cf-cache-status
HIT
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains
age
549
etag
W/"4e9aaefffd5f8ae7dc83361aa2294190"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=2592000
cf-ray
7e8148c499142c47-FRA
access-control-allow-headers
OneSignal-Subscription-Id
alt-svc
h3=":443"; ma=86400
expires
Wed, 16 Aug 2023 08:58:38 GMT
details
epsilon.6sense.com/v3/company/
726 B
577 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.73.167.36 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-73-167-36.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
b1c67ef1f94af13cc299f9143d69a95eb253555b0888fb6e08599b295de59847

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
Authorization
Token 8ba4c5a3fa178cfadac2b61291295db2874be830
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
content-length
388
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.73.167.36 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-73-167-36.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.sentinelone.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.sentinelone.com
access-control-max-age
1800
date
Mon, 17 Jul 2023 08:58:38 GMT
server
nginx
ga.js
ga.clearbit.com/v1/
4 KB
1 KB
Script
General
Full URL
https://ga.clearbit.com/v1/ga.js?authorization=pk_ed7b4bbadb390cf24ef37a1223019246
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-127-196-46.eu-central-1.compute.amazonaws.com
Software
envoy /
Resource Hash
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-envoy-response-flags
-
server
envoy
x-api-version
2018-03-28
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
x-account-id
330680ff-f4de-4d19-81d4-375af65453c9
icon
onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/
268 B
805 B
Fetch
General
Full URL
https://onesignal.com/api/v1/apps/acaf2329-c613-4dbe-a651-1ed5a45c3762/icon
Requested by
Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151603
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1deada449ce1e720c36f2d1e638c588de0f889e078c3361eed0fdb67d1b08b50
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
via
1.1 google
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
content-encoding
br
x-permitted-cross-domain-policies
none
strict-transport-security
max-age=15552000; includeSubDomains
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
x-request-id
58066a19-d3ea-4f1e-9c28-6fcd0cbf6678
x-runtime
0.013490
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"1deada449ce1e720c36f2d1e638c588d"
x-download-options
noopen
x-frame-options
SAMEORIGIN
vary
Accept, Origin, Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=0, private, must-revalidate
cf-ray
7e8148c53e699231-FRA
access-control-allow-headers
SDK-Version
dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=*;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentine...
adservice.google.com/ddm/fls/z/ Frame D533
42 B
108 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=*;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F
Requested by
Host: 13115870.fls.doubleclick.net
URL: https://13115870.fls.doubleclick.net/activityi;dc_pre=CPuN5IiwlYADFRjHsgodvAMDPA;src=13115870;type=pagev0;cat=reque0;ord=%5BSessionID%5D;auiddc=868522072.1689584317;gtm=45fe37c0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://13115870.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=ipv6&q=%7B%22address%22%3A%222a01%3A4a0%3A1338%3A92%3A%3A5%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.google.de/pagead/1p-conversion/970186784/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.s...
  • https://www.google.com/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs...
  • https://www.google.de/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%...
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&auid=868522072.1689584317&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE0zVHBRWVFoTGJIM00tRGo5R3ZBUklsQUNVemhIZ0FjaEc5eVJSX0xYUWdBQzlPbVdGRzJvTFZJZ2UySlI2R2ZodmU5MW5RMFEaV0NoQUk4TTNUcFFZUXdfdkZ1dEMtamY4aUVpMEEwV2c5VkpSR09vRDdic1FLN1dHSkJzVGhsRnJ4aFVUcHBIZmFkcnB5dHA3QXpocnVlNGxJUmw0VC1wMCITCJ6P6oiwlYADFceQ_QcdEA8Cbg&is_vtc=1&ocp_id=vgK1ZJ64C8eh9u8PkJ6I8AY&cid=CAQSKQBpAlJWDimpuIlu47Hhrp1-9Hl-YP0c7IAChobSyJsfedesqeWP8hbR&eitems=ChEI8M3TpQYQ97iVwPi3pcbhARIdAKMROOBg3sLALsu0VoTOje97eLS2-sL7aoLf9zY&random=3166919005&ipr=y
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Server
