www.securonix.com Open in urlscan Pro
2606:4700:3108::ac42:2b19  Public Scan

18 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70

• https://s.adroll.com/j/exp/VJKZ2AZ6BRDQFPNHOW6CAP/index.js HTTP 302
• https://s.adroll.com/j/exp/index.js

Request Chain 71

• https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
• https://s.adroll.com/j/pre/index.js

Request Chain 78

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D61924%26time%3D1695694091839%26url%3Dhttps%253A%252F%252Fwww.securonix.com%252Fblog%252Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-hsSqWqYkVgAAAYrPPnlE_sYbpdOEvo-JQnRkax5PFM_yqsn8sROdHzNlU6sm0ce89gbA

191 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/	162 KB 36 KB	215ms 151ms	Document text/html	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 618f7fefe1e23e98e173011f6a147ada8baa5d90faf5a288452209d7b2755bde Security Headers Name Value Strict-Transport-Security max-age=31622400 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 283 cache-control public, max-age=600 cf-apo-via origin,no-cache cf-cache-status BYPASS cf-edge-cache cache,platform=wordpress cf-ray 80c7f51ff87e453a-TXL content-encoding br content-type text/html; charset=UTF-8 date Tue, 26 Sep 2023 02:08:10 GMT link <https://www.securonix.com/wp-json/>; rel="https://api.w.org/", <https://www.securonix.com/wp-json/wp/v2/blog/22917>; rel="alternate"; type="application/json", <https://www.securonix.com/?p=22917>; rel=shortlink nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f40E3T%2B%2Fh14qwvNcQsl3v8v7ULAuVXD%2B8YWGzGMCdQ9A4inSpeNLZXs42X8mcpSSRsiarM0VNVr%2BuWVlCAJICiiWnqSDivAXZuw2y30PkdoCch1lih3kc9%2BRhcOUT564KXYm0ma4R4eTL9Y4kf5I"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31622400 vary Accept-Encoding, Cookie, Cookie via 1.1 varnish, 1.1 varnish x-cache HIT, MISS x-cache-hits 1, 0 x-content-type-options nosniff x-frame-options SAMEORIGIN x-pantheon-styx-hostname styx-fe2-b-776f48d7fd-6sfq8 x-served-by cache-chi-klot8100134-CHI, cache-cph2320056-CPH x-styx-req-id e12e0eb8-5c10-11ee-9942-eec7e2e8aff2 x-timer S1695694090.262172,VS0,VE98 x-xss-protection 1; mode=block
GET H2	200	pjm0fus.css use.typekit.net/	28 KB 3 KB	102ms 38ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/pjm0fus.css Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 0c8b393617a1f3f9dae0ff4a84fdf2acde49751035c10f44767dcc536b035571 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; content-encoding gzip date Tue, 26 Sep 2023 02:08:10 GMT server nginx vary Accept-Encoding content-type text/css;charset=utf-8 access-control-allow-origin * cache-control private, max-age=600, stale-while-revalidate=604800 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 2381
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	190ms 59ms	Script text/javascript	2a00:1450:4001:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 25 Sep 2023 18:16:08 GMT content-encoding gzip x-content-type-options nosniff age 28322 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 24 Sep 2024 18:16:08 GMT
GET H2	200	styles.css www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/	57 KB 7 KB	35ms 32ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/dist/css/blocks/styles.css?ver=4.6.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d01f57a85c58079c3645a6d9794f82a2d0f7e3edc8a1f84818086e535f3f6d41 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:21 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 cf-polished origSize=58632 content-encoding br x-cache MISS, HIT x-cache-hits 0, 3 x-served-by cache-chi-kigq8000039-CHI, cache-jnb7027-JNB cf-bgj minify last-modified Thu, 21 Sep 2023 23:00:06 GMT server cloudflare x-timer S1695408063.380438,VS0,VE1 etag W/"650ccaf6-e508" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KkUupL3yL4UHroXVYwb3zuhzQ%2FOhxyQG5zAEx03hguRLh%2B4MuvjH%2Bqvwt0H%2FDMxpAvewk%2F8TTOwg1%2FpxGVan1dzpycbnWOZbj6ec%2F%2B207UeOJk0LqUt%2FKukGTPONwlIUp1aDT1bwZxyHZ72CsQXO"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 87c7af9a-5975-11ee-be87-6a1b9eb3a74a cache-control max-age=31622400 cf-ray 80c7f5216959453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-t2gdn
GET H2	200	wpcdt-public.css www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/	680 B 843 B	38ms 35ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/countdown-timer-ultimate/assets/css/wpcdt-public.css?ver=2.4 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 175eab7bef961e3d69c7c97f5371d532f30be4547670ba55578ed1af53d3114d Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 31 Aug 2024 14:31:06 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 cf-polished origSize=822 content-encoding br x-cache HIT, HIT x-cache-hits 1, 3 x-served-by cache-chi-kigq8000092-CHI, cache-jnb7027-JNB cf-bgj minify last-modified Wed, 30 Aug 2023 07:17:56 GMT server cloudflare x-timer S1695408063.391929,VS0,VE0 etag W/"64eeed24-336" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kUeluhZKaZMvrEaZihyWfvPHxFHhh44OUfZQ%2FTzETqE2LTvEkLqlesHu8NWAJVvJCDUtmuE2PZ67nvDeFkgItOMuWVHiCwwIhDuLORHVsJ6rYLT2ad4N4BStLsxl%2BCQ%2BzbuHODPJE09uZvv3tu47"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 05780440-480b-11ee-bb26-16c0f03147c0 cache-control max-age=31622400 cf-ray 80c7f521695a453a-TXL x-pantheon-styx-hostname styx-fe2-b-76757478-bqpkp
GET H2	200	jquery.powertip.min.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	2 KB 889 B	40ms 37ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 18:52:47 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-869d798c96-95zxf x-served-by cache-chi-kigq8000120-CHI, cache-jnb7024-JNB last-modified Tue, 05 Sep 2023 16:02:58 GMT server cloudflare x-timer S1695408063.394327,VS0,VE2 etag W/"64f75132-70d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ug2Nde6YgKHBI9Q6%2By7%2FOwtqSTiuGb3AP9c%2BzTUQz2ACrsFhgo7A2R5kv5PSGc%2Bjj5dze%2BChV2qPfca0DQIJyOLu74CaAoGePypXms9pVD0f90g4B9%2FR5ulO0BC%2FiMLNrILmfdaqa%2BtP0gxOVu4A"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 67c6cee1-4c1d-11ee-aa29-c63595eacccc cache-control max-age=31622400 cf-ray 80c7f521695b453a-TXL x-cache-hits 1, 1
GET H2	200	maps_points.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	5 KB 2 KB	34ms 31ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e2d296664123aed1106464a611ef20234a6eed68d82ed5b1afd66660b185c59 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 07 Sep 2024 07:18:13 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 cf-polished origSize=6896 content-encoding br x-cache HIT, HIT x-cache-hits 1, 1 x-served-by cache-chi-klot8100052-CHI, cache-jnb7027-JNB cf-bgj minify last-modified Tue, 05 Sep 2023 19:58:02 GMT server cloudflare x-timer S1695408063.386780,VS0,VE1 etag W/"64f7884a-1af0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EPfcJptJj5ZANxZCtD56KlEdxvu0gdrMzh3grJMGqMlgBovnFszS8RgT2F6fmJx1ZKGEnWUNpUJFexE%2Bd4qS70d05w8GNy0tze7JqB0Oc5sf8x7JoWCyAzpeIUp390IC7CXMyLTukQV7nnlDvsGk"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id b4f47bbc-4d4e-11ee-84f3-7a0ba50ff911 cache-control max-age=31622400 cf-ray 80c7f521695c453a-TXL x-pantheon-styx-hostname styx-fe2-b-5dc668f645-l6klh
GET H2	200	style.min.css www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/	258 B 633 B	38ms 36ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/menu-item/style.min.css?ver=1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b9257e3e9c959214ddfab833a69a021ae6557403efe76afcbee259621175274 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 23:29:28 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-75f45bdf4d-8fpp2 x-served-by cache-chi-klot8100055-CHI, cache-jnb7022-JNB last-modified Tue, 05 Sep 2023 15:47:47 GMT server cloudflare x-timer S1695408063.403677,VS0,VE1 etag W/"64f74da3-102" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZsYyW5dB%2F7iPZs6ggT9o%2FovleoQ5ZSMmxCJyOwiZJ7RZAEkaeYZVQhILPkOPKJEfbNtYxcbf5K89U35l0SoNCCzFRmTCzF95Ik%2FrqXg%2BDR0WraKTpJCXWdiWCJk3wHwUhmIDePRF3TUmyGGkWwFu"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 0ee2ef35-4c44-11ee-a95f-e2f86a7ba4f0 cache-control max-age=31622400 cf-ray 80c7f521695d453a-TXL x-cache-hits 1, 3
GET H2	200	style.css www.securonix.com/wp-content/themes/securonix/assets/css/	420 KB 68 KB	642ms 640ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3bb30871ea8ec966b055cf1da34cd665d450b7dcd56e50972368e2d645469b3b Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:17 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-polished origSize=434477 x-cache MISS, HIT x-cache-hits 0, 1 x-served-by cache-chi-kigq8000076-CHI, cache-jnb7026-JNB cf-bgj minify last-modified Sun, 24 Sep 2023 09:02:04 GMT server cloudflare x-timer S1695586442.797721,VS0,VE2 etag W/"650ffb0c-6a12d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CvYBwd5HrPMQ9uPVqQwm3mEL0P%2BUb0eFtPExEAj6xw%2BiaRfCc%2Fsrfj41EYXVBTUB9eGUIPtu1pUkTRNbIPFxu1sbn6n%2BBO%2FBM3f6EqQGR6A7QJldjiCz%2FQQ1vurlbhRU6IuENjpUxh89xMXD5v7Z"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 43519f9b-5b15-11ee-99ec-625f0ac20bf0 cache-control max-age=31622400 cf-ray 80c7f521695f453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-x5p8h
GET H2	200	stylesheet.css www.securonix.com/wp-content/themes/securonix/assets/css/fonts/	2 KB 666 B	793ms 791ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/css/fonts/stylesheet.css?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fbb6162a3febf0d96b3372dd4f325d2ecd9b9c4e2c6d23e2c2b4eeeb3d7ccdb0 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:17 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-polished origSize=2058 x-cache MISS, HIT x-cache-hits 0, 1 x-served-by cache-chi-kigq8000178-CHI, cache-jnb7023-JNB cf-bgj minify last-modified Sun, 24 Sep 2023 09:02:04 GMT server cloudflare x-timer S1695586442.802237,VS0,VE2 etag W/"650ffb0c-80a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PCxM1F4vCSi%2FbfjhVS4bzZblXdgJftRYyrEoqf6Hbl4G%2BiLzWm4Ml9lIGIdjHu%2FPbh6SjfD1Ow%2FG4nto9r9puRVQtqBicT8svjx8i6YmoChw3aN2BiXsXzFHG4kG3kONkkUHql5w835mhj%2BUrc2P"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 4373c213-5b15-11ee-b79b-1e8ef206825b cache-control max-age=31622400 cf-ray 80c7f5216960453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-62cmk
GET H2	200	default.css www.securonix.com/wp-content/plugins/tablepress/css/build/	6 KB 3 KB	38ms 36ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.1.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9bc19ce27e7fe54728be0d4489cf683005fd6f522bbf6391a681d7d2d8d3f190 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:22 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 cf-polished origSize=6091 content-encoding br x-cache MISS, HIT x-cache-hits 0, 5 x-served-by cache-chi-klot8100056-CHI, cache-jnb7023-JNB cf-bgj minify last-modified Thu, 21 Sep 2023 01:28:18 GMT server cloudflare x-timer S1695408063.403025,VS0,VE0 etag W/"650b9c32-17cb" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q93SLi0mQ8slWe7V7NuR7uDxKhSEHl7VGI8Yetgq8pgsWTVfaBynv6wMT%2Fcw7QTVMqg8u2ti2U2RNZM10DQv4cKKNyq4x7dk%2FAyWIDL8k4xPrk2SwWUtvjl036VbOUxUzuzC80duqL%2FGINiNSJBC"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 8848899e-5975-11ee-9ac6-a2ae6b8d4424 cache-control max-age=31622400 cf-ray 80c7f5216961453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-6lx95
GET H2	200	tablepress-responsive.min.css www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/	9 KB 2 KB	40ms 38ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Wed, 11 Sep 2024 13:59:42 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-95c68c68d-tfh2b x-served-by cache-chi-klot8100134-CHI, cache-jnb7026-JNB last-modified Sat, 09 Sep 2023 15:43:34 GMT server cloudflare x-timer S1695408063.415949,VS0,VE1 etag W/"64fc92a6-22aa" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wdQiYHQ6wK1a1whIrSuTyntRIr8mhEmBTCDIiS%2BfBfXQe%2B5znO%2FmRfr3I1MjPVIQPffhbPmPnbjVt%2BWucKoSNfJUQ%2BRANlvHyAJ%2FdWh%2BS8l9%2B8q0I7bzcc4bTY8u9pjP2O8DjIRqQucRopxJzKTA"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 74d454fb-50ab-11ee-95dd-cab014e74c89 cache-control max-age=31622400 cf-ray 80c7f5216962453a-TXL x-cache-hits 1, 2
GET H2	200	addtoany.min.css www.securonix.com/wp-content/plugins/add-to-any/	1 KB 948 B	35ms 33ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f93483f0aaf24aea4b5534bb8647d22cd9dfcb4d08d2fd1008787bdfb8a6cc47 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 23:37:39 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-75f45bdf4d-jh6c5 x-served-by cache-chi-klot8100175-CHI, cache-jnb7027-JNB last-modified Tue, 05 Sep 2023 15:47:46 GMT server cloudflare x-timer S1695408063.413778,VS0,VE1 etag W/"64f74da2-5ef" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NcF%2BTwb5k%2Bg1xz6p4tWgC%2Be07BlKwjbgsvXb4xCRytIq06LFftTssQyeL%2Bgv3pBm4AecgaLN6afij8Br2NmvLRY690eqlka%2Fd%2Bei2WkP0S%2FINic%2BswDd0SgAqjOJYhOtkb08Kgcx3IonDmXTqU46"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 33c0ca9a-4c45-11ee-b539-4aacdb6dcda3 cache-control max-age=31622400 cf-ray 80c7f5216963453a-TXL x-cache-hits 1, 5
GET H2	200	ubermenu.min.css www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/	66 KB 10 KB	55ms 54ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/pro/assets/css/ubermenu.min.css?ver=3.7.4 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7ba7e664816f88dde2f3f9b789e427087a5deb8986f708dd02bcfe1c0d8ff55 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 17:24:25 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-m6bvx x-served-by cache-chi-kigq8000138-CHI, cache-jnb7027-JNB last-modified Thu, 21 Sep 2023 03:12:31 GMT server cloudflare x-timer S1695408063.401991,VS0,VE0 etag W/"650bb49f-1062c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k63n%2Bt6hlMFZhpan18PwUZLslw3IBUNEZJ7IxlKR0RRlYm%2BdxgCvGR4JqVpTQD19mWTu0h9dcZrCI2zveBjOy4V1YbyKEzD5kh1mls0e8PU%2Bjc97nkXs%2B1%2FFgcdbk89vhJ4NvzrlbQK9FUiriizo"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id e0821f94-596c-11ee-bd0a-f68c7166e459 cache-control max-age=31622400 cf-ray 80c7f5217987453a-TXL x-cache-hits 1, 3
GET H2	200	all.min.css www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/	57 KB 13 KB	51ms 50ms	Stylesheet text/css	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/assets/fontawesome/css/all.min.css?ver=6.3.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:22 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-65f885485-x5p8h x-served-by cache-chi-klot8100178-CHI, cache-jnb7026-JNB last-modified Thu, 21 Sep 2023 03:12:31 GMT server cloudflare x-timer S1695408063.418267,VS0,VE0 etag W/"650bb49f-e4d2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T65CBTVy3oJdAb%2Fgsnf8ttehE3BaA1KK8G%2F8DMOf1EZ4cAXw%2B%2F7p1ybdn7vI2ZE7E1Arfhq72SEdhW3GomHlpXvb0RpusjRic09lX36nKaYiSsl0qpXIouvPXcA7SMNoNRN7uxYTQf4Yn2t7i0uJ"}],"group":"cf-nel","max_age":604800} content-type text/css x-styx-req-id 8849abff-5975-11ee-86e2-625f0ac20bf0 cache-control max-age=31622400 cf-ray 80c7f5217988453a-TXL x-cache-hits 0, 3
GET H2	200	jquery.min.js Show response www.securonix.com/wp-includes/js/jquery/	85 KB 31 KB	53ms 52ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 17:24:25 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-hgr5n x-served-by cache-chi-kigq8000075-CHI, cache-jnb7026-JNB last-modified Thu, 21 Sep 2023 23:00:08 GMT server cloudflare x-timer S1695408064.386321,VS0,VE1 etag W/"650ccaf8-155ba" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X%2BofEpaV4V0qVeMbe1v2vgzLy1yop%2FvVUxcB6u9lOqYhqJ2LPjxbSVidktlxkc8TS0SrNKgS%2Bh3o4YLav5hb0xk936bjty82pboDJ22WP4NF%2Bm1mlAY1OLwETytHG7zeLwhtOb2H0kQvJDiSORSo"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id e0c29a6a-596c-11ee-be04-82e0673e86e8 cache-control max-age=31622400 cf-ray 80c7f5217989453a-TXL x-cache-hits 1, 3