2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 17 Jul 2023 08:58:38 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.de/pagead/1p-conversion/970186784/?random=686617797&cv=11&fst=1689584318038&bg=ffffff&guid=ON&async=1&gtm=45He37c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&label=P7U6CJqLydsBEKDAz84D&hn=www.googleadservices.com&frm=0&tiba=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&value=0&auid=868522072.1689584317&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek5DaEVJOE0zVHBRWVFoTGJIM00tRGo5R3ZBUklsQUNVemhIZ0FjaEc5eVJSX0xYUWdBQzlPbVdGRzJvTFZJZ2UySlI2R2ZodmU5MW5RMFEaV0NoQUk4TTNUcFFZUXdfdkZ1dEMtamY4aUVpMEEwV2c5VkpSR09vRDdic1FLN1dHSkJzVGhsRnJ4aFVUcHBIZmFkcnB5dHA3QXpocnVlNGxJUmw0VC1wMCITCJ6P6oiwlYADFceQ_QcdEA8Cbg&is_vtc=1&ocp_id=vgK1ZJ64C8eh9u8PkJ6I8AY&cid=CAQSKQBpAlJWDimpuIlu47Hhrp1-9Hl-YP0c7IAChobSyJsfedesqeWP8hbR&eitems=ChEI8M3TpQYQ97iVwPi3pcbhARIdAKMROOBg3sLALsu0VoTOje97eLS2-sL7aoLf9zY&random=3166919005&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
v2YIX3gQ6moCsoRYtalA_apple-touch-icon.png
img.onesignal.com/permanent/00b53cc8-e3cf-4d2d-bbf3-1986e3d59095/
2 KB
2 KB
Image
General
Full URL
https://img.onesignal.com/permanent/00b53cc8-e3cf-4d2d-bbf3-1986e3d59095/v2YIX3gQ6moCsoRYtalA_apple-touch-icon.png
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:d73b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a643e2fcf834dce892b4f2844cab6db03148dea4523223816742f43077e4572d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-goog-encryption-kms-key-name
projects/core-infra-onesignal/locations/europe-west4/keyRings/keyring-kms-onesignal/cryptoKeys/img-persistence-bucket-onesignal/cryptoKeyVersions/1
date
Mon, 17 Jul 2023 08:58:38 GMT
strict-transport-security
max-age=15552000; includeSubDomains
cf-cache-status
HIT
age
958
cf-polished
origSize=4820, status=vary_header_present
x-guploader-uploadid
ADPycdtlsI78d_FfzwfedrBRw_7LNQDExEHGF8hF7rZ1_1V75F4Jx2GPjgpeCBuun8KcwtkYRURh-e4ocOiiV5EmlFY8FQ
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=86400
content-length
1830
pragma
no-cache
cf-bgj
imgq:85,h2pri
last-modified
Mon, 22 May 2023 20:49:17 GMT
server
cloudflare
etag
"-CLTLg7zmif8CEAE="
vary
Origin, Accept-Encoding
x-goog-generation
1684788557702580
content-type
image/png
x-goog-hash
crc32c=menOhw==, md5=+95Zp3W01opqou09atAbPQ==
cache-control
public, max-age=2678400
x-goog-stored-content-length
4820
accept-ranges
bytes
cf-ray
7e8148c5efde194b-FRA
expires
Thu, 17 Aug 2023 08:58:38 GMT
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=*&eid=51&u=AgAAAAAAAAAAACA&h=Ag&z=0
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:38 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A39%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A38%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:39 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=173164196&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&ul=en-us&de=UTF-8&dt=Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aDDAAEADQAAAACAAI~&jid=&gjid=&cid=1752860504.1689584318&tid=UA-38175129-1&_gid=188145197.1689584318&gtm=45He37c0n71KGGXSJ&cd1=&cd2=&cd3=&cd4=Germany&cd5=&z=756264125
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 16 Jul 2023 12:50:29 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
72490
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
async-api.30bd804e-1.236.0.min.js
js-agent.newrelic.com/
3 KB
2 KB
Script
General
Full URL
https://js-agent.newrelic.com/async-api.30bd804e-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fa44ba5620fc182eb36d66b9dea560edeb23af9c3104647e39e2a4d3fabcf8cd
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
366JrVMQzTPfkja9KvKWB.1FAlNj2g2u
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:39 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEGF3EKJ20GJ2M0B
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
1418
x-amz-id-2
7Bnp/acDFEVPOk4KkO8G7KCaEAPmVl9BEz+T2W3GECp7L6ot5oleCbOlovAlxmFTFBTt4vF0h30=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.968649,VS0,VE0
etag
"ce1527db8799a0ba1913b5c7b7f666aa"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1546
860.03a8b7a5-1.236.0.min.js
js-agent.newrelic.com/
14 KB
5 KB
Script
General
Full URL
https://js-agent.newrelic.com/860.03a8b7a5-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
38068c6216d8cd0ebd227e767dea7b85b17c68ee40a2b32c20cb879ea225d274
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
iJSI6dlO2Ys6eX3e0ReqL6kXFai6YRCl
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:39 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEG37M53ZHPNPYPQ
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5273
x-amz-id-2
gv55Gg66aMmrHkB8Fge6lNpTz6cyGgp4g3hGLfVUoXX8Ywtm0u+nP7Cq83BuwsuHuDSgB7+4MC4=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.969665,VS0,VE0
etag
"5c2d33afe15ef1ea0f7dfd3d77677165"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3165