GET H2	200	jquery-migrate.min.js Show response www.securonix.com/wp-includes/js/jquery/	13 KB 5 KB	47ms 46ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:22 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-hgr5n x-served-by cache-chi-kigq8000086-CHI, cache-jnb7026-JNB last-modified Thu, 21 Sep 2023 23:00:08 GMT server cloudflare x-timer S1695408064.503509,VS0,VE0 etag W/"650ccaf8-3509" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3kNQD2KvompRLMJ9P7mr3ci%2B6AF7WCpHBgee%2BvkSS91lnpvFGzuRlTUpfv2sfFwIsvvCqN3Qwk4RnVVts2e4mcklmQWUUa%2BSVZMhfrYN3gW%2FJLPUkJ9dFhjsemiyH6OpUhaXPi%2FALr9pQhwgwk1e"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 884f0a1c-5975-11ee-be04-82e0673e86e8 cache-control max-age=31622400 cf-ray 80c7f521798a453a-TXL x-cache-hits 0, 3
GET H2	200	language-cookie.js Show response www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/	185 B 628 B	48ms 47ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/sitepress-multilingual-cms/res/js/cookies/language-cookie.js?ver=4.6.3 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e830cef6395dcf3b3640b9b67986a48eb98d994e87405c75a0f1846a2a9ad996 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 31 Aug 2024 14:31:13 GMT date Tue, 26 Sep 2023 02:08:10 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101562 cf-polished origSize=226 content-encoding br x-cache HIT, HIT x-cache-hits 1, 3 x-served-by cache-chi-kigq8000038-CHI, cache-jnb7026-JNB cf-bgj minify last-modified Wed, 30 Aug 2023 07:17:57 GMT server cloudflare x-timer S1695408063.450967,VS0,VE1 etag W/"64eeed25-e2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5MXDRidg2%2FvB4T%2BvBBR7s1IeWbnQmOB4s5jn8CubrmYngHeFizQes6MX5QIhr%2F3m16C4IoUEjd0DKXqyw0Vr9EeuxneFNPeoOB8gQnK2Qvfw%2FwugANGJ6R8EOzjPEEjgXPyd9F0ykW%2FbFqdXH6Qh"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 0943ab02-480b-11ee-bb26-16c0f03147c0 cache-control max-age=31622400 cf-ray 80c7f521798b453a-TXL x-pantheon-styx-hostname styx-fe2-b-76757478-bqpkp
GET H2	200	page.js Show response static.addtoany.com/menu/	3 KB 2 KB	120ms 40ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/page.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51e6d23e4a97f15652c1709f999062fcced9990b5090dde0d22b869247ea0869 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT via e7s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 142689 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Sun, 24 Sep 2023 10:29:33 GMT server cloudflare etag W/"c09-60618514a9dca" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=172800 cf-ray 80c7f526feae047e-FRA
GET H2	200	addtoany.min.js Show response www.securonix.com/wp-content/plugins/add-to-any/	129 B 603 B	46ms 43ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:04 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-65f885485-dpfzx x-served-by cache-chi-klot8100064-CHI, cache-jnb7022-JNB last-modified Fri, 22 Sep 2023 06:49:22 GMT server cloudflare x-timer S1695408064.752286,VS0,VE0 etag W/"650d38f2-81" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B%2F7HDh3C764S9vyHLuavy1EnUvvOAIlvf6XjvtOzL%2BtBTsrckcuvUuSokDX7lRSwTEabx%2B2fZGcJ9Nk9I03K0FM%2FJPgfLSkwnabcRANFBlUk546DmZoOJgpegtmJdxGiZNbogZhaNyj%2Fc2A0EoDr"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 7db08c7c-5975-11ee-84c8-8aaee1c5079e cache-control max-age=31622400 cf-ray 80c7f5268c69453a-TXL x-cache-hits 0, 5
GET H2	200	Drone.png www.securonix.com/wp-content/uploads/2023/09/	578 KB 579 KB	342ms 338ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/Drone.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6667b8a56ce14a4c9ba964a1e8f4df63ba770f76d8965e52f01911c24d4b76e8 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:00:57 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=886514 x-cache MISS, HIT content-disposition inline; filename="Drone.webp" content-length 591708 x-served-by cache-chi-klot8100172-CHI, cache-jnb7026-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:00:52 GMT server cloudflare x-timer S1695646497.631379,VS0,VE4 etag "650dd654-d86f2" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BpCM1WW9AGas7uD28bC8YXSA3my9NCbzCleCxAQGgw3ffqeX3nf%2FwAMsqeNGLCJ3%2F2TmbpXcZHYOdXF7WbdcTaO5MdtrZe1AJvW4V%2FRTJa0HZFkR%2Bwq0u5kIffxiQVVtUlf65ELpfyZp4vYLZxmk"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id faf428d5-5971-11ee-bd0a-f68c7166e459 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c6b453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-m6bvx
GET H2	200	image1-768x449.png www.securonix.com/wp-content/uploads/2023/09/	112 KB 113 KB	344ms 341ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image1-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e535640eb94068c54622143f28fb673a061ccbed20560c5bf1b50d56d697ac1b Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:25 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=162171 x-cache MISS, HIT content-disposition inline; filename="image1-768x449.webp" content-length 114726 x-served-by cache-chi-kigq8000044-CHI, cache-jnb7024-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:04:16 GMT server cloudflare x-timer S1695647247.270312,VS0,VE363 etag "650dd720-2797b" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E0BeTk6bVtlZJyPBw7sHXIMbMb7w4S8tJeTIl2pqsUqgzElY714Ds1iO6vgvv%2BMQmjNhVXnMges45dQftOLvcxkdE8CxqZaTwyqfTJoXA8SNVT05Tr1qea6gjgjwkt5XwBZuPedqyDBNASzubfXP"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id efb41210-5976-11ee-9ac6-a2ae6b8d4424 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c6c453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-6lx95
GET H2	200	image2-768x449.png www.securonix.com/wp-content/uploads/2023/09/	195 KB 196 KB	341ms 337ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image2-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9e2e2ff7e6213c5057c8bc950382dfccfa2045661217963792def14c2bd780e1 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=303647 x-cache MISS, HIT content-disposition inline; filename="image2-768x449.webp" content-length 199652 x-served-by cache-chi-kigq8000046-CHI, cache-jnb7023-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:05:16 GMT server cloudflare x-timer S1695647248.376844,VS0,VE374 etag "650dd75c-4a21f" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rkjZ8gWYKihaVEhUXIWGqlPoGx335zBlgbAP4poi%2BZBFpVYGjsj5mhV0amoORtIxNeALqb8Zo1q3LetN%2BG5BcMbr8LP9X73tF9hwX0VPcIauEyUL55FKBqaGanBlULFJu2j0fCCS5w3tdXE4z%2B21"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f090e071-5976-11ee-9ac6-a2ae6b8d4424 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c6d453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-6lx95
GET H2	200	image3-768x449.png www.securonix.com/wp-content/uploads/2023/09/	245 KB 246 KB	1020ms 1017ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image3-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c6de3b2752f7d26bfcb9dcb647b068db49967ef5e0a170e700f81bbecbb0cdfa Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:12 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 0 cf-polished origFmt=png, origSize=315959 x-cache MISS, HIT content-disposition inline; filename="image3-768x449.webp" content-length 251082 x-served-by cache-chi-klot8100044-CHI, cache-jnb7022-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:06:13 GMT server cloudflare x-timer S1695647249.637730,VS0,VE475 etag "650dd795-4d237" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QBmcA1jWKzvPfVAvcEjvKOjhD6uz5b0C3Va8Sk1hMJmXJbxCwwdWkrPXWqljS7G5caxFmfyz3GHkNFNxcXNjWHWYOlrAnGVBnwQw%2BSMEhFXMxfJc%2B%2Fa%2Fr87KzomqNdzrVpnz3zBVKD94XcAkZz6p"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f094845e-5976-11ee-b79b-1e8ef206825b cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c6e453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-62cmk
GET H2	200	image4-768x449.png www.securonix.com/wp-content/uploads/2023/09/	423 KB 424 KB	341ms 338ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image4-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2a4ea51a61a2ec537b8feb61bb9e6ef90ae9ebcfa189d8c5a2de4e5a181df157 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=540671 x-cache MISS, HIT content-disposition inline; filename="image4-768x449.webp" content-length 432734 x-served-by cache-chi-kigq8000161-CHI, cache-jnb7026-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:07:04 GMT server cloudflare x-timer S1695647250.651325,VS0,VE432 etag "650dd7c8-83fff" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rmlBwFLLP8j30gmJ4nZBLT8DRV983tesfCcfoonnpYywqlfWlYw3OGap9%2Frk7i4BMsRGHiwdtjUP1GP1GlouHPklWzbNqu%2ByV4r7wb7jCUm0mV75xH9GXYhCriuju6cT1T5lL3cLzC5HsP8AV8Ae"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f0967500-5976-11ee-be87-6a1b9eb3a74a cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c6f453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-t2gdn
GET H2	200	image5-768x449.png www.securonix.com/wp-content/uploads/2023/09/	390 KB 391 KB	266ms 263ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image5-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 63f3fa8bd81fdfc8f9811265df1f44f18fa1deb48f8b1947e3006135418fb326 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=499779 x-cache MISS, HIT content-disposition inline; filename="image5-768x449.webp" content-length 399192 x-served-by cache-chi-kigq8000058-CHI, cache-jnb7026-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:10:07 GMT server cloudflare x-timer S1695647251.857914,VS0,VE351 etag "650dd87f-7a043" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OJW9dPhrl5dIo%2F9h77uiqQJQxxAqHfB%2FjxHw%2Bs19AFYss5fVY868%2FrjpOcoaxIeqDSyIy4rT2iPKzoPE519uBcvKqBs1%2F2zGAndfN0VhI%2Fqa4bU1%2B1cNjdyhBHQgA0E5WG2ijiW2P3%2B9b8BYPkVx"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f094aaa3-5976-11ee-be87-6a1b9eb3a74a cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c70453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-t2gdn
GET H2	200	image6-768x449.png www.securonix.com/wp-content/uploads/2023/09/	379 KB 380 KB	280ms 277ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image6-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b9534be02ad2e504d880537a7b0397e5f02d92a7671f85138337b3c4d2b16b3 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=493144 x-cache MISS, HIT content-disposition inline; filename="image6-768x449.webp" content-length 388338 x-served-by cache-chi-klot8100139-CHI, cache-jnb7026-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:10:53 GMT server cloudflare x-timer S1695647250.190470,VS0,VE364 etag "650dd8ad-78658" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2KHbXcwkijYWVZIcRIZhY73XjRFW7or3KBwKcu3DzLn2DvJFPqliZV1qPlQmDtkM%2BkZvjENoEVvj%2FJrtew25IQUFXXet09hkgQqW6GZUQlxhEkc3zNrJop972n%2FmXv5s0IQO0k5D9S4VIZ8P7t6X"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f0959015-5976-11ee-83f2-22f23fbfa393 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c71453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-679hj
GET H2	200	image7-768x449.png www.securonix.com/wp-content/uploads/2023/09/	220 KB 221 KB	265ms 262ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image7-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9b41f2c7fb403b1525f8b46416524239a29aaccd5b86b529272c9797d2ff7fca Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=316774 x-cache MISS, HIT content-disposition inline; filename="image7-768x449.webp" content-length 224966 x-served-by cache-chi-kigq8000036-CHI, cache-jnb7022-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:11:48 GMT server cloudflare x-timer S1695647250.488566,VS0,VE325 etag "650dd8e4-4d566" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4n935ZkPeSv%2BLcai%2BFB5zaP6SqhosjAxi4Vd4hMMw9%2FnVLqlNwFsT0DgEgTB7Z5ef7Y7qQG6CITan6GhIMspy%2Buvi3O%2B5%2B7fRnMd7VRpTi4JZFScJGgmffjCZ5TlzZbaw4gdxjh39Ylc386NxIyh"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f094859f-5976-11ee-b79b-1e8ef206825b cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c72453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-62cmk
GET H2	200	image8-768x449.png www.securonix.com/wp-content/uploads/2023/09/	210 KB 211 KB	344ms 341ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image8-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ae322bdae8a2b8be246c8c183cb2cbc94e039db62fd88dda32307d7e5b644690 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=284183 x-cache MISS, HIT content-disposition inline; filename="image8-768x449.webp" content-length 215524 x-served-by cache-chi-klot8100102-CHI, cache-jnb7022-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:13:18 GMT server cloudflare x-timer S1695647251.993914,VS0,VE441 etag "650dd93e-45617" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HbwIuq5RhL%2FhwEV4NOYno1LDxZXQBktmjNX8nfR1LWxn7Sp9KY8SbzIiotn87SwzuxSkG4w927ApSm%2BgOhV%2B%2B2JTDJpd1OHdZ17vlUJ3zucq9xmI2345eOB%2Fqnt2W6VebTt0fpuZULrBAmR%2Fw7mW"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f095523c-5976-11ee-be04-82e0673e86e8 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c73453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-hgr5n
GET H2	200	image9-768x449.png www.securonix.com/wp-content/uploads/2023/09/	173 KB 174 KB	330ms 328ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image9-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 210d28d941ac7d5ace3a9f6d4ec1cce0a078438cbbfae8530a1be1151871d52a Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=221811 x-cache MISS, HIT content-disposition inline; filename="image9-768x449.webp" content-length 177564 x-served-by cache-chi-kigq8000068-CHI, cache-jnb7026-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:15:47 GMT server cloudflare x-timer S1695647252.792090,VS0,VE433 etag "650dd9d3-36273" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5HwRzF6maxO%2BNNX0NBvrinMgP4FYda4L7Jy5wqlzNVmbdNK9IMQxkjV2Z2RFBVYl%2BVx5L%2F%2FSHtVgLyx6Lj3ReZcf6I4%2BQS%2BBgmA65EOTQHWl96g13ufp%2BnOsmNcgGq81rTLl1Ssc9KLKUp3OpUCm"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f096e2c1-5976-11ee-b79b-1e8ef206825b cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c74453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-62cmk
GET H2	200	image10-768x449.png www.securonix.com/wp-content/uploads/2023/09/	175 KB 175 KB	275ms 273ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/09/image10-768x449.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 97b1a37c7336e6eef67698e9d5c5f3d5c939ef91b1ff58e7a1179236c10710b0 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:36:27 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 0, 1 cf-polished origFmt=png, origSize=254917 x-cache MISS, HIT content-disposition inline; filename="image10-768x449.webp" content-length 178940 x-served-by cache-chi-kigq8000078-CHI, cache-jnb7023-JNB cf-bgj imgq:85,h2pri last-modified Fri, 22 Sep 2023 18:16:39 GMT server cloudflare x-timer S1695647252.825303,VS0,VE442 etag "650dda07-3e3c5" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WctJw214SlGvIx24HenrUw4ApVXGh7CQ0qCF5DYx43FR%2B7YI4p0vkDFum7r1P0RGEbl4%2B9eHdbQf0zGGY3Vvrcyew7Rt6DAVIOPKcnSWWGqtJAtNvwhwyEgReYPY5q3rSy2SWCc%2BPMCH6znffv9X"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f095286d-5976-11ee-be87-6a1b9eb3a74a cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c75453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-t2gdn
GET H2	200	forms2.min.js Show response pages.securonix.com/js/forms2/js/	208 KB 70 KB	318ms 148ms	Script application/x-javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pages.securonix.com/js/forms2/js/forms2.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Thu, 07 Sep 2023 05:56:12 GMT server cloudflare etag "3e26f3-34099-604be84687700" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 80c7f5267a34267d-TXL expires Tue, 26 Sep 2023 06:08:11 GMT
GET H2	200	jquery.powertip.min.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	11 KB 4 KB	28ms 28ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 21 Sep 2024 10:15:28 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-b-65f885485-zlkrm x-served-by cache-chi-klot8100113-CHI, cache-jnb7021-JNB last-modified Wed, 20 Sep 2023 06:29:28 GMT server cloudflare x-timer S1695408063.035228,VS0,VE0 etag W/"650a9148-2ae5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zvrUzDFn6IUhPwlFlJa%2BgriiS8XSQURtHmFf3fVu0hih2MSWOWcuMUTlhQgZCSFqW30E7PSmzRtKgRObW%2FBt5Zf3LwU%2F2SS%2FO8AjAqze%2FJlbdIdDR6kcoJ4UamxA9SIDOFMqgU4LWBGZOxom8xep"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id c9c96b54-5867-11ee-9067-5668abe485bf cache-control max-age=31622400 cf-ray 80c7f5265c41453a-TXL x-cache-hits 1, 3
GET H2	200	maps_points.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	504 B 818 B	32ms 27ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb698b4af30a506bea5e24025b0f742db88461e40a7f9f2f24293ad810bdf842 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:22 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 cf-polished origSize=606 content-encoding br x-cache MISS, HIT x-cache-hits 0, 2 x-served-by cache-chi-klot8100147-CHI, cache-jnb7021-JNB cf-bgj minify last-modified Thu, 21 Sep 2023 03:12:30 GMT server cloudflare x-timer S1695408063.030315,VS0,VE0 etag W/"650bb49e-25e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DJHHDHPp5kHEtbtWBeDeZim4tQM0oXAKLTamknlv2x3MHqxA1cYoAbPYDEKs3GMC1xafDOSYuNlHKAx14%2FkFtKonsOhFL71HY4iNvU8H7NVtY7NXBnmpoP1K5xgjt4riHadIMTT5pIsr2l6WC1nW"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 884f7692-5975-11ee-83f2-22f23fbfa393 cache-control max-age=31622400 cf-ray 80c7f5266c53453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-679hj
GET H2	200	modernizr.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	16 KB 6 KB	241ms 236ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/modernizr.js?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8f060e210fa92b0bce82108a417cbf3f4f0ded2dc69a8b293db44da9f4b24c23 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:18 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-polished origSize=50144 x-cache MISS, HIT x-cache-hits 0, 1 x-served-by cache-chi-klot8100098-CHI, cache-jnb7025-JNB cf-bgj minify last-modified Sun, 24 Sep 2023 09:02:04 GMT server cloudflare x-timer S1695586442.364758,VS0,VE2 etag W/"650ffb0c-c3e0" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sB%2FeXMLeeagpWD6f2vRx8%2BHW3aFuRM0rMa0iR8r67Agx11TrbYGbvJ2lCR3c81BWGAYJtyHeNwGmfHLnaUnB1UL889Ockgh%2F0ktHMFQ5UBKp13XQ9H1yXbFpLchOWXhMaH2m9%2BtGa5iHftc7poAs"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 43aa191a-5b15-11ee-b095-f68c7166e459 cache-control max-age=31622400 cf-ray 80c7f5266c54453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-m6bvx
GET H2	200	wow.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	8 KB 3 KB	816ms 811ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/wow.min.js?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7852a22b72ead62cfc4a1b1ca32874b3e222f232a991a6d1432313572f534135 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:17 GMT date Tue, 26 Sep 2023 02:08:12 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-65f885485-dpfzx x-served-by cache-chi-klot8100140-CHI, cache-jnb7023-JNB last-modified Sun, 24 Sep 2023 19:31:06 GMT server cloudflare x-timer S1695586442.882506,VS0,VE2 etag W/"65108e7a-1fdb" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xKtx9Oz3NMdrBNUbrJxxPUyafPp%2FeoeUx5duFkVUK8cMvehFzWb50pqe1MXr%2ByaECYp4m7D7scpUeON8ID%2F598TLm6XrlBdqLAltU0No%2Fh6SMZ6MN83HpgEEh5H0zADwq4YNXODhPfTw0Rx%2FYRDx"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 4310af68-5b15-11ee-a493-8aaee1c5079e cache-control max-age=31622400 cf-ray 80c7f5266c55453a-TXL x-cache-hits 0, 1
GET H2	200	select2.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	100 KB 24 KB	414ms 410ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/select2.js?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ba711f4ae1f09fd05735a7b8ec5e0d70d271cf09212431fa192deaed9a324360 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:18 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-polished origSize=155132 x-cache MISS, HIT x-cache-hits 0, 1 x-served-by cache-chi-kigq8000045-CHI, cache-jnb7027-JNB cf-bgj minify last-modified Sat, 23 Sep 2023 15:59:35 GMT server cloudflare x-timer S1695586442.876954,VS0,VE2 etag W/"650f0b67-25dfc" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x353UkTkiv6MNMKj2ZdJQae9zV8YOqYzC9sm7VtxqhNpfvv2KsTHDIIuCw1RwtzIQVWVw1oaNDGGOhXJltJMQPqa0xEq3zXD0Tc%2FBGwd0rWexnqZTj9S6RXwTeOGFjMxNA%2FuVccfgg9cU%2BS%2FSbgR"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 43970ec4-5b15-11ee-8aba-be9e2dcae46f cache-control max-age=31622400 cf-ray 80c7f5266c56453a-TXL x-pantheon-styx-hostname styx-fe2-a-8599f9599f-9b52h
GET H2	200	slick.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/vendor/	36 KB 10 KB	247ms 242ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/vendor/slick.min.js?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22529609ad54b33ee1695008d3daa6e35f133849c49ee00d7e9bc02eb0dd9a56 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:18 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-b-65f885485-679hj x-served-by cache-chi-klot8100085-CHI, cache-jnb7025-JNB last-modified Sun, 24 Sep 2023 14:29:21 GMT server cloudflare x-timer S1695586442.877818,VS0,VE2 etag W/"651047c1-9040" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZGeKwL%2FXRfzc9P%2FFkfm1paktA3lC5DWrjPfzLE6f2TIclduebRzCDdpTD09oEa7%2B7n%2Fuoz1hEErjCSbp3TGll4N6kdYXgP2HBpoXZz1SeB%2BEX1e%2BVk9MHU6SdnPKcAS9dDyTl5JXMz%2FZJuUnRNl"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 439b7dad-5b15-11ee-b3cf-22f23fbfa393 cache-control max-age=31622400 cf-ray 80c7f5266c57453a-TXL x-cache-hits 0, 1
GET H2	200	scripts.min.js Show response www.securonix.com/wp-content/themes/securonix/assets/js/	171 KB 45 KB	301ms 296ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/js/scripts.min.js?ver=1695583866 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a5dc25b44f66a4a97302932d4e42507562ecd23f893b1669a791662a8ec00542 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Tue, 24 Sep 2024 20:02:18 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-hgr5n x-served-by cache-chi-kigq8000151-CHI, cache-jnb7026-JNB last-modified Sun, 24 Sep 2023 19:31:06 GMT server cloudflare x-timer S1695586442.876183,VS0,VE6 etag W/"65108e7a-2ace1" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BmIFECIlm516zH8zzMcL%2Br5n0%2B8pD5eZ1cN1et9PCGEJyMKabb0NkbtTwAdX%2BnYoZztCLn9fV549oOEd6q%2Bu6%2Bzr6LQj2HiBLrXlETSZ%2BwYUe0V3FmSEOIUyg76UNmiMalPOZt%2BuTNPXOxwNHo2W"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 43958dbe-5b15-11ee-a3f7-82e0673e86e8 cache-control max-age=31622400 cf-ray 80c7f5266c58453a-TXL x-cache-hits 0, 1
GET H2	200	new-tab.js Show response www.securonix.com/wp-content/plugins/page-links-to/dist/	24 KB 9 KB	265ms 260ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 17:24:29 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br x-cache HIT, HIT x-cache-hits 1, 3 x-served-by cache-chi-kigq8000041-CHI, cache-jnb7027-JNB cf-bgj minify last-modified Fri, 22 Sep 2023 06:49:22 GMT server cloudflare x-timer S1695408063.646813,VS0,VE1 etag W/"650d38f2-609e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1MpDhS%2Fmhbhi4El0TZaneujsfEd6Z6x5kztc4qNKZZ6westTG%2F%2FgDPaAcXpiSjKcm0Sjuhrht%2FeWaAilz4Gzv%2B6aFxIyvpqS%2BnQSPntVOGCpmUTOxyZ%2BQeKaxDKy%2B2c%2Fth4S6LJzO7KJEpP5scIG"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id e328e037-596c-11ee-84c8-8aaee1c5079e cache-control max-age=31622400 cf-ray 80c7f5266c59453a-TXL x-pantheon-styx-hostname styx-fe2-b-65f885485-dpfzx
GET H2	200	ubermenu.min.js Show response www.securonix.com/wp-content/plugins/ubermenu/assets/js/	38 KB 10 KB	33ms 29ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/ubermenu/assets/js/ubermenu.min.js?ver=3.7.4 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 58415d97eb0b5745ccfa6e5e2f996581ec39f6c4af80627d3dd3c06bc5977ca6 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 22 Sep 2024 18:26:21 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache MISS, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-m6bvx x-served-by cache-chi-kigq8000049-CHI, cache-jnb7024-JNB last-modified Thu, 21 Sep 2023 03:12:31 GMT server cloudflare x-timer S1695408064.754770,VS0,VE1 etag W/"650bb49f-9750" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IIIvwKmE4SGEvW%2FjEvi5hyvXJFcTU5BbNM9NAoTSoMef%2FeTmqikcR0whw%2B%2F0EcxBuuNc0qbJqFQnzG0MdeMzCO70sXrO%2FGaT5hXp73tMf4c93%2FXApqSCtxk2VNc5nbynC9dF8acD6fWLx0s09jIe"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 87cd0eba-5975-11ee-bd0a-f68c7166e459 cache-control max-age=31622400 cf-ray 80c7f5266c5a453a-TXL x-cache-hits 0, 4
GET H2	200	smush-lazy-load.min.js Show response www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/	8 KB 4 KB	33ms 29ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.12.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 31 Aug 2024 14:31:06 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-85758c8d7d-n9v8c x-served-by cache-chi-klot8100156-CHI, cache-jnb7026-JNB last-modified Wed, 30 Aug 2023 02:59:36 GMT server cloudflare x-timer S1695408063.811403,VS0,VE1 etag W/"64eeb098-1ef2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDuFd3nZTxl7kFQWK29%2BACQkkg3%2BAsIWPU%2B2U8vaZYG5K%2B3bIAG%2BvvLUutgDuCKIzu2MnAiJJj3TP905%2Bv1LERNp3WGhtwWpqumRRtBjexTjNH8ogeTSP0kvXtjmwgJj3yZ8FlaYq3d7TqlWqTEY"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 057d4f95-480b-11ee-a4e5-966976ec4a17 cache-control max-age=31622400 cf-ray 80c7f5266c5b453a-TXL x-cache-hits 1, 3
GET H2	200	p.css p.typekit.net/	5 B 172 B	59ms 32ms	Stylesheet text/css	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://p.typekit.net/p.css?s=1&k=pjm0fus&ht=tk&f=26034.26052.26053.26054.26055.26056.26057.26058.26059.26060.26061.26062.26063.26064.26065.26067.26068.26069.25998.25999.26000.26001.26016.26017.26018.26019.26036.26037.26046.26047.26070.26071.26072.26073.26074.26075.26076.26077.26078.26079.26080.26081.26082.26083.26086.26087&a=92827302&app=typekit&e=css Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb Request headers accept-language de-DE,de;q=0.9 Referer https://use.typekit.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:10 GMT last-modified Fri, 23 Jun 2023 17:09:47 GMT server nginx etag "6495d1db-5" content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes content-length 5
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	106ms 30ms	Script application/x-javascript	104.102.38.132 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.38.132 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-38-132.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Tue, 26 Sep 2023 02:08:11 GMT Content-Encoding gzip Last-Modified Fri, 17 Mar 2023 01:24:48 GMT Server AkamaiNetStorage ETag "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Length 729
GET H2	403	lt-v3.js lltrck.com/scripts/	0 0	390ms 124ms	Script text/html	54.80.42.4 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://lltrck.com/scripts/lt-v3.js?llid=23883 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.80.42.4 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-80-42-4.compute-1.amazonaws.com Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers
GET BLOB	200 OK	7337321b-385d-41c9-ba2a-83d19e2cee40 https://www.securonix.com/	1 KB 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.securonix.com/7337321b-385d-41c9-ba2a-83d19e2cee40 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Content-Length 1245 Content-Type text/javascript
GET H2	200	gtm.js Show response www.googletagmanager.com/	264 KB 92 KB	204ms 79ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2676c2bbd885c4a558bbcc44367ce143ea0dae56017fc8989f992545383e7d37 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 94152 x-xss-protection 0 last-modified Tue, 26 Sep 2023 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 26 Sep 2023 02:08:11 GMT
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	hero-coverage.png www.securonix.com/wp-content/uploads/2022/04/	3 KB 4 KB	229ms 229ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2022/04/hero-coverage.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfb9e92353e3d4999e02a6f01a3551a87686ebf0180baf65b4c961f7061bcf52 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 31 Aug 2024 15:49:29 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache-hits 1, 2 cf-polished origFmt=png, origSize=10885 x-cache HIT, HIT content-disposition inline; filename="hero-coverage.webp" content-length 3564 x-served-by cache-chi-klot8100063-CHI, cache-jnb7021-JNB cf-bgj imgq:85,h2pri last-modified Wed, 20 Apr 2022 17:31:36 GMT server cloudflare x-timer S1695410355.591843,VS0,VE484 etag "62604378-2a85" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kdU9tjB5F6Vg%2FUwSuOj6RkHhtXIcHRNO5YIV16t%2FbRB8JqZO2lhf%2BSrhpbpRIsRYn2UzXQZcTj3l9w4VfLkAiIKf4%2F5y6xpLZkjne79q4lyh3ZEV3r3N5CJyp7OFQjGQURywikYV4JRzru8x9Plk"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id f86860e2-4815-11ee-a15b-966976ec4a17 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5268c76453a-TXL x-pantheon-styx-hostname styx-fe2-a-85758c8d7d-n9v8c
GET H2	200	l use.typekit.net/af/46da36/00000000000000003b9acaf6/27/	26 KB 26 KB	97ms 32ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/46da36/00000000000000003b9acaf6/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 464b561ee00c86db1cddb80f2c9d6febbc2c1aa95f422fa73a4fb8ef7d5d5028 Request headers Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT server nginx etag "de29fb2e3e401b15877c6b3a0953702fe7fa1105" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 26812
GET H2	200	icomoon.ttf www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/	5 KB 5 KB	229ms 228ms	Font application/x-font-ttf	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix/assets/fonts/icons/icomoon.ttf?folamw Requested by Host: www.securonix.com URL: https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1695583866 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a4d1cf1412729a6ebf14ef0c798f0b9c9dc0ecee9e06e912859e4c53380fb33b Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers Referer https://www.securonix.com/wp-content/themes/securonix/assets/css/style.css?ver=1695583866 Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 18:52:48 GMT date Tue, 26 Sep 2023 02:08:11 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-pantheon-styx-hostname styx-fe2-a-75f45bdf4d-8fpp2 x-cache MISS, HIT x-served-by cache-chi-kigq8000049-CHI, cache-jnb7023-JNB last-modified Tue, 05 Sep 2023 16:03:00 GMT server cloudflare x-timer S1695408063.082425,VS0,VE2 etag W/"64f75134-1358" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BfalqN118fM1cv66XrSgTK%2Bqps%2BkUmZ26Nhki4ayD2ToyPBkDnavLk1BXid%2BdLy%2FCre%2FixwymQe3kUDE71nAczERAmv6RrG4Et0Fhq2Q1CdPR%2Bow4M40nA%2FBgoVwnofxnnDPGP%2FscsOkbCLTEkRe"}],"group":"cf-nel","max_age":604800} content-type application/x-font-ttf access-control-allow-origin * x-styx-req-id 688407e8-4c1d-11ee-a95f-e2f86a7ba4f0 cache-control max-age=31622400 cf-ray 80c7f5268c78453a-TXL x-cache-hits 0, 1