session-manager.2a64278a-1.236.0.min.js
js-agent.newrelic.com/
1 KB
1 KB
Script
General
Full URL
https://js-agent.newrelic.com/session-manager.2a64278a-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
ur1tw3MWf2WErGuFKp0fYWjcNIfD4uOb
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:39 GMT
strict-transport-security
max-age=300
x-amz-request-id
F0T0KRXCF42HDR2X
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
677
x-amz-id-2
chmyyZ+gRR6zkYZ+3vMJ32qO1vXfDlOxAuZMMzIY+AS2GnAwDXG8hGK8xI4QRjD1cmRKC3VRKOI=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.968599,VS0,VE0
etag
"a097cb2068fb2d63e521cacf139c921d"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
1633
up
insight.adsrvr.org/track/ Frame A60B
0
182 B
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=vfu9xa7&ref=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&upid=jskiafk&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a12b7a488abeaa9e4.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.sentinelone.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Mon, 17 Jul 2023 08:58:40 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
lazy-feature-loader.2f55ce66-1.236.0.min.js
js-agent.newrelic.com/
1 KB
883 B
Script
General
Full URL
https://js-agent.newrelic.com/lazy-feature-loader.2f55ce66-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d9bafbaa07911d0596a806a1177da26c107f735052d28603bc5eb8fa0dc63b55
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
SNNZ70_ndPBZM4f5drSRay_oJEEp97f5
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:40 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEGDKDYAMFQT6R5V
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
435
x-amz-id-2
xrQ60wqPVy7njbGQJaMAoxW1ZbXN7jToII+PgtVwmYfznO3vHvTB0zXoVanUjEaGc5Y6C1AIk5c=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.021810,VS0,VE0
etag
"e43b565f398109176254b8a9394de5ba"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3129
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A39%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:40 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
148.1a20d5fe-1.236.0.min.js
js-agent.newrelic.com/
8 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/148.1a20d5fe-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e89824dcd4a1d958c6972134bfc50e0c8e4a76d6b47569d14fd7cba455c1f7f
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
ScUpW5z6XcbV4AsRwaGpjCwUtY9KtEdV
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:40 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEGCSGC0W9EB60VT
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
3249
x-amz-id-2
RnX/69X59j0YEmOJZIej61dk2R6E0i47JxJl2JtlBTegNG/hLBJslK0O+SoecA24IzWGVFxnPg0=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.067204,VS0,VE0
etag
"bed1f74897d091a7dfc2b06e8a1e29a3"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
325
page_view_event-aggregate.06482edd-1.236.0.min.js
js-agent.newrelic.com/
11 KB
4 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_event-aggregate.06482edd-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f1249e3503b8a12598e09882e9ded38155ac212298143dec459ce6820c6d3f37
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
olBWVnN3KrZD.7AbCiVQ_LmF1ZBKIJEh
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:40 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEG0G20JAAY1G1GR
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
4102
x-amz-id-2
ZmI1+PZGzHgg/9HTiUZurwSqPtQNpHBccTB2Chdf6IKRzVHz3wtddTZoDy1FX7PpqNnW+ncvqWc=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.067544,VS0,VE0
etag
"553d27144d4f9fbe7e31b802107a2071"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3108
page_view_timing-aggregate.bd6de33a-1.236.0.min.js
js-agent.newrelic.com/
15 KB
6 KB
Script
General
Full URL
https://js-agent.newrelic.com/page_view_timing-aggregate.bd6de33a-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6dc5a41a72f6c1b4148d0629284183a4db42a28fef188ff4d55d5872d0ea3561
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
9W2va1QLSUaCTJ3OoHH2ZOYSIAKsuvOr
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:40 GMT
strict-transport-security
max-age=300
x-amz-request-id
QEG9E846R1QCFG8V
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
5367
x-amz-id-2
VXMN1ilK2pe4fta289xr7NSuAjTDPPdDBLrxuZ6WNJ2P9qLnLApxA5pESOv4R5er+ii418WL2hI=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.067762,VS0,VE0
etag
"01e96e9ff5c360298d13581ad38e60a8"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
3124
metrics-aggregate.3dc53903-1.236.0.min.js
js-agent.newrelic.com/
8 KB
3 KB
Script