GET H2	200	QGYsz_wNahGAdqQ43Rh_fKDp.woff2 www.securonix.com/fonts.gstatic.com/s/worksans/v19/	49 KB 50 KB	31ms 30ms	Font font/woff2	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438 Request headers Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT cf-cache-status HIT last-modified Thu, 14 Sep 2023 01:13:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 101562 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cOwcqiYV5p7c8YZEqg24SxyNeZTgtLMvrFOEGGwz%2B7J9U%2Fc5JGW3x5tcQ28IRB0%2B%2FYenjfMddrLF%2FfCgYAFAIqYIUrFiuaAH6PGROc%2FpsK3jH4V4WRT%2BTrQXQZ2uJ2%2Fo9d2SIg6b1w2BBQZC6rxu"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control public, max-age=31536000 cf-apo-via proxy accept-ranges bytes cf-ray 80c7f5268c79453a-TXL content-length 50668
GET H2	200	l use.typekit.net/af/027dd4/00000000000000003b9acafa/27/	18 KB 19 KB	106ms 42ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/027dd4/00000000000000003b9acafa/27/l?subset_id=2&fvd=n6&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash deb1aa1c2af7a0f084b58e34c78545593305a87b23f9f6e099849c1ace0c9dd6 Request headers Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT server nginx etag "de3ec5612df14c88441e596fbc2c46580ea46ed7" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 18912
GET H2	200	l use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/	19 KB 19 KB	130ms 66ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/829fc1/00000000000000003b9acaf8/27/l?subset_id=2&fvd=n5&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash 841ec96a41283cf23db2d69fe67d9beee3e9b222bccfe81ecf6edefc78e92151 Request headers Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT server nginx etag "7fe86a8b0e0aad464390eb5e39aa627a47e9886d" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 18988
GET H2	200	l use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/	26 KB 26 KB	100ms 37ms	Font application/font-woff2	2a02:26f0:3500:16::215:1495 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://use.typekit.net/af/6d4bb2/00000000000000003b9acafc/27/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3 Requested by Host: use.typekit.net URL: https://use.typekit.net/pjm0fus.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:1495 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software nginx / Resource Hash da03f140d305f2abdf496bdd3fad9cfed87a237cf09f6a2edcec58bc5a1f044d Request headers Referer https://use.typekit.net/pjm0fus.css Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT server nginx etag "7d4a321fb4284bed9856c33aee6c065aba0855a7" content-type application/font-woff2 access-control-allow-origin * cache-control public, max-age=31536000 cross-origin-resource-policy cross-origin timing-allow-origin * content-length 26392
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	39ms 38ms	Script application/x-javascript	104.102.38.132 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.38.132 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-38-132.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Tue, 26 Sep 2023 02:08:11 GMT Content-Encoding gzip Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4741 Expires Thu, 04 Jan 2024 02:08:11 GMT
GET H2	200	sm.24.html Show response static.addtoany.com/menu/ Frame 891B	677 B 541 B	42ms 41ms	Document text/html	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/sm.24.html Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5a4192e762a449dfd6e63bee835e0941627223c9159e8219acdd01881a1ac175 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 376877 alt-svc h3=":443"; ma=86400 cache-control max-age=315360000, immutable cf-cache-status HIT cf-ray 80c7f5273ec3047e-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 26 Sep 2023 02:08:11 GMT etag W/"2a5-5edb40e6d10d8" last-modified Fri, 18 Nov 2022 00:47:55 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding via e4s x-content-type-options nosniff
GET H3	200	core.f4498a6a.js Show response static.addtoany.com/menu/modules/	70 KB 25 KB	92ms 54ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/modules/core.f4498a6a.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7f3c20825909bb222fd8ec5db0a985fb397c20a97d8362858ccfffb576e13a77 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT via e7s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 133763 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Sun, 24 Sep 2023 10:29:31 GMT server cloudflare etag W/"11650-606185138cb5e" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, immutable cf-ray 80c7f5277ab519b1-FRA
POST H/1.1	200 OK	visitWebPage 179-djp-142.mktoresp.com/webevents/	2 B 318 B	744ms 128ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://179-djp-142.mktoresp.com/webevents/visitWebPage?_mchNc=1695694091465&_mchCn=&_mchId=179-DJP-142&_mchTk=_mch-securonix.com-1695694091462-91961&_mchHo=www.securonix.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Tue, 26 Sep 2023 02:08:12 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id aed158a7-f181-49de-b444-352e86e86a0c
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	185ms 59ms	Script text/javascript	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 26 Sep 2023 01:49:43 GMT last-modified Mon, 12 Jun 2023 18:23:07 GMT server Golfe2 age 1108 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20994 expires Tue, 26 Sep 2023 03:49:43 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1004449086/	3 KB 2 KB	191ms 69ms	Script text/javascript	2a00:1450:4001:813::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1004449086/?random=1695694091612&cv=11&fst=1695694091612&bg=ffffff&guid=ON&async=1&gtm=45He39k2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&hn=www.googleadservices.com&frm=0&tiba=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&auid=201437025.1695694092&uamb=0&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 714b051d0ee6857f2d4a937d25a8622ce3746649f60fa1895980df4f636b2491 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1467 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	44 KB 13 KB	128ms 53ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a236aed5086b9c24d3cc94944d4349e9ce469f325ac23bafcaa5fe3659b15fd1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 26 Sep 2023 02:08:11 GMT last-modified Wed, 06 Sep 2023 22:41:28 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: D66486D7589A4947ACCF9CFF56F2F41D Ref B: FRAEDGE1307 Ref C: 2023-09-26T02:08:11Z etag "09cc4613e1d91:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript cache-control private,max-age=1800 accept-ranges bytes content-length 12981
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	12 KB 4 KB	125ms 35ms	Script application/x-javascript	2a02:26f0:780::210:a423 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:a423 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 28a26321734fb5f8c8fe42b5503f162fdf1469bf97e2d9c503a83cc2b3c534cd Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 05 Sep 2023 13:41:52 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=32740 accept-ranges bytes content-length 3822
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	75 KB 24 KB	135ms 32ms	Script text/javascript	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0e7ad47a4bc6ddbb17cb8cbe6167dae4717d0b5962a1d63de2e93e6dc201b9e8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers X-Amz-Version-Id 2W0nFhLgp3U9gUvvEzXT9GuNEpd6A6yg Content-Encoding gzip Via 1.1 b47ba5841a54cf2d19fc521c78e94514.cloudfront.net (CloudFront) Date Tue, 26 Sep 2023 01:59:01 GMT Age 552 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Thu, 03 Aug 2023 19:17:31 GMT Server AmazonS3 Etag W/"67e54a60303cfbf4c3b977aa390ad408" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id CCuY--9BU7F_LK1nyVg4nyjwS0FktpeNQa3M2vE2GUywyv1r_3sZlQ==
GET H2	200	6si.min.js Show response j.6sc.co/	51 KB 15 KB	170ms 29ms	Script application/javascript	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 24 Aug 2023 22:29:49 GMT server nginx/1.14.0 (Ubuntu) etag "64e7d9dd-cc38" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 14993 expires Tue, 26 Sep 2023 02:08:11 GMT
GET H2	200	r32rm8p2zmht.js Show response js.driftt.com/include/1695694200000/	215 KB 61 KB	246ms 156ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1695694200000/r32rm8p2zmht.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6b59be2f48490e7fab65a6fa43c99851ed0026b9c651ffa9937f49ad57cc2a22 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers x-amz-version-id l.B85eaiR5sX7u8JchWT4_t6lV2e1Zf2 strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip date Tue, 26 Sep 2023 02:08:11 GMT via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 29 last-modified Tue, 19 Sep 2023 20:16:03 GMT server istio-envoy etag W/"cfd0f6983bb181a781dd1c9ca318f995" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-cache access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id YzZfkjeHmQgEthQUqx2EPUnqDgTyDeTw2x7vbUZBiwnR7pBeXHJZCw==
GET H2	200	js Show response www.googletagmanager.com/gtag/	293 KB 95 KB	77ms 76ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 95ac0bda0ba2eabf85fe53e1a907be5c2e5b34c8c45a82e94d856db00581c627 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 97333 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Tue, 26 Sep 2023 02:08:11 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 256 B	117ms 34ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je39k2&_p=1974820507&_gaz=1&cid=943503128.1695694092&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1695694091&sct=1&seg=0&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&dt=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 247 B	104ms 35ms	Ping text/plain	2a00:1450:400c:c03::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=943503128.1695694092&gtm=45je39k2&aip=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c03::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	197ms 71ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=943503128.1695694092&gtm=45je39k2&aip=1&z=1480228395 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	36ms 36ms	Script application/x-javascript	2a02:26f0:780::210:a423 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:780::210:a423 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:11 GMT content-encoding gzip x-content-type-options nosniff last-modified Mon, 28 Aug 2023 12:14:15 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=28602 accept-ranges bytes content-length 4862
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/ Redirect Chain https://s.adroll.com/j/exp/VJKZ2AZ6BRDQFPNHOW6CAP/index.js https://s.adroll.com/j/exp/index.js	28 B 785 B	55ms 33ms	Script application/javascript	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/index.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol HTTP/1.1 Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers X-Amz-Version-Id e6mCeG7.PAM9gYrIJBIXJohubS3UVCEK Date Mon, 25 Sep 2023 14:51:19 GMT Via 1.1 b47ba5841a54cf2d19fc521c78e94514.cloudfront.net (CloudFront) Age 40613 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 28 Last-Modified Thu, 03 Aug 2023 18:30:18 GMT Server AmazonS3 Etag "5816cced8568d223aa09d889f300692b" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id h3c6wenqCgcVR4r3tMoz35Em9Wh5lVI_vkpSs5PPc8UGF7JO24p4UA== Redirect headers Date Mon, 25 Sep 2023 15:03:58 GMT Via 1.1 b47ba5841a54cf2d19fc521c78e94514.cloudfront.net (CloudFront) Age 39852 X-Amz-Cf-Pop FRA60-P4 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/exp/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id B4Yq-ERa0qutU06Dfymz6QeU12gES8EBGaBIF2hNzUiEn8zIMb-O-A==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/ Redirect Chain https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js https://s.adroll.com/j/pre/index.js	0 733 B	52ms 33ms	Script application/javascript	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/index.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol HTTP/1.1 Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers Date Mon, 25 Sep 2023 15:38:12 GMT X-Amz-Version-Id nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy Via 1.1 12e62b05f63a1a2118cca20014b15012.cloudfront.net (CloudFront) Age 37800 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Last-Modified Wed, 15 Jan 2020 23:54:18 GMT Server AmazonS3 Etag "d41d8cd98f00b204e9800998ecf8427e" Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id _8n8OZcT8T7n1H8EKAoAw_j37yq-SONoCH6RwU3GCU8CtNwl36g5aA== Redirect headers Date Mon, 25 Sep 2023 15:03:58 GMT Via 1.1 b47ba5841a54cf2d19fc521c78e94514.cloudfront.net (CloudFront) Age 39852 X-Amz-Cf-Pop FRA60-P4 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/pre/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id Ynxtb3lI9AVV0LOdFoWcP45JjVFjDx8dZ0Lijw_3Twv6WYZm1EktLg==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/	8 KB 4 KB	79ms 35ms	Script text/javascript	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 53ed652c4ef9ae06063e9e261d8dc730a32c7f94e5fc8e9c0cb7a5976e74f6b3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers X-Amz-Version-Id 5GZOP2iyp9Fjc7q4Umhs5XjWCEnLB8Nl Content-Encoding gzip Via 1.1 24fc4e03b1de2a14f79be2422e46a318.cloudfront.net (CloudFront) Date Tue, 26 Sep 2023 02:08:11 GMT Age 1015 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Mon, 25 Sep 2023 12:34:56 GMT Server AmazonS3 Etag W/"459cb1a9305a91036e006846810993f6" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id APstXKuW_ttz19WX1McAJhto0zv5Jik3unNl17aZrqDVpxYQ0Fq8Xg==
GET H2	204	27010718.js Show response bat.bing.com/p/action/	0 116 B	57ms 57ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/27010718.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Tue, 26 Sep 2023 02:08:11 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A5A75ACA48E84C5B9606D3C5CF43E331 Ref B: FRAEDGE1307 Ref C: 2023-09-26T02:08:11Z x-cache CONFIG_NOCACHE
GET H2	200	/ www.google.com/pagead/1p-user-list/1004449086/	42 B 154 B	199ms 71ms	Image image/gif	2a00:1450:4001:830::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1004449086/?random=1695694091612&cv=11&fst=1695693600000&bg=ffffff&guid=ON&async=1&gtm=45He39k2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&frm=0&tiba=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&fmt=3&is_vtc=1&random=2864721118&rmt_tld=0&ipr=y Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1004449086/	42 B 455 B	155ms 70ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1004449086/?random=1695694091612&cv=11&fst=1695693600000&bg=ffffff&guid=ON&async=1&gtm=45He39k2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&frm=0&tiba=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&fmt=3&is_vtc=1&random=2864721118&rmt_tld=1&ipr=y Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	4 B 211 B	67ms 66ms	XHR text/plain	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1974820507&t=pageview&_s=1&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&ul=en-us&de=UTF-8&dt=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1152890681&gjid=800739553&cid=943503128.1695694092&tid=UA-12895815-1&_gid=402425767.1695694092&_r=1&_slc=1&gtm=45He39k2n81N56FZ8X&z=1470846447 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/61924/domain/securonix.com/	36 B 375 B	128ms 33ms	XHR application/json	2600:9000:20eb:d000:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/61924/domain/securonix.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:d000:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.securonix.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 01:58:16 GMT content-encoding gzip via 1.1 cb33a7a4640adbb55df3e0d143601558.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 age 595 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id RJ9mc9sQaiutO4mlVm6JIltXBnvQcF7M9R68fB3u6FuCnZeFbmXL8w==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D61924%26time%3D1695694091839%26url%3Dhttps%253A%252F%252Fwww.securonix.com%252Fbl... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors...	0 265 B	270ms 176ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-hsSqWqYkVgAAAYrPPnlE_sYbpdOEvo-JQnRkax5PFM_yqsn8sROdHzNlU6sm0ce89gbA Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 20EE9434DE704552A5CE4814887F64F6 Ref B: FRAEDGE2014 Ref C: 2023-09-26T02:08:12Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYGOYwNuR8h0lNPsROzbQ== Redirect headers date Tue, 26 Sep 2023 02:08:12 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 6A048FA21D0140E3AB8363A08B7159B6 Ref B: FRAEDGE1313 Ref C: 2023-09-26T02:08:12Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1695694091839&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&cookiesTest=true&liSync=true&e_ipv6=AQI-hsSqWqYkVgAAAYrPPnlE_sYbpdOEvo-JQnRkax5PFM_yqsn8sROdHzNlU6sm0ce89gbA x-li-proto http/2 content-length 0 x-li-uuid AAYGOYwJnFJ6Mwn/W9gYvQ==
GET H2	200	VJKZ2AZ6BRDQFPNHOW6CAP Show response d.adroll.com/consent/check/	482 B 575 B	182ms 48ms	Script application/javascript	2a05:d018:cc3:fe05:a5a8:9312:631e:6dfd AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?pv=86976748971.11496&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&_s=4e58c2d111be2f303d81d7696d5c4fd6&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe05:a5a8:9312:631e:6dfd Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash 282f37aa23fd9562092dcba23f845420602761ca59fb1fe6964b8a84a6da61d1 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT server nginx/1.22.1 content-length 482 content-type application/javascript
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 151 B	35ms 34ms	XHR text/plain	2a00:1450:400c:c03::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-12895815-1&cid=943503128.1695694092&jid=1152890681&gjid=800739553&_gid=402425767.1695694092&_u=YADAAEAAAAAAACAAI~&z=450065636 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c03::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Tue, 26 Sep 2023 02:08:11 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 408 B	81ms 71ms	Image image/gif	2a00:1450:4001:830::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-12895815-1&cid=943503128.1695694092&jid=1152890681&_u=YADAAEAAAAAAACAAI~&z=1155680483 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	70ms 70ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-12895815-1&cid=943503128.1695694092&jid=1152890681&_u=YADAAEAAAAAAACAAI~&z=1155680483 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:11 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	securonix-blue.svg www.securonix.com/wp-content/uploads/2021/07/	4 KB 2 KB	27ms 27ms	Image image/svg+xml	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2021/07/securonix-blue.svg Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3a484da0ec050bccd6034a00ee39c4919c49ca749d0510f934a9ff5a07251a6c Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 23:37:57 GMT date Tue, 26 Sep 2023 02:08:12 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-75f45bdf4d-l4mt5 x-served-by cache-chi-klot8100025-CHI, cache-jnb7022-JNB last-modified Fri, 03 Dec 2021 17:18:42 GMT server cloudflare x-timer S1695408065.511033,VS0,VE1 etag W/"61aa5172-f3a" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZGkDw7ImdMXPj3%2FK86BIm11DjYF6VFf4prXi2c0IuX0pO6rReKkNbGzmXzqJeFLpb%2FZ4bVkds6eCkpBR%2BBWibEK1CvqE%2BcYmeokfgnCxRccyAfInCPSehXjkhap4pruIUP5umh95hWQstVC8l46%2F"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-styx-req-id 3e2706f4-4c45-11ee-80e4-7aa0144e2b91 cache-control max-age=31622400 cf-ray 80c7f52b9f5a453a-TXL x-cache-hits 1, 2
GET H3	200	linkedin.js Show response static.addtoany.com/menu/svg/icons/	447 B 550 B	42ms 41ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/linkedin.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.f4498a6a.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 98a4e1fdf290cfc7c5d58fd5688a45f0348db9ea62eceefad96a75569cae2a2d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.f4498a6a.js Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT via e2s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 13085454 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Fri, 18 Nov 2022 01:01:37 GMT server cloudflare etag W/"1bf-5edb43f69a778" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=7776000 cf-ray 80c7f52baca419b1-FRA
GET H3	200	twitter.js Show response static.addtoany.com/menu/svg/icons/	695 B 656 B	43ms 42ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/twitter.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.f4498a6a.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 74ec1e2bfcf647ccdeaf5b127294db846ee4a6f8ffd6c909d4938370d4187d1f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.f4498a6a.js Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT via e2s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 813006 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Fri, 18 Nov 2022 01:01:39 GMT server cloudflare etag W/"2b7-5edb43f86f378" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=7776000 cf-ray 80c7f52baca519b1-FRA
GET H3	200	facebook.js Show response static.addtoany.com/menu/svg/icons/	318 B 501 B	43ms 43ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/facebook.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.f4498a6a.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3a19ff3554a1e589f756a92be8263726674127c133feb1d333095668b77ba08c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.f4498a6a.js Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT via e2s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 453477 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Fri, 18 Nov 2022 01:01:36 GMT server cloudflare etag W/"13e-5edb43f5ee978" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=7776000, stale-while-revalidate=30 cf-ray 80c7f52baca619b1-FRA
GET H3	200	a2a.js Show response static.addtoany.com/menu/svg/icons/	182 B 397 B	40ms 39ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/a2a.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.f4498a6a.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.f4498a6a.js Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT via e4s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 309705 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Fri, 18 Nov 2022 01:01:36 GMT server cloudflare etag W/"b6-5edb43f58ee38" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=7776000 cf-ray 80c7f52baca819b1-FRA
GET H3	200	email.js Show response static.addtoany.com/menu/svg/icons/	393 B 526 B	45ms 45ms	Script application/javascript	2606:4700:10::6816:46c5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/email.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.f4498a6a.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:10::6816:46c5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 15684309274ca43c5240c88c5be2c9ed2f56ed2b38d0367dc372760f9e287c50 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://static.addtoany.com/menu/modules/core.f4498a6a.js Origin https://www.securonix.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT via e3s x-content-type-options nosniff cf-cache-status HIT content-encoding br strict-transport-security max-age=31536000; includeSubDomains; preload age 308558 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Fri, 18 Nov 2022 01:01:36 GMT server cloudflare etag W/"189-5edb43f5e5cd8" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=7776000 cf-ray 80c7f52baca919b1-FRA
GET H2	200	wp-emoji-release.min.js Show response www.securonix.com/wp-includes/js/	18 KB 5 KB	26ms 26ms	Script application/x-javascript	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.3.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230 Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sun, 15 Sep 2024 23:04:12 GMT date Tue, 26 Sep 2023 02:08:12 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 content-encoding br x-cache HIT, HIT x-pantheon-styx-hostname styx-fe2-a-8599f9599f-hb94v x-served-by cache-chi-kigq8000174-CHI, cache-jnb7022-JNB last-modified Fri, 15 Sep 2023 03:30:06 GMT server cloudflare x-timer S1695408063.683046,VS0,VE1 etag W/"6503cfbe-4904" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0kfNVC7V892iJP4NlrrlmfKwUu%2BYgH1k8t1G6Y73dgRrPaJaXrx8LkaGtnIUxVLarWF7u%2BKaZ6m94EIS%2Bu9jlG7yX3ls0rbozhgQ6qcHH83DT%2Fi2P%2B8LGWXVQPxly7uei4Ae9tM%2B8Jk4hZkOhUz7"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript x-styx-req-id 2f36e591-541c-11ee-b82b-e29b82b877c3 cache-control max-age=31622400 cf-ray 80c7f52baf6a453a-TXL x-cache-hits 1, 4
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	418 KB 56 KB	33ms 33ms	Script text/javascript	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 47e5ff66931402cb5755d7eed98a6d23ee556a7f8e9c1dd340d351c27f669a0f Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers X-Amz-Version-Id wD7IUQmRA9PUuld8lU58FBeuMlOqC6p6 Content-Encoding gzip Via 1.1 12e62b05f63a1a2118cca20014b15012.cloudfront.net (CloudFront) Date Tue, 26 Sep 2023 02:06:45 GMT Age 91 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Wed, 05 Jul 2023 21:39:27 GMT Server AmazonS3 Etag W/"3306a47faf7223d93fb356e8a73d1942" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id 0aDGDDNmd6tywm5rCTtab93tlIqXSLv00nXz_swgNsbCicPypIO-Fw==
GET H2	204	0 bat.bing.com/action/	0 285 B	55ms 54ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=83aa56fe-36ee-4ec0-9bf5-b10bff6c4a93&sid=8b973fc05c1111ee88d1995236891b7a&vid=8b9742605c1111eeb53e31c595269dbb&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&r=&lt=1938&evt=pageLoad&sv=1&rn=596478 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 26 Sep 2023 02:08:11 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: C2ADD90B60464D5BB71B7E84FEB518F0 Ref B: FRAEDGE1307 Ref C: 2023-09-26T02:08:12Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	34ms 33ms	Image image/png	2600:9000:225e:5200:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:5200:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Date Mon, 25 Sep 2023 15:07:00 GMT Via 1.1 12e62b05f63a1a2118cca20014b15012.cloudfront.net (CloudFront) Age 39672 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 1615 Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Server AmazonS3 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type image/png Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id Li4todQGN4AEJztCmyJ_9Rfeyw8c2nVbL2vL43X7-5aEMjozM8wQyQ==
GET H2	200	/ Show response c.6sc.co/	7 B 195 B	37ms 29ms	XHR text/html	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:12 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.securonix.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	20 B 313 B	153ms 29ms	XHR text/html	2a02:26f0:480:23::1726:62a7 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:62a7 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash fb6ace03aeac78105f826dbd0e0b1042b42d67e61255e4ed092bf632756b2755 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:13 GMT vary Origin content-type text/html access-control-allow-origin https://www.securonix.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2a03:1b20:b:f011::2e server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1695694093047_388391911_663364785_25_987_27_58_219";dur=1 content-length 20 expires Tue, 26 Sep 2023 02:08:13 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	243ms 223ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:13 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	core Show response js.driftt.com/ Frame 8916	2 KB 1 KB	132ms 132ms	Document text/html	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1695694200000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 014c54f9c69b24966b07631c7e8e558f5539ec546d75a475defe14337d28e152 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 26 Sep 2023 02:08:13 GMT etag W/"00133a3cf34b34b4e4ff44f62b5986b1" last-modified Tue, 19 Sep 2023 20:15:27 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-id t4idGjZY_J12wceUsnW6WIUD5rCmnGGGxggvhZyFowfzlB_jKjW3sw== x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-amz-version-id ZNXLNC0ssKOxmDh5pl9NDq6HqHehrwEr x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 15
GET H2	200	chat Show response js.driftt.com/core/ Frame F74C	2 KB 1 KB	136ms 136ms	Document text/html	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1695694200000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 014c54f9c69b24966b07631c7e8e558f5539ec546d75a475defe14337d28e152 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Tue, 26 Sep 2023 02:08:13 GMT etag W/"00133a3cf34b34b4e4ff44f62b5986b1" last-modified Tue, 19 Sep 2023 20:15:27 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-id 1CaARCSBHO6Ua3x2u2Twk5XWcTh360oqX3ethzjNVIspSlA5cS11OQ== x-amz-cf-pop FRA56-P5 x-amz-server-side-encryption AES256 x-amz-version-id ZNXLNC0ssKOxmDh5pl9NDq6HqHehrwEr x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 15
GET H2	200	nr-rum-1.241.0.min.js Show response js-agent.newrelic.com/	44 KB 16 KB	97ms 27ms	Script application/javascript	151.101.130.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://js-agent.newrelic.com/nr-rum-1.241.0.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 61088e8f402c9a4e121d26355073e8c692e8db86a0075b92ceed5c7eb4c424cc Security Headers Name Value Strict-Transport-Security max-age=300 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers x-amz-version-id F17sxhTmRNweJyZpjESmBytTZGz_S0Xi content-encoding br via 1.1 varnish date Tue, 26 Sep 2023 02:08:13 GMT strict-transport-security max-age=300 x-amz-request-id GNHWHC873H8W839R x-amz-server-side-encryption AES256 x-cache HIT cross-origin-resource-policy cross-origin content-length 15723 x-amz-id-2 FeKio+D4gTR8DXDRDwZz82tdi/lLLaS3HmJDchGQx2qDvHpJZuvdBbqeMhQQvPiIFKJJkh/vV74= x-served-by cache-fra-eddf8230125-FRA last-modified Tue, 19 Sep 2023 15:49:20 GMT server AmazonS3 x-timer S1695694093.064591,VS0,VE0 etag "b7786897586ffb59d4496d491cdbb690" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=7200, stale-if-error=604800 accept-ranges bytes x-cache-hits 122
POST H/1.1	200 OK	NRJS-e6ece394b0ed1b033c0 Show response bam.nr-data.net/1/	40 B 466 B	1099ms 997ms	XHR text/plain	162.247.241.14 NEWRELIC-AS-1
General Check archive.org Show headers Download Go to Full URL https://bam.nr-data.net/1/NRJS-e6ece394b0ed1b033c0?a=989077289&v=1.241.0&to=ZwNaNkBSWkAHVUZRCV5JeQFGWltdSUVbVgFcAxUAXlxT&rst=2933&ck=0&s=54033ca144db89aa&ref=https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/&ap=1045&be=215&fe=2605&dc=1722&at=S0RZQAhISU4%3D&perf=%7B%22timing%22:%7B%22of%22:1695694090162,%22n%22:0,%22dn%22:1,%22dne%22:20,%22c%22:20,%22s%22:37,%22ce%22:65,%22rq%22:65,%22rp%22:215,%22rpe%22:291,%22di%22:1928,%22ds%22:1933,%22de%22:1937,%22dc%22:2802,%22l%22:2818,%22le%22:2820%7D,%22navigation%22:%7B%7D%7D&fp=1170&fcp=1170 Requested by Host: js-agent.newrelic.com URL: https://js-agent.newrelic.com/nr-rum-1.241.0.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 162.247.241.14 San Francisco, United States, ASN23467 (NEWRELIC-AS-1, US), Reverse DNS Software cloudflare / Resource Hash ed59ee4d04819c48c1bb60b3ef6928c621cd5cd86d7103957de3eebba9910b0d Request headers Referer https://www.securonix.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 content-type text/plain Response headers Date Tue, 26 Sep 2023 02:08:14 GMT CF-Cache-Status DYNAMIC Server cloudflare Vary Accept-Encoding access-control-allow-methods GET, POST, PUT, HEAD, OPTIONS Content-Type text/plain Access-Control-Allow-Origin https://www.securonix.com access-control-allow-credentials true cross-origin-resource-policy cross-origin Connection keep-alive CF-Ray 80c7f53289494522-TXL Content-Length 40