General
Full URL
https://js-agent.newrelic.com/metrics-aggregate.3dc53903-1.236.0.min.js
Requested by
Host: www.sentinelone.com
URL: https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
11b4a5f186edf838f6e951559bef8aa85c686a83e0a226c5a82622da95e54307
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-amz-version-id
Z8jxLQfOXuFmYqpMJ60TDp7HscNrmk8O
content-encoding
gzip
via
1.1 varnish
date
Mon, 17 Jul 2023 08:58:40 GMT
strict-transport-security
max-age=300
x-amz-request-id
T9WATCNZXDW4W0PE
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
2880
x-amz-id-2
JlOL3h6YW9l3T5Wv3UIKced+6cWRgJjfCT3Vya4XA1nU1Xlf0KKGjRI7kguETxTd+dI2djlaEAs=
x-served-by
cache-fra-eddf8230084-FRA
last-modified
Tue, 27 Jun 2023 17:17:41 GMT
server
AmazonS3
x-timer
S1689584320.067907,VS0,VE0
etag
"a912f1cb80b2d3cf15f10d9d022b6188"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
8893
NRJS-7f7a0b93139dcf56f90
bam.nr-data.net/1/
40 B
409 B
XHR
General
Full URL
https://bam.nr-data.net/1/NRJS-7f7a0b93139dcf56f90?a=773889139&v=1.236.0&to=ZlwDMkMCWxJQUkdYXF8WIAVFCloPHkJaX1RdXA%3D%3D&rst=3949&ck=0&s=cc25cbeb7e6bf6c0&ref=https://www.sentinelone.com/labs/cloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp/&ap=610&be=184&fe=3527&dc=1006&at=ShsARAsYSBw%3D&perf=%7B%22timing%22:%7B%22of%22:1689584316149,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:9,%22c%22:9,%22s%22:48,%22ce%22:93,%22rq%22:93,%22rp%22:184,%22rpe%22:225,%22di%22:1188,%22ds%22:1188,%22de%22:1190,%22dc%22:3707,%22l%22:3708,%22le%22:3712%7D,%22navigation%22:%7B%7D%7D&fp=876&fcp=964
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d

Request headers

Referer
https://www.sentinelone.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
content-type
text/plain

Response headers

date
Mon, 17 Jul 2023 08:58:40 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.sentinelone.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
Content-Length
40
x-served-by
cache-fra-eddf8230134-FRA
test
cdn.abrankings.com/
2 B
425 B
XHR
General
Full URL
https://cdn.abrankings.com/test?url=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&abr_id=1280
Requested by
Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26db:cc00:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-my-header
my-header-content
date
Mon, 17 Jul 2023 08:58:23 GMT
content-encoding
gzip
via
1.1 bc8243121fd94c5b2714caac07caccde.cloudfront.net (CloudFront)
server
nginx/1.20.1
x-amz-cf-pop
MUC50-P3
age
17
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
application/json
access-control-allow-origin
*
x-cache
Hit from cloudfront
cache-control
max-age=60, public
x-amz-cf-id
WhuLStBfoQHHvyFG0_HF_Qq8jvq0JG-s3nYvtQLozeGtXouok_WLEg==
a
www.googletagmanager.com/
0
11 B
Image
General
Full URL
https://www.googletagmanager.com/a?id=AW-10940107324&v=3&t=t&pid=1479342509&cv=2&rv=37c0&tc=10&es=1&e=gtm.load&eid=54&u=AgAAAAAAAAAAACA&h=Ag&z=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:40 GMT
server
Google Tag Manager
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A40%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:41 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
483 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:42 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=null&visitor=4982e0e0-da4e-4a03-8d3b-f0ac18f99328&session=42cb9090-c12e-4124-851e-d9e950383e63&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2017%20Jul%202023%2008%3A58%3A42%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%225010%22%7D&isIframe=false&m=%7B%22description%22%3A%22Cloud%20credentials%20stealing%20campaign%20expands%20to%20target%20Azure%20and%20Google%20Cloud%20via%20unpatched%20web%20app%20vulnerabilities.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cloudy%20With%20a%20Chance%20of%20Credentials%20%7C%20AWS-Targeting%20Cred%20Stealer%20Expands%20to%20Azure%2C%20GCP%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&pageViewId=fbba2ea7-ab93-448c-887c-51c95b464265
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-101-111-170.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.sentinelone.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Mon, 17 Jul 2023 08:58:43 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f02dad-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

188 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 boolean| credentialless object| onbeforetoggle object| onscrollend object| NREUM object| webpackChunkNRBA object| newrelic object| NRBA object| OneTrustStub function| OptanonWrapper object| google_tag_manager object| google_tag_data object| dataLayer object| google_optimize object| analytics string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| $ function| jQuery object| MktoForms2 function| FontFaceOnload function| Swiper function| Collage object| FaqSearcher function| HeadingSizer object| HomeScrolling function| LogoCrossfader object| MarketoWrap object| ScrolledSections function| TestimonialCarousel function| VideoCarousel function| VideoTabs function| VimeoPlaylist function| documentInitOneSignal function| OneSignal function| gtag object| regexThatChecksForEmail function| calibermindCaptureSubmit function| calibermindAddFormListener function| ClipboardJS object| lazyLoadInstance function| sidebarSticky function| checkPageScroll object| anchors object| anchor object| swiper undefined| largest object| hljs object| MarkerAnimation function| LazyLoad function| WOW object| AmazonPolly object| AnimatedBox object| Autopop object| Calendar object| GlobalMediaViewer object| Glossary object| Greenhouse object| Highlighter object| ImageModalOpener object| Magnifier object| MultiStepForm object| PathFactoryUtils object| ProgressBar object| ResourceCenter object| TableOfContents object| TechCenter object| Threats object| Tooltip object| UrlShortener object| UtmLinks object| webpackChunk_ion_builder_server object| __SEGMENT_INSPECTOR__ number| r object| Optanon object| OneTrust function| postscribe object| google_tag_manager_external function| addCaptchaScript object| jQuery112408823964543234839 string| GoogleAnalyticsObject function| ga object| GooglebQhCsO function| hj object| _hjSettings function| rdt object| _pa object| freeEditElems number| len undefined| curr string| bfId number| bfSession string| _linkedin_partner_id object| _linkedin_data_partner_ids function| qp function| onYouTubeIframeAPIReady object| gaGlobal number| abr_id function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si object| script string| target object| elem function| twq object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady function| lintrk boolean| _already_called_lintrk number| __oneSignalSdkLoadCount object| _oneSignalInitOptions function| __jp0 object| gaplugins object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels function| facebookEventsHelper function| googleAdsEventsHelper object| _pq function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| qevents object| terminusTracker function| UET function| UET_init function| UET_push object| ueto_5441bea2db object| uetq object| gaData object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ string| abr_url object| abr function| abrankings function| Template7 function| ttd_dom_ready function| TTDUniversalPixelApi object| regeneratorRuntime object| twttr object| MunchkinTracker object| ccConsole boolean| ccinstalled boolean| _storagePopulated boolean| abr_completed string| dateDayShort string| dateDay string| dateDD string| dateMon string| dateMM string| dateMonth string| dateYYYY string| dateYY

49 Cookies

Domain/Path Name / Value
.sentinelone.com/ Name: __cfredirector_sm
Value: DE
.go.sentinelone.com/ Name: __cf_bm
Value: _J_nKjc7YKBFx4haICJDTZaOALoOHpWeHHT9RJBtNlE-1689584316-0-AT3GU/syhKZGIFHBzHOgiHdbfCj2FOdPo0nHLpnjJCGvyOKZgkklYG7o+fMhxfGOeltedoROSHSQpqq1X5xCD7w=
.onesignal.com/ Name: __cf_bm
Value: Yo_nFWxoohrFKVvwn5cvC7GPnSY42lh2BK3AnZKM8Mw-1689584317-0-AcQsJz8kiBSil/bcKO8E7d46/fyAYk05XVBLlfrhzz25Pym1cMsWHQ59Q8SlQVGNUxfLOYh7m2rAJARm/T/jKjY=
.sentinelone.com/ Name: ajs_anonymous_id
Value: dcc9539f-9742-4056-8cd4-55c6f810c3fc
.youtube.com/ Name: YSC
Value: 27liyBnePjg
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: wy_iTR_hBDU
.sentinelone.com/ Name: _gcl_au
Value: 1.1.868522072.1689584317
.sentinelone.com/ Name: _ga_KJPGLC9EVP
Value: GS1.1.1689584317.1.0.1689584317.0.0.0
.sentinelone.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Mon+Jul+17+2023+08%3A58%3A37+GMT%2B0000+(GMT)&version=6.23.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Flabs%2Fcloudy-with-a-chance-of-credentials-aws-targeting-cred-stealer-expands-to-azure-gcp%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.sentinelone.com/ Name: _rdt_uuid
Value: 1689584317705.97a9646b-1a68-4151-8401-fb93b8cfa5c9
go.sentinelone.com/ Name: BIGipServerab14web-nginx-app_https
Value: !NJYpLiK6mL3rwcKkCIQPm+cqSAXSEYXQTwQdYBPisqYcAojifUwug/3siie8C/cNyj+dGj+rbc14JDM=
.sentinelone.com/ Name: bf_lead
Value: 1ulk25s5608o00
.doubleclick.net/ Name: IDE
Value: AHWqTUkBOItOxCMoxinXfWIz0qgGNU4x4Nj8xtxjHtWtZPi6hcfCxUsxpPhMYpveW3E
.sentinelone.com/ Name: _ga
Value: GA1.2.1752860504.1689584318
.sentinelone.com/ Name: _gid
Value: GA1.2.188145197.1689584318