GET H2	200	runtime~main.250b8c3b.js Show response js.driftt.com/core/assets/js/ Frame 8916	6 KB 3 KB	29ms 28ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash ab6259024d508e82f2100726285def9d2c67211afc10f9450dbb9efee58db5de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id INmBWBUTI7s8HQHrQELARWPZPG_qc8WA content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Fri, 15 Sep 2023 20:51:10 GMT server istio-envoy etag W/"187268a131d0fc1896127a07856617bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id L5gAA5OvakNCZF3i7dTMlI1rb_TXEuPWpBMeMKuLckxUiiSo6FouQQ==
GET H2	200	9.4a3e9801.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	35 KB 13 KB	31ms 31ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Fri, 27 Jan 2023 17:24:56 GMT x-amz-version-id hzm2Healt7ZjvNDM3nYQ47BRwWjFuLrw content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 20853797 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 16 last-modified Fri, 27 Jan 2023 17:00:22 GMT server istio-envoy etag W/"c6f58dd3d60f07462254b842dd4f9ca1" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id OXlF_3jVjDxVS5s1AleqDSywZP-Uwj-1VOmPeXyTUL4ku2dR6hkrWQ==
GET H2	200	main~493df0b3.d2a43907.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	7 KB 3 KB	32ms 32ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 08 Jul 2023 02:18:12 GMT x-amz-version-id UAS9fZEsWJhy55_yzrvbe0LqT9eTyvUT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6911401 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 75 last-modified Thu, 29 Jun 2023 18:36:40 GMT server istio-envoy etag W/"e094b276ad2035c3a46871991c258c2d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id aSVUY1XDxWMW5VifLJd7DgiKhWndg2bs50LcWT0LEDQjN6FiGe0sDw==
GET H2	200	runtime~main.250b8c3b.js Show response js.driftt.com/core/assets/js/ Frame F74C	6 KB 3 KB	29ms 28ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash ab6259024d508e82f2100726285def9d2c67211afc10f9450dbb9efee58db5de Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id INmBWBUTI7s8HQHrQELARWPZPG_qc8WA content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Fri, 15 Sep 2023 20:51:10 GMT server istio-envoy etag W/"187268a131d0fc1896127a07856617bb" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id dauLm2yTqhI7KvuNL3i_qQPlL2uCaZA-ybxrvGO5uwHIjM8Ymn47tQ==
GET H2	200	9.4a3e9801.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	35 KB 13 KB	31ms 31ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Fri, 27 Jan 2023 17:24:56 GMT x-amz-version-id hzm2Healt7ZjvNDM3nYQ47BRwWjFuLrw content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 20853797 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 16 last-modified Fri, 27 Jan 2023 17:00:22 GMT server istio-envoy etag W/"c6f58dd3d60f07462254b842dd4f9ca1" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id c6oc4IBzP0Bsjk_0LlDaq3TlW6pZrKq_y9YslwU4Uib07BpSoFlZCg==
GET H2	200	main~493df0b3.d2a43907.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	7 KB 3 KB	32ms 31ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 Origin https://js.driftt.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 08 Jul 2023 02:18:12 GMT x-amz-version-id UAS9fZEsWJhy55_yzrvbe0LqT9eTyvUT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6911401 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 75 last-modified Thu, 29 Jun 2023 18:36:40 GMT server istio-envoy etag W/"e094b276ad2035c3a46871991c258c2d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id t_WE4uMvyfJbCJHqv6wZ3LtlKjWh8gBnDnxk9LnjCBIMUYTkg4x1TA==
GET H2	200	details Show response epsilon.6sense.com/v3/company/	1 KB 838 B	220ms 159ms	XHR application/json	35.157.162.42 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.162.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-162-42.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 101979adbeba2ba0427d54874f700dc8d1029848bbfda7d939c9fadcb9708645 Request headers Referer https://www.securonix.com/ accept-language de-DE,de;q=0.9 Authorization Token 45bc92abc111f3fccbf9c8779059ecfc1d69c9e6 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 X-6s-CustomID WebTag1.0 05b12115ad17914938bf7667643ca0d3 Response headers date Tue, 26 Sep 2023 02:08:13 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://www.securonix.com access-control-allow-credentials true content-length 651
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	107ms 31ms	Preflight	35.157.162.42 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.162.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-157-162-42.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.securonix.com access-control-max-age 1800 date Tue, 26 Sep 2023 02:08:13 GMT server nginx
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	224ms 224ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3Ab%3Af011%3A%3A2e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:13 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	51.558be3c5.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	23 KB 8 KB	32ms 29ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 28 Aug 2023 01:45:42 GMT x-amz-version-id QZtKcKkqFh2Uk4IvDTqkNiRMO.MEc6F8 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2506951 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 18 last-modified Mon, 21 Aug 2023 14:57:26 GMT server istio-envoy etag W/"fa281fcbe4b2e35558d60fae3e316367" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sCQBd9tQddwmkDzMaC2ePxnS61hyT4p9Vrf-sgtj3iB_qM3KojrDRg==
GET H2	200	35.d0f1ccda.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	36 KB 10 KB	33ms 30ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 15 Aug 2023 23:55:35 GMT x-amz-version-id .9Z1hFvkMGOKBXSr0z8XOGr_QD6PPYGP content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3550358 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 30 last-modified Fri, 11 Aug 2023 16:01:20 GMT server istio-envoy etag W/"46fa5a7bc37a22544a908e4ad950309c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 85yBtwtvIALMCOXxVeYnkgwIuM6I2im8e0kWQ_EhV7dOp193o3Uhmg==
GET H2	200	22.6b9a301a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	32 KB 11 KB	36ms 32ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Thu, 13 Jul 2023 02:16:45 GMT x-amz-version-id b6Bt2g8ryVQoHB7t6bzl84fc0qn29fSy content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6479488 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 28 last-modified Wed, 12 Jul 2023 14:36:16 GMT server istio-envoy etag W/"d8739a9fe9a3a42936f5cd86c8727494" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id nIYLrDwFBqo1ZBzg6D96G8TXGpreaYzTW9H7cfF6v4ou-UY-6zOBwg==
GET H2	200	19.6f85b843.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	17 KB 6 KB	35ms 33ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sun, 23 Jul 2023 02:11:00 GMT x-amz-version-id Au8F3Ar_U1LqcmITQ7kozyIXP1hU0l.o content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5615833 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 61 last-modified Fri, 21 Jul 2023 20:53:08 GMT server istio-envoy etag W/"e28ebc3391b56e8f01ea063dc089e9d3" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1VpB87xWWA_kjr5GeLjyVZRNQ4Xi3s4fs987IajyoRAUrxxbhEWt5w==
GET H2	200	41.b4fc4de2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	25 KB 8 KB	37ms 34ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 15 Aug 2023 23:55:35 GMT x-amz-version-id Gp2dtlKh208YR70UI5PUzEC2uodfavWf content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3550358 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 14 last-modified Fri, 11 Aug 2023 16:01:20 GMT server istio-envoy etag W/"a2ace4f65aa7b34dedb884f6cfe9df8d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 0HO2Tj5gSsC04YP6euZdNak3fSFIUGjoY6P3RFYRmYBRXv0sRsbHDw==
GET H2	200	20.8c21ea18.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	74 KB 23 KB	40ms 38ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:18 GMT x-amz-version-id tpgacrQ52XYRAJzwU6or.lrZGF0wZZj1 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300095 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 19 last-modified Wed, 26 Jul 2023 13:14:42 GMT server istio-envoy etag W/"6d77a76055d81227033363af2f18caf8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Ms6OLrI1zA28ecm36-bF_8oGmSTDVN_MkpAiOHKwjrBSREOSnqdYDQ==
GET H2	200	26.04e7f30b.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	66 KB 20 KB	46ms 43ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 10:11:06 GMT x-amz-version-id QuflpVsRjQoeLsgyzbb2dO87jCp6veQD content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4291027 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 32 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"49ce5445ddcf5d24ef3badc4eb1a11dd" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id uVEaWjewz9eXzI75X5jJoORkqw562FtMo6FxQo5oZScCWkrdzaVbPg==
GET H2	200	14.e24a6190.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	91 KB 28 KB	50ms 48ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 15 Jul 2023 08:49:23 GMT x-amz-version-id ivQMayQoxYPrsJJ_uTz8OzBvhj3ZlBwm content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6283130 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Wed, 12 Jul 2023 14:36:15 GMT server istio-envoy etag W/"16d7ae86e21434a32157d3226ac9bb77" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6kuU9oAHPcmXwt0AYWerUyJR3F1-wrbdfvjAEAsSXQfXS1vp6_eaxw==
GET H2	200	11.639238ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	23 KB 7 KB	54ms 52ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/11.639238ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 28 Aug 2023 01:45:42 GMT x-amz-version-id kjsgkmFh.GnFcyw4pHTlnQqAwDZ4.mYa content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2506951 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 25 last-modified Mon, 21 Aug 2023 14:57:24 GMT server istio-envoy etag W/"4049f38c00add1738dc4806148ff8829" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id nGYSsnn7L6lblTGvYXk18fPW_-FalHrLK3os-zOw6VgVXiJqLI6t2A==
GET H2	200	18.9c1bd1fb.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	62 KB 20 KB	58ms 55ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 03:36:34 GMT x-amz-version-id fCU1rHK8PZHGjSHZj5aLYRigEERsAl0V content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4314698 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"02f09379c544befa413d22eb57ed41de" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id K4xLFO20__5qLi1IgiCHYlH0umEVn-EjjuJOmweFA_41ge8wjLguXQ==
GET H2	200	49.f7274268.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	105 KB 34 KB	62ms 60ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/49.f7274268.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:19 GMT x-amz-version-id nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 last-modified Wed, 26 Jul 2023 13:14:43 GMT server istio-envoy etag W/"e268d36b98f0119a2bb1a15f69fd4ffe" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sLBDJM6n7yNi3_y2e7xmvztncJprQSk0ZLV71QCTJ-xU3Md9NOCToA==
GET H2	200	40.31ef8dbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	12 KB 4 KB	67ms 65ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 19:12:12 GMT x-amz-version-id NUGZxvPg7W.acSsa10LtQDbxO8WVBOao content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5295361 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 16 last-modified Wed, 26 Jul 2023 13:14:42 GMT server istio-envoy etag W/"b0793fa46e8c0ae1846b7be8a833da35" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id blNHAu0M_viDdTR1VvpIYW97pc1bIdenH-71CF_qEmji4rtn6lV2sQ==
GET H2	200	29.31d09948.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	13 KB 6 KB	68ms 66ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/29.31d09948.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Fri, 14 Jul 2023 22:57:09 GMT x-amz-version-id LpOGcCN0tTTni4jtht.pQLzX33GYkDdT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6318664 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 21 last-modified Wed, 12 Jul 2023 14:36:16 GMT server istio-envoy etag W/"455157cb49065fb85fed54901ddaeb0e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id s1wWH7XdQVNOAIEb_SHeZ1mwm_wWrv3DiLq7BBdJjwy9fgWtyD4UoA==
GET H2	200	21.b8c41db9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	17 KB 7 KB	69ms 68ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 02:40:25 GMT x-amz-version-id rITDjXEpthOTAiahCXONMRPruIsBsv5Z content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4318068 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"65e5c965272e021ae33ff8bc39565ef5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id SI9rHcov4JwnJqqziHzF3DzpLqDps4cjk8AAKl3l9wIeb8w91WmGqQ==
GET H2	200	8.7602338c.chunk.css js.driftt.com/core/assets/css/ Frame 8916	31 KB 4 KB	70ms 69ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/8.7602338c.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 05 Sep 2023 18:50:08 GMT x-amz-version-id q66dX6dU5ESudoXt4AefzwSKn47c9cKn content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1754285 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 60 last-modified Mon, 04 Sep 2023 22:45:58 GMT server istio-envoy etag W/"76d0343f1f9f445c80d5c68c2a35b6e0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NotEX_iXilr8AISd5IdlEnclCvgWW0Jy-E-5cjSHb_kGCWfj7eLlCg==
GET H2	200	8.eba5dae8.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	81 KB 26 KB	73ms 72ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/8.eba5dae8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash c871f116084716e74638906e8f72d572ad0b429fe4ffd1e6524698f8863e6eed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 05 Sep 2023 18:50:08 GMT x-amz-version-id mBPubbVlcoGyCFUAJnlHcT2v7IEHPkOa content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1754285 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 64 last-modified Mon, 04 Sep 2023 22:46:02 GMT server istio-envoy etag W/"e5667c6d6613c671dc878d325651ed30" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tY0sDntLOSPoMgt6Sdmb69v0Zl9K2Iip0CHGY45kXIC5tppynPDPQA==
GET H2	200	16.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame 8916	24 B 697 B	71ms 70ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:55:06 GMT x-amz-version-id X5qMPjTBZh_EXTsHKYZdHpoQ.o7TDnrq via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 5299987 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 15 content-length 24 last-modified Wed, 26 Jul 2023 13:14:40 GMT server istio-envoy etag "0c5dad92482d9a7c7c253510f5082465" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NAksSfUyVrYsth9620pihGIJ2qgkh3VMwTK7v1c3yO1vfwoUGN4Gtw==
GET H2	200	16.8bd9e5a9.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	91 KB 24 KB	78ms 77ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.8bd9e5a9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 8879c5372c9cdd8a63f0482260b11c03651fb6bf5a216ab4478fdb30394ee24a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 13 Sep 2023 04:36:24 GMT x-amz-version-id it8iZm_DIEh8shbvI0o3g6PsgOCzAp9y content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1114309 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 85 last-modified Thu, 07 Sep 2023 15:58:12 GMT server istio-envoy etag W/"ef144ff505a111b4fe4731aaba1cffed" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 2I-d7lTr_F4gfsxv9vxFKlzA8BS0hIK3XUfpE4btX1NNDOoZFzbRJA==