.sentinelone.com/ Name: _gat_UA-38175129-1
Value: 1
.bing.com/ Name: MUID
Value: 2C155B51A1496888255F4800A0E569A4
www.sentinelone.com/ Name: ln_or
Value: eyI0MzI4OTAiOiJkIn0%3D
.linkedin.com/ Name: li_sugr
Value: b38be3f4-f5a4-429e-8932-d3c929fbe349
.linkedin.com/ Name: bcookie
Value: "v=2&bac486b0-1ec1-48ef-8c24-792dedf3580b"
.linkedin.com/ Name: lidc
Value: "b=VGST09:s=V:r=V:a=V:p=V:g=2609:u=1:x=1:i=1689584317:t=1689670717:v=2:sig=AQGnCGvv5lQwMBBZFXSQB8xvD10-pMB_"
.sentinelone.com/ Name: _mkto_trk
Value: id:327-MNM-087&token:_mch-sentinelone.com-1689584317969-12771
.prfct.co/ Name: pa_uid
Value: pa_oKPCsn2LHW5LpETEy
.sentinelone.com/ Name: _hjSessionUser_2714452
Value: eyJpZCI6IjZjNTkzNzZhLTI1NGItNTYwMi1hM2FiLTQ2MWY1MjI5NjhhYiIsImNyZWF0ZWQiOjE2ODk1ODQzMTgwMDUsImV4aXN0aW5nIjpmYWxzZX0=
.sentinelone.com/ Name: _hjFirstSeen
Value: 1
.sentinelone.com/ Name: _hjIncludedInSessionSample_2714452
Value: 1
.sentinelone.com/ Name: _hjSession_2714452
Value: eyJpZCI6IjA5NDNiNjE3LTNlNzMtNDBmYy05NmJjLTgwZjI2ZjBhYmNlZSIsImNyZWF0ZWQiOjE2ODk1ODQzMTgwMTgsImluU2FtcGxlIjp0cnVlfQ==
.sentinelone.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
www.sentinelone.com/ Name: _gd_visitor
Value: 4982e0e0-da4e-4a03-8d3b-f0ac18f99328
www.sentinelone.com/ Name: _gd_session
Value: 42cb9090-c12e-4124-851e-d9e950383e63
.sentinelone.com/ Name: _uetsid
Value: 1e4b0790248011eea272918820725325
.sentinelone.com/ Name: _uetvid
Value: 1e4b1830248011eea31e37a45fb105e1
.linkedin.com/ Name: UserMatchHistory
Value: AQKT43IbSdbILgAAAYljEraqucxKkhHb2gDU8xA01Vuy5Jev2rzjHexvPhguoE-OtLgl4uQqnpHhjQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKY7ZTY3pgX9wAAAYljEraqAAgVRfdmZE0yXDWYJNlab4rwoP2Nl9GGPB5gAfAQVpRy_Ga7kuIkeRC24xfGbw
.prfct.co/ Name: pa_twitter_ts
Value: 1689584318165
.twitter.com/ Name: guest_id_marketing
Value: v1%3A168958431813587440
.twitter.com/ Name: guest_id_ads
Value: v1%3A168958431813587440
.twitter.com/ Name: guest_id
Value: v1%3A168958431813587440
.prfct.co/ Name: pa_yahoo_ts
Value: 1689584318220
.6sc.co/ Name: 6suuid
Value: aad0170202380200be02b5640a010000e3fa2100
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODk1ODQzMTg7MjswMjH1AIW3M433Bb+CKptkKCiKhwvXO4jmc5sj2vmRNqYpSA==
.prfct.co/ Name: pa_rubicon_ts
Value: 1689584318277
.prfct.co/ Name: pa_openx_ts
Value: 1689584318275
.prfct.co/ Name: pa_google_ts
Value: 1689584318276
.t.co/ Name: muc_ads
Value: 5f394fc5-4230-49de-8816-18558b22959f
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230717085838d5229b16-8e59-4b19-85c8-5ca5ff497309AQHscG_7cVVWdPwLqQxddJcgc80vqx4E"
.twitter.com/ Name: personalization_id
Value: "v1_7nFZ5bVnxTtdGm55zegaEg=="
.adnxs.com/ Name: uuid2
Value: 6627859907632189718
.adnxs.com/ Name: anj
Value: dTM7k!M4/8CxrEQF']wIg2ImNG[4!2!@wnf-Te9(>wL5L!!'UJ$jG!=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'unsafe-eval' https://snap.licdn.com/ https://cdn.calibermind.com/ https://a.quora.com/ https://app.cdn.lookbookhq.com/ https://connect.facebook.net/ https://ct.capterra.com/ https://ga.clearbit.com/ https://js.adsrvr.org/ https://munchkin.brightfunnel.com/ https://munchkin.marketo.net/ https://static.ads-twitter.com/ 'unsafe-inline' http://schema.org https://*.cloudfront.net/ https://*.googletagmanager.com https://a.omappapi.com/ https://analytics.twitter.com/ https://bat.bing.com/ https://cdn.abrankings.com https://cdn.abrankings.com/ https://cdn.cookielaw.org/ https://cdn.datatables.net/ https://cdn.jsdelivr.net/ https://cdn.onesignal.com/ https://cdnjs.cloudflare.com/ https://cloud.typography.com/ https://code.jquery.com/ https://collector-5527.tvsquared.com/ https://fonts.googleapis.com/ https://go.sentinelone.com/ https://googleads.g.doubleclick.net/ https://j.6sc.co/ https://js.maxmind.com/ https://js.qualified.com/ https://onesignal.com/ https://pixel-geo.prfct.co/ https://platform-api.sharethis.com/ https://platform.twitter.com/ https://pt.ispot.tv/ https://pubads.g.doubleclick.net/ https://px.spiceworks.com/ https://script.hotjar.com/ https://scripts.demandbase.com/ https://sentinelone.com https://ssl.google-analytics.com https://staging.s1preview.com/ https://static.hotjar.com/ https://tag.marinsm.com/ https://ws.qualified.com/ https://www.clickcease.com/ https://www.google-analytics.com https://www.google-analytics.com/ https://www.google.com/* https://www.googleoptimize.com/ https://www.googletagmanager.com/ https://www.googletagmanager.com/* https://www.redditstatic.com/ https://www.vantajs.com/ https://www.youtube.com/ https://yoast.com/ https://www.google.com/ https://qualified.com/ https://www.vantajs.com/ https://js.maxmind.com/ https://cdn.onesignal.com/ https://cdn.datatables.net/ https://platform-api.sharethis.com/ https://yoast.com/ https://fonts.googleapis.com/ https://cdn.datatables.net/ https://js-agent.newrelic.com/ https://www.sentinelone.com/ https://boards.greenhouse.io/ https://ajax.cloudflare.com/ https://www.googleadservices.com/ https://bam.nr-data.net/ https://cdn.linkedin.oribi.io/ https://fr.sentinelone.com/ https://it.sentinelone.com/ https://jp.sentinelone.com/ https://de.sentinelone.com/ https://it.sentinelone.com/ https://es.sentinelone.com/ https://nl.sentinelone.com/ https://kr.sentinelone.com/ https://www.google.it/ https://www.google.co.jp/ https://www.google.de/ https://ar.sentinelone.com/ https://www.google.es/ https://www.google.fr/ https://www.google.nl/ https://sonix.ai https://bam.nr-data.net/ https://docs.google.com/ https://apis.google.com/js/api.js/ https://accounts.google.com/ https://*.googleapis.com *.google.com https://*.gstatic.com https://sheets.googleapis.com/; frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10466992.fls.doubleclick.net
13115870.fls.doubleclick.net
327-mnm-087.mktoresp.com
a.quora.com
adservice.google.com
alb.reddit.com
analytics.twitter.com
api.brightfunnel.com
b.6sc.co
bam.nr-data.net
bat.bing.com
c.6sc.co
cdn.abrankings.com
cdn.calibermind.com
cdn.cookielaw.org
cdn.linkedin.oribi.io
cdn.onesignal.com
cloud.typography.com
cm.g.doubleclick.net
de.sentinelone.com
e.calibermind.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
ga.clearbit.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
img.onesignal.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.adsrvr.org
munchkin.brightfunnel.com
munchkin.marketo.net
onesignal.com
pixel-geo.prfct.co
pixel.rubiconproject.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
region1.google-analytics.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag.marinsm.com
ups.analytics.yahoo.com
us-u.openx.net
www.clickcease.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.sentinelone.com
www.youtube.com
104.102.38.132
104.17.73.206
104.244.42.131
104.244.42.5
104.26.3.18
104.80.240.192
108.138.40.116
13.107.42.14
13.32.121.45
142.250.185.166
142.250.186.130
146.75.116.157
15.197.193.217
151.101.1.140
151.101.194.137
151.101.64.65
162.159.152.17
162.247.243.29
18.66.192.125
18.66.192.34
185.89.210.90
192.28.144.124
2001:4860:4802:34::36
216.58.212.130
23.185.0.2
2600:9000:20eb:9e00:2:53b2:240:93a1
2600:9000:223e:d600:15:a0d3:77c0:93a1
2600:9000:26db:cc00:11:8a36:7200:93a1
2606:4700:3031::ac43:d595
2606:4700:3037::6815:2d74
2606:4700::6812:1d26
2606:4700::6812:a972
2606:4700::6812:d73b
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:806::200e
2a00:1450:4001:808::200e
2a00:1450:4001:809::200e
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:827::2003
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2004
2a00:1450:4001:82b::2003
2a00:1450:400c:c0c::9a
2a02:26f0:480:23::1726:629c
2a02:26f0:780::210:a423
2a04:4e42:400::396
3.127.196.46
3.71.149.231
3.73.167.36
35.244.159.8
52.209.55.66
52.222.236.74
52.3.54.184
69.173.144.139
95.101.111.170
00bfd3137d2072d85b3a5ab1d9933273a09dd4a0aecd6a3e26e5d524e22d128d
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
0cfc74f37470c666d6ac10d4d7a933b923c13b29879134c0866c7de7dcee0310
0da08befe5a68eec43e1e5598ae8f09c574234a20c164c52c16ed0938712ca5e
11b4a5f186edf838f6e951559bef8aa85c686a83e0a226c5a82622da95e54307
14e22ee71d78a987b58d848362620b45e567735952281ef301e92e9e56b7c3f1
187ace26442461a0e81a59bac6d66b83984d1fe7c5e6bb674a442421699f1f43
1deada449ce1e720c36f2d1e638c588de0f889e078c3361eed0fdb67d1b08b50
1f1b053798feca0d6310c9f463fa883f374d4ad73d5cc54e4d1160762a87ca96
22a799158fe74ae3e802bb4708fa9b5888b3553ca8296ae1f4a23799a006d1ba
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
26f2c0ed462cfc22a4e8ee8b49647b8e17e022a8cddb63d17604d7cb29f0d2d2
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
30ca408ce84116fb6e43580f7e1a6e7dea9b1cd86bbdd50ccd307e1b94b70b0f
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
322215fdcb5e286389111a5bac2077cf8baba59c6b26fc05ff3c0832b339ad4f
38068c6216d8cd0ebd227e767dea7b85b17c68ee40a2b32c20cb879ea225d274
38fb72b9d6d50b1b5ba8f5c222d3c31966b672cd5fd7f3454f881d7020011118
3b3c7778ba4e247b97d37e9559528c0f1524faf72de80d4312a322e5e2420d65
3e89824dcd4a1d958c6972134bfc50e0c8e4a76d6b47569d14fd7cba455c1f7f
43fd687a5599e7289ed7452b0e2b4dd62e8a2b2bc616dc994b598cbbb0642b56
452706c0ab7786a68c8c124f5ecf4652bada979632dc366a5ea54ed620cd967c
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4c939a7c5dd7f97c9b29e9041b1d944c465bd990b5294c4d3761217c69a7cc41