GET H2	200	24.b8195d6f.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	50 KB 14 KB	81ms 80ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.b8195d6f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 13e6d3edf54c6c00bfa34948557a2988bd13c12dfa05426e2f96841e05859f61 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id VrlnP2ljCYKV4aqktyeLhDSqfEtxPA8K content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 18 last-modified Fri, 15 Sep 2023 20:51:06 GMT server istio-envoy etag W/"28a73cfbb87b842bc4035605050cf485" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id iZJ-981LQF0sp6dAIma_RauIwRKzur74z2V-ddK-Gk9MCHlqmaNCYQ==
GET H2	200	17.10f4dc86.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	40 KB 13 KB	82ms 82ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.10f4dc86.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e51a2be6b9ef83a35f3c668ee14a711245586dd5d64abec9609d71586063b5a0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id wYenZXx3wWk5yohfiJf5T8DgKkEzKw25 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 14 last-modified Fri, 15 Sep 2023 20:51:06 GMT server istio-envoy etag W/"73b73361bca65f89bc335da0149e0de6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id BRo1ay512K2tdWjTAMO8elfn5os_NazJMrFVZ-Goed57mynN9LBM-A==
GET H2	200	51.558be3c5.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	23 KB 8 KB	81ms 80ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 28 Aug 2023 01:45:42 GMT x-amz-version-id QZtKcKkqFh2Uk4IvDTqkNiRMO.MEc6F8 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2506951 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 18 last-modified Mon, 21 Aug 2023 14:57:26 GMT server istio-envoy etag W/"fa281fcbe4b2e35558d60fae3e316367" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id xO4iVDzLnw7m7C2A8vs4jNQr5EAFXn6UXAA0GKujN2clC5fqHfg23A==
GET H2	200	35.d0f1ccda.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	36 KB 10 KB	81ms 80ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 15 Aug 2023 23:55:35 GMT x-amz-version-id .9Z1hFvkMGOKBXSr0z8XOGr_QD6PPYGP content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3550358 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 30 last-modified Fri, 11 Aug 2023 16:01:20 GMT server istio-envoy etag W/"46fa5a7bc37a22544a908e4ad950309c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id FDoEpYDAehaP7LcelsqTGSuvV_FiMAp568swuJ362fUHaM0E2zjRxA==
GET H2	200	22.6b9a301a.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	32 KB 11 KB	82ms 81ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Thu, 13 Jul 2023 02:16:45 GMT x-amz-version-id b6Bt2g8ryVQoHB7t6bzl84fc0qn29fSy content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6479488 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 28 last-modified Wed, 12 Jul 2023 14:36:16 GMT server istio-envoy etag W/"d8739a9fe9a3a42936f5cd86c8727494" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Ac2H83RrVP6iW6H_cCa4qdSUQ5M5zCVi7E5rNIQG5QCDJNzLNwTTKQ==
GET H2	200	19.6f85b843.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	17 KB 6 KB	83ms 82ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sun, 23 Jul 2023 02:11:00 GMT x-amz-version-id Au8F3Ar_U1LqcmITQ7kozyIXP1hU0l.o content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5615833 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 61 last-modified Fri, 21 Jul 2023 20:53:08 GMT server istio-envoy etag W/"e28ebc3391b56e8f01ea063dc089e9d3" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id dp_EjZRj63aJAGVj3fWWacg_pdxGdgPEelec6kSiPwpetDoEhoxP9g==
GET H2	200	41.b4fc4de2.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	25 KB 8 KB	83ms 82ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 15 Aug 2023 23:55:35 GMT x-amz-version-id Gp2dtlKh208YR70UI5PUzEC2uodfavWf content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3550358 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 14 last-modified Fri, 11 Aug 2023 16:01:20 GMT server istio-envoy etag W/"a2ace4f65aa7b34dedb884f6cfe9df8d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tTivU3-KxnEuvQxviSpWb2iWaa2klySuKpXoCCYsgMlFXustm74ypQ==
GET H2	200	20.8c21ea18.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	74 KB 23 KB	85ms 84ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:18 GMT x-amz-version-id tpgacrQ52XYRAJzwU6or.lrZGF0wZZj1 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300095 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 19 last-modified Wed, 26 Jul 2023 13:14:42 GMT server istio-envoy etag W/"6d77a76055d81227033363af2f18caf8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id WggMdpTApwwq1szNH3X2ffryOfXp8cDPqDrOILZAnQ1-xS9K8Kopig==
GET H2	200	26.04e7f30b.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	66 KB 20 KB	86ms 85ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 10:11:06 GMT x-amz-version-id QuflpVsRjQoeLsgyzbb2dO87jCp6veQD content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4291027 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 32 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"49ce5445ddcf5d24ef3badc4eb1a11dd" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id WCNkgFU9z1sG4eb5o_HyaWys8rM4r_n3SowNmTm0OmHeMZamu7o3LQ==
GET H2	200	14.e24a6190.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	91 KB 28 KB	90ms 88ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 15 Jul 2023 08:49:23 GMT x-amz-version-id ivQMayQoxYPrsJJ_uTz8OzBvhj3ZlBwm content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6283130 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Wed, 12 Jul 2023 14:36:15 GMT server istio-envoy etag W/"16d7ae86e21434a32157d3226ac9bb77" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id NAMkh_zSugGfiBSVDRSv19-8wyMng7rsF4mgYu1_kNKSk5dhvJf3bQ==
GET H2	200	11.639238ba.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	23 KB 7 KB	90ms 89ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/11.639238ba.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 28 Aug 2023 01:45:42 GMT x-amz-version-id kjsgkmFh.GnFcyw4pHTlnQqAwDZ4.mYa content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 2506951 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 25 last-modified Mon, 21 Aug 2023 14:57:24 GMT server istio-envoy etag W/"4049f38c00add1738dc4806148ff8829" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 43XcZrgVejXifF_8euTbxNJiHm5PFDWQNZ5sUwBihU8THydR-3L2Sg==
GET H2	200	18.9c1bd1fb.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	62 KB 20 KB	91ms 90ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 03:36:34 GMT x-amz-version-id fCU1rHK8PZHGjSHZj5aLYRigEERsAl0V content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4314698 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"02f09379c544befa413d22eb57ed41de" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id U97eSO6VVEl6imyXh6XN-sBAC6FIMCQp4cbYvei2dkwTiIoO5y_qPQ==
GET H2	200	49.f7274268.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	105 KB 34 KB	92ms 91ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/49.f7274268.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:19 GMT x-amz-version-id nu5YPPYpbxwbA5KeFnNDvED6qjQ46e.5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300094 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 last-modified Wed, 26 Jul 2023 13:14:43 GMT server istio-envoy etag W/"e268d36b98f0119a2bb1a15f69fd4ffe" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 5cOqrNiD1Vn6pXqbbC_7Mph9B7CMdIZu9mhTa1ZFdFdyB2gb0XBR6w==
GET H2	200	40.31ef8dbf.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	12 KB 4 KB	93ms 92ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 19:12:12 GMT x-amz-version-id NUGZxvPg7W.acSsa10LtQDbxO8WVBOao content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5295361 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 16 last-modified Wed, 26 Jul 2023 13:14:42 GMT server istio-envoy etag W/"b0793fa46e8c0ae1846b7be8a833da35" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id W1GIaL5PSVC7MgRdGOePz7Z0FC46iFQVpwHLt05fFM6z3rzQH5Lw5A==
GET H2	200	29.31d09948.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	13 KB 6 KB	93ms 93ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/29.31d09948.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Fri, 14 Jul 2023 22:57:09 GMT x-amz-version-id LpOGcCN0tTTni4jtht.pQLzX33GYkDdT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 6318664 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 21 last-modified Wed, 12 Jul 2023 14:36:16 GMT server istio-envoy etag W/"455157cb49065fb85fed54901ddaeb0e" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id RBJevA5-TxP5I4caRMSnjmGKZb8lDQQOI7zJhZNGUppMihyr7Q8_3A==
GET H2	200	21.b8c41db9.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	17 KB 7 KB	94ms 94ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 02:40:25 GMT x-amz-version-id rITDjXEpthOTAiahCXONMRPruIsBsv5Z content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4318068 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"65e5c965272e021ae33ff8bc39565ef5" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id PlaQSPZSO2hHbODLcRL0Ia-kRHdHslna-rGTT-Pipz6duAona9G2jg==
GET H2	200	8.7602338c.chunk.css js.driftt.com/core/assets/css/ Frame F74C	31 KB 4 KB	94ms 94ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/8.7602338c.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 310de82ec6ba5948814ab8ec2369aa1d437e84e26ac56967fc79897acaa99a95 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 05 Sep 2023 18:50:08 GMT x-amz-version-id q66dX6dU5ESudoXt4AefzwSKn47c9cKn content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1754285 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 60 last-modified Mon, 04 Sep 2023 22:45:58 GMT server istio-envoy etag W/"76d0343f1f9f445c80d5c68c2a35b6e0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id OTi-GepPGKveV5YyefjjPiVlJ2RYm4kM_4XeUGIynF2vngubYOBYfw==
GET H2	200	8.eba5dae8.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	81 KB 26 KB	95ms 95ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/8.eba5dae8.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash c871f116084716e74638906e8f72d572ad0b429fe4ffd1e6524698f8863e6eed Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 05 Sep 2023 18:50:08 GMT x-amz-version-id mBPubbVlcoGyCFUAJnlHcT2v7IEHPkOa content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1754285 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 64 last-modified Mon, 04 Sep 2023 22:46:02 GMT server istio-envoy etag W/"e5667c6d6613c671dc878d325651ed30" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id sxjbfbqypA31V5lvtFMpVkrbaz45tkY8p1ejdJXrO8ZTU8ZKxWApSw==
GET H2	200	16.22abfce0.chunk.css js.driftt.com/core/assets/css/ Frame F74C	24 B 698 B	95ms 95ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:55:06 GMT x-amz-version-id X5qMPjTBZh_EXTsHKYZdHpoQ.o7TDnrq via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 5299987 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 15 content-length 24 last-modified Wed, 26 Jul 2023 13:14:40 GMT server istio-envoy etag "0c5dad92482d9a7c7c253510f5082465" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ihO-6RPqtnbjMDC5UNYcqF7-vaULuonyVZBUvr7znUkcjm_8l-GekQ==
GET H2	200	16.8bd9e5a9.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	91 KB 24 KB	97ms 97ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/16.8bd9e5a9.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 8879c5372c9cdd8a63f0482260b11c03651fb6bf5a216ab4478fdb30394ee24a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 13 Sep 2023 04:36:24 GMT x-amz-version-id it8iZm_DIEh8shbvI0o3g6PsgOCzAp9y content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1114309 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 85 last-modified Thu, 07 Sep 2023 15:58:12 GMT server istio-envoy etag W/"ef144ff505a111b4fe4731aaba1cffed" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 6OlNia3ZboTush6P4VgrXgfmOWS-9RV62rq6vHCsfApr9fmKclKdVA==
GET H2	200	24.b8195d6f.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	50 KB 14 KB	98ms 98ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/24.b8195d6f.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 13e6d3edf54c6c00bfa34948557a2988bd13c12dfa05426e2f96841e05859f61 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id VrlnP2ljCYKV4aqktyeLhDSqfEtxPA8K content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 18 last-modified Fri, 15 Sep 2023 20:51:06 GMT server istio-envoy etag W/"28a73cfbb87b842bc4035605050cf485" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id HKsOlcd5UW7BSl67ozE1REin-suyBph13CdinOmcsEu4LYS_QzAM_Q==
GET H2	200	17.10f4dc86.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	40 KB 13 KB	99ms 99ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/17.10f4dc86.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e51a2be6b9ef83a35f3c668ee14a711245586dd5d64abec9609d71586063b5a0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 19 Sep 2023 20:15:27 GMT x-amz-version-id wYenZXx3wWk5yohfiJf5T8DgKkEzKw25 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 539566 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 14 last-modified Fri, 15 Sep 2023 20:51:06 GMT server istio-envoy etag W/"73b73361bca65f89bc335da0149e0de6" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tDre5-vnX-AdFN2d8IKqRip3BKh4Dy7ZrBMZc7aCnh5nuQgcN69s0w==
GET H2	200	0.0b2ebd4a.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	9 KB 3 KB	31ms 30ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:21 GMT x-amz-version-id 11XPwI2xxVbguG7UE_GEw7u.mY1XZ4Ws content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300092 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 30 last-modified Wed, 26 Jul 2023 13:14:41 GMT server istio-envoy etag W/"c5efcdc9e465604f32cf24af10fd6c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id i5snEMO4lgzCLYcuKeFf4GBPjXL9c6sg5JziRbn9uCyrt4WCyoS7vg==
GET H2	200	27.01c2bea5.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	35 KB 10 KB	32ms 31ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 04:19:39 GMT x-amz-version-id 8ImB2GzfMuOIT4VQ58DA5kzWjWXBsygZ content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5348913 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 73 last-modified Tue, 25 Jul 2023 18:08:14 GMT server istio-envoy etag W/"04a233a42dcf8c50a83bfecea8ba552d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id pVHqmQxQy3XVX3hloY8lYzHuj9O3xlEApNBazsbacJn53g2zKXK9UA==
GET H2	200	28.b5e8f5e1.chunk.css js.driftt.com/core/assets/css/ Frame 8916	8 KB 2 KB	32ms 31ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/28.b5e8f5e1.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 7849ba1748f8188749df28e9d59ca4e570a8495684353d8df4715fa70a81e787 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 04 Sep 2023 23:24:26 GMT x-amz-version-id dWp9miJXOVmUTXcain7mZ7aJqiAGjznQ content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1824227 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 41 last-modified Mon, 04 Sep 2023 22:45:58 GMT server istio-envoy etag W/"e7107bc29ccb3c6d928f0f8f10a0f22d" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Zw-UbdawLS3GLFm5vjtZjp5BrNTIh6YnnTP35Lm_Oi6r4tFvQwEJnQ==