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f9687af855e3702920c9feedcf07596807bf43bcd8de0b543ffee66f98e1a22
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
5ba7cabc016f8cf4a7bdcf49242a8717422360ed3d617a2f1e3bc838220e7c80
5de4b128a933b726d8b2987bb31607134c187abf301c5e288f6e232de26fe925
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
6782c26e66d8abbe5816cd0222f41c431399582ce9b59805bffda7572e7ba288
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6bc7e5dfe9784d1c955897354de762f1cc8e8d5b65bd40e1320855e8f698ff0b
6cc7aa1d0e20765408f1a5f78d55f9f366eb1f910fe4da807ccb1cd5ab66c8f9
6dc5a41a72f6c1b4148d0629284183a4db42a28fef188ff4d55d5872d0ea3561
700c8bd73d93522ca53cdc35e2a71e96caf7c344bc7a8391f3af90c10b917033
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
792074561f2d94442c8648916f41fc6016817b61d554daa9c67301aeecca14bb
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8ae35f96358f1b70d18cf16c45761c444ba700312c70bcbdb6c07327842f7679
91ca6512df8dbf62bfa5c05723905b52d5c39a12f254c731d066c3aabfd5327f
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
972ef704c969142982239fb4c433ca38a069701e60d1443d7b6bad1d82378e6d
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a083171a710f259df776baf46a4822350eea47635a1bf05a8931bf6609d12848
a15bef5551f730c8269a1cba57c370099d559defd996193c80a477c411081ca2
a6260b7c10e561ba217fb95a89cf0f829e7c566d038bab15fdcb7a1a67d6ebaa
a643e2fcf834dce892b4f2844cab6db03148dea4523223816742f43077e4572d
a65b319d23a224339d6bb2d40f4fb6f43d9cdcdb41bdda00869cd9a88477a171
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
adc0e2dacc10d6d2acec5ffc5b5346f30a3424ea0bfccff7b902b6a594878a18
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af7942c0849d53ac33209a400329eab0816c7dc133d085537b5b4eb167d6ff0d
b1c67ef1f94af13cc299f9143d69a95eb253555b0888fb6e08599b295de59847
b22694fa42d11b3f176084eeeedfd9331f7b5e56ec0cf2be2828301e74f4b24b
b3835be0df2f7515cdd23362cfa62c70b247f0cf7b50a8d20daff104d71d2a26
b58f75e6c6145ed7f6e19a4c2f32996ecb830577f1e06ef5f247ff21f998e734
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b906ad2354f2fda9f508a0cd7c7d57ecf61cb7a47974ce212d6588e07c3efa53
b921cf7c75254a91b0094a74466fa6efe7919c919e280ffc31e3c01c72d4561b
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
bd8cf80ac0e7f7fa126a0cbe0f16d568325a156ca744e8f1e6aef14a9f23e2b2
c0a1d3ca28aa25ee5a441e3ac2b2b1396424994f26550a49d36fab35b7050f65
c0eda55ec47640c00aa84096fabdb63c66f5e456f7b141e1ba1d153c2b6ebceb
c1a3d20f10ccb380e3acd058e949abdb32d40455c2e8ccf56f140584cde5c8c9
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
c43e933b9d6cd7f80c7eacd3a7e347199d64c3a9827d982552fd480b72948e78
c4d97de65cd9e6bf5ee2724452b46b314480d7d6649f53ee771df32271422b86
c829514739663b0fbaa1e5b4da63fecddb091258f1f8cb852c5e54e1b3fce9af
c902ff18c7858648be03999d4022c40d66ad694ae218ea4b1558e74703b854a5
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
ca8e60ba9a281ae41f019d64c681ba7b523d7b9c839db4d41eb042dcbaad8b7a
cc079836abe496d8cc3a3e2b5ec355195b2dc1cde665b6d1ea5996e04b930720
cda851ced6071adcde40501c1c09e21fd48be1594567337f82711a6371b9779c
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d0647d8975d5c92ea700e635befca523c5aac18754b8454d954909fe070e68cc
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d67eedcc15f788685857f9d24dbe627698a1e118bfb9903fd244b80a576f301a
d9bafbaa07911d0596a806a1177da26c107f735052d28603bc5eb8fa0dc63b55
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
db71f8a28ad8501544fb4e7668e3c6d0b731760b6f20de3525ebaeba597f1922
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
ddb06e7a4aa617032f2bdebe1845d4d69010eaf90b19be754fe8985b594e1c47
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de51ba53b38ba54ff68c8d8446802ae1a917d5c456494d88e3bb9d488dc605b9
e1a95fe6d4be6f16467a0a7a04c51110a66f610b7d59cf9b716fa34f1543c42a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e852245c2645727c8023e6f242a17a9206f53ec0376b54080d121216f77606e2
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef678c966f2d7de1944fbed459455023b93bc657fc82d5a1a7b7a2f2f4bc1183
f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d
f1249e3503b8a12598e09882e9ded38155ac212298143dec459ce6820c6d3f37
f4aa58ca80a157a7094443dc0eb57a6da3b3b639b8b7df19dd18a874d167ba9d
f4e392aa498ce82dc20c138d1d212e496861c34f0b7f04551f212fa04e51486d
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa44ba5620fc182eb36d66b9dea560edeb23af9c3104647e39e2a4d3fabcf8cd
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fe94c281d83caa56e37f5c2d904f813327778a6dcd9857baa3df3058317781a3
ffc79feebdfe105c3de8840c2a5814b3fae59d3529463fdf9329080967ed92ba
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678