GET H2	200	28.bdd92ff2.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	14 KB 6 KB	33ms 32ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/28.bdd92ff2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 01:08:20 GMT x-amz-version-id FvCtLBM3Ax0E94dTAA_8PRI1sla9ZXxV content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4323593 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 43 last-modified Fri, 28 Jul 2023 18:55:10 GMT server istio-envoy etag W/"260fbabe310bd2cae5c44538f3d833ad" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id tGexqCor2sdyUxDrBq9C-tbzJWbNwOo7_iyZg_vIOsVk_t8nOdSRxw==
GET H2	200	25.c695453b.chunk.css js.driftt.com/core/assets/css/ Frame 8916	365 B 1 KB	33ms 32ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/25.c695453b.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 23:31:21 GMT x-amz-version-id n.AcAAyNdrluKmEb0IgSI_RvtitbHfQj via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 5279812 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 68 content-length 365 last-modified Wed, 26 Jul 2023 13:12:09 GMT server istio-envoy etag "06b2963b029c0824382815165bfea73e" access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id zmKOuJpqhGFZZfsOh5RD-wLcbh7u3zRBJ51lzWzfWDwa71sDr3jqZw==
GET H2	200	25.a9a52994.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	91 KB 25 KB	33ms 33ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/25.a9a52994.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash d21b490fa72e9cd90e09db07c73ef43c0d65bf38de6a41dfd1c53338f71549a3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 09 Sep 2023 18:42:49 GMT x-amz-version-id pcw9AIvdRX0G68ZPKiKBrPWu5fkyVt6d content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1409124 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 88 last-modified Thu, 07 Sep 2023 15:58:12 GMT server istio-envoy etag W/"34109a0bf2906f78b21b4a9f5fa4ab8c" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id pZhTBsvikQBx07VNCxdLpgHMUGheZkDEp90n35xSAYd54Fi3wp2UZA==
GET H2	200	37.11d2b6a7.chunk.css js.driftt.com/core/assets/css/ Frame F74C	3 KB 1 KB	30ms 29ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 10:11:06 GMT x-amz-version-id 1Fvw.FePqdHMTWAULWhHtYDtzjDh8y58 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4291026 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 41 last-modified Fri, 28 Jul 2023 18:55:08 GMT server istio-envoy etag W/"87532c4db85f1429fa6d759bc3332f36" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id zBCVwNQfO2H49ZCSTKSQCPcvsUZnXCq_WHWtAAVa1Rvs1cVhvpRseQ==
GET H2	200	37.298cbb69.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	3 KB 2 KB	31ms 30ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/37.298cbb69.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 19 Aug 2023 03:07:53 GMT x-amz-version-id JzP5EHa1AgOQDQQqP6XtnDRIZFkYBhy2 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3279620 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 46 last-modified Fri, 18 Aug 2023 19:22:22 GMT server istio-envoy etag W/"86b289eeb2bf9d30034f30d9794e8041" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id jt0MVQR-FqWVr-XUtVG5aMzQu3hJVULkccrqpePXbSC1QMavSm989Q==
GET H2	200	0.0b2ebd4a.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	9 KB 3 KB	29ms 28ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:21 GMT x-amz-version-id 11XPwI2xxVbguG7UE_GEw7u.mY1XZ4Ws content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300092 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 30 last-modified Wed, 26 Jul 2023 13:14:41 GMT server istio-envoy etag W/"c5efcdc9e465604f32cf24af10fd6c13" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id b2HlUeL-NNOs2BZLz4YRLHLzCs6h8b5pfcAoGqK2xg-I9rv2Pru9Fg==
GET H2	200	3.07aa08a5.chunk.css js.driftt.com/core/assets/css/ Frame F74C	7 KB 2 KB	30ms 29ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 17:53:21 GMT x-amz-version-id Ov831I2a5yEZEgVNkzjL3jR4iYT4qeoU content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5300092 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 40 last-modified Wed, 26 Jul 2023 13:12:09 GMT server istio-envoy etag W/"189aeffd571884559dababa22c66d75a" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id pls5TnsK3kLhMKAmEKOT0DEcpDXguoh4c_XRBOoFRQSA7pbb86M6ow==
GET H2	200	3.f50b964b.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	54 KB 15 KB	31ms 30ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Wed, 26 Jul 2023 09:32:39 GMT x-amz-version-id jXTrJe6220Uy3oL4jKw8LE4E7PDU6e2f content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5330134 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 54 last-modified Tue, 25 Jul 2023 18:08:14 GMT server istio-envoy etag W/"1ac37bf2b93050f29058b66a9ad43e10" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id ykvwYPSzE0LPrMfuMsR9_AD3c94Jo1rG0-XfnvCrjAgXvGjbEJVzJg==
GET H2	200	1.12ba17b6.chunk.css js.driftt.com/core/assets/css/ Frame F74C	44 KB 7 KB	31ms 31ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/1.12ba17b6.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 58fdb03fac3e89e51525a5a45eb777395d1b499bf4483e96201b6becddbe516f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 07 Aug 2023 11:27:15 GMT x-amz-version-id eSNvdp0yfhg_hVHGVV1T0Cg9aS8M1FwM content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 4286458 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 20 last-modified Fri, 28 Jul 2023 18:55:08 GMT server istio-envoy etag W/"3b8ba82e1bac13ee29e9764a55620d99" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id q0ncuXzlFbypKk6ZImu0VuyhJSuGG879s2AmaqGg2gpGNeg4LWdOEw==
GET H2	200	1.2aebee2c.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	54 KB 17 KB	32ms 32ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/1.2aebee2c.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 60409946ec37f5d25bf3516bd3fbc347358e60feaf168a3d578b323cb750860b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Mon, 04 Sep 2023 22:45:31 GMT x-amz-version-id bS8baBPItBLwxisqBAsAAbXKmqRySvKy content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1826562 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 25 last-modified Mon, 04 Sep 2023 17:29:48 GMT server istio-envoy etag W/"8dec138e62d799d028f8c7ed0cc19058" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id lGjnrb_95xPdUSqtSOlhAXlLwl_CNBNAx7aBvj7qHQImnVevMSyjaQ==
GET H2	200	4.9d776499.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	23 KB 10 KB	33ms 33ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/4.9d776499.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 622373f59cdda9ea36f307c5f7bef0cfd8e140018c995b6394468a26ef499dec Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 25 Jul 2023 18:55:58 GMT x-amz-version-id uGJ36CDXFf5jc7zFgfXUohqg1i8mPHWM content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5382735 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 17 last-modified Tue, 25 Jul 2023 18:08:15 GMT server istio-envoy etag W/"cc02ad980b6b04f3bba61e68883356d4" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id YFMjgp5_5yYF8B1GavInQ5rxuVIA9hsGcEMs53ZhoMQZpiFUxSvRWg==
GET H2	200	34.0504aac4.chunk.css js.driftt.com/core/assets/css/ Frame F74C	16 KB 3 KB	33ms 33ms	Stylesheet text/css	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/css/34.0504aac4.chunk.css Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 2b74bc303570faa3cd261b240078960cd0c28f811ae71cb72352809a42d20f6e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sun, 23 Jul 2023 02:11:02 GMT x-amz-version-id q2speui9tJuSqazhqyXXmusrZlo.6X8E content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 5615831 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 50 last-modified Fri, 21 Jul 2023 20:53:06 GMT server istio-envoy etag W/"95b017fb41a8751bd7175f8a73f035f8" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type text/css access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id gOz3Mhp57KPUIMK09yGGwBw6i1eSb7ay7v2h2HDowo1xkWmmitxUOg==
GET H2	200	34.565cc93a.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	13 KB 5 KB	33ms 33ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/34.565cc93a.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 08b15334412c5f3ad02391af96b4068d23b85e63c63fa8d78ee9bb7e78ce752d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 05 Sep 2023 18:50:08 GMT x-amz-version-id .CV9Gv7QHuYDZKNfN_Mj0Og0uIzMiBl5 content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 1754285 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 last-modified Mon, 04 Sep 2023 22:46:01 GMT server istio-envoy etag W/"57c0a57c3cf808c4592182b4c490b3a0" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id n0RdqpWzmRjivCtT9Kz_JobRSQlEQqqRq72kBhe7Tkr_pfTjB5L5NA==
POST H2	200	v2 Show response bootstrap.api.drift.com/widget_bootstrap/ping/ Frame 8916	147 B 588 B	416ms 128ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap/ping/v2 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 3342caca9bd339f32f1265167077f480be638202c9a7e271adda0818dfdae714 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Tue, 26 Sep 2023 02:08:13 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid 3a674b54b6a405d2 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 147
GET H3	200	collect www.google-analytics.com/	35 B 55 B	59ms 59ms	Image image/gif	2a00:1450:4001:802::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&a=1974820507&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&ul=en-us&de=UTF-8&dt=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=943503128.1695694092&tid=UA-12895815-1&_gid=402425767.1695694092&gtm=45He39k2n81N56FZ8X&z=828672975 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Mon, 25 Sep 2023 07:30:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 67039 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H2	200	v3 Show response metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 8916	25 B 89 B	176ms 146ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/widget/init/v3 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Tue, 26 Sep 2023 02:08:13 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid 767ed2b5a6e22ba6 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 21 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25
POST H2	200	widget_bootstrap Show response bootstrap.api.drift.com/ Frame 8916	12 KB 5 KB	467ms 467ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://bootstrap.api.drift.com/widget_bootstrap Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash b53e16252027e47f78cb63a3bcde56f0f9e9d8486e4e60f16923978011b74b06 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Tue, 26 Sep 2023 02:08:13 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip server istio-envoy requestid 1af0bbe77f751dac access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 343 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	224ms 224ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A11%20GMT%22%2C%22timeSpent%22%3A%222133%22%2C%22totalTimeSpent%22%3A%222133%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:14 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	Featured_Thumbnail_477X364.jpg www.securonix.com/wp-content/uploads/2023/04/	40 KB 41 KB	30ms 30ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/04/Featured_Thumbnail_477X364.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d6eca03ed71209b9ffb851f4cdd9f1fc307e5aeb871d91f93a1ff62989383dfa Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Sat, 31 Aug 2024 14:31:27 GMT date Tue, 26 Sep 2023 02:08:14 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 cf-polished qual=85, origFmt=jpeg, origSize=182629 x-cache HIT, HIT x-cache-hits 1, 2 content-disposition inline; filename="Featured_Thumbnail_477X364.webp" content-length 41074 x-served-by cache-chi-kigq8000040-CHI, cache-jnb7025-JNB cf-bgj imgq:85,h2pri last-modified Thu, 13 Apr 2023 19:08:27 GMT server cloudflare x-timer S1695408068.732847,VS0,VE1 etag "6438532b-2c965" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iouaH2khSpz0D7WdYWCPFYRDnhTWmcO1aq90wEwvwK34618DQiJ7OXrBWW%2FZUpgD0vPL%2FJA0sGo4EoEUlgcWOOvybdHOP12j3JKh1Z93lMsi745BQoU58lVoF7l5CCgGw9p%2FvvLD7LOEe4P0srjL"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id 118ff46b-480b-11ee-9826-223b42c2c902 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5377e57453a-TXL x-pantheon-styx-hostname styx-fe2-a-85758c8d7d-44kbq
GET H2	200	gartner_innovationInsightReport_21_menuImg.jpg www.securonix.com/wp-content/uploads/2021/12/	28 KB 28 KB	29ms 29ms	Image image/webp	2606:4700:3108::ac42:2b19 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2021/12/gartner_innovationInsightReport_21_menuImg.jpg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:2b19 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 39aa671013c2af0bf0046fe10ae6ec6fb66295ea5cf95f107808f575a85d824f Security Headers Name Value Strict-Transport-Security max-age=31622400 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers expires Thu, 05 Sep 2024 18:52:51 GMT date Tue, 26 Sep 2023 02:08:14 GMT strict-transport-security max-age=31622400 via 1.1 varnish, 1.1 varnish cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 101563 cf-polished qual=85, origFmt=jpeg, origSize=133138 x-cache HIT, HIT x-cache-hits 1, 2 content-disposition inline; filename="gartner_innovationInsightReport_21_menuImg.webp" content-length 28204 x-served-by cache-chi-kigq8000071-CHI, cache-jnb7027-JNB cf-bgj imgq:85,h2pri last-modified Fri, 03 Dec 2021 17:18:42 GMT server cloudflare x-timer S1695408067.213337,VS0,VE1 etag "61aa5172-20812" vary Accept report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oil3Bp4KjFsCwDKGrtUmqAbi9laMTgzzjvXMEleWuFlq15F3MTU7Cp3VPKBmadgu5%2FzH%2Bc%2Fqv%2BWR1l2nr0IscvxRWr4p8gg4oNc9B1%2FB7TsmcOKG%2BofV3Ur%2FwZzpTEOQLniH3iGrt9y2VaM5IBa4"}],"group":"cf-nel","max_age":604800} content-type image/webp x-styx-req-id 6a40edff-4c1d-11ee-bbe8-aee58b288ed2 cache-control max-age=31622400 accept-ranges bytes cf-ray 80c7f5377e58453a-TXL x-pantheon-styx-hostname styx-fe2-a-75f45bdf4d-cdpk8
POST H2	200	track Show response event.api.drift.com/ Frame 8916	810 B 868 B	127ms 126ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://event.api.drift.com/track Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 633e3fe65dc2cc76b1f7b6a02ee5435ed0f993eaa5b68f5548c053df7665822a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTU3MTM4NDM5NCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjUwNDkwNDgiLCJleHAiOjE3MjczMTY0OTQsImlhdCI6MTY5NTY5NDA5NH0.-2suDGg4m_efX-990QRK76s_43ZnCK53HveFwNQ7YZ48ZrEDN0b5k02iBw4SnoWKnVjvXV49ScgYHqTYxaSzjw User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/json Response headers date Tue, 26 Sep 2023 02:08:15 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid 9b8491d03e3769d6 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-credentials true x-envoy-upstream-service-time 1 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 810
OPTIONS H2	200	track event.api.drift.com/ Frame	0 0	135ms 127ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://event.api.drift.com/track Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 26 Sep 2023 02:08:15 GMT requestid drift8feb5eb46dc871ae3b5ad65e043 server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 1
POST H2	200	evaluate_with_log Show response targeting.api.drift.com/targeting/ Frame 8916	800 B 459 B	127ms 127ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/targeting/evaluate_with_log Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 1e79f9ddf0bc1fae8fc618cdd9682067a3ee66bc31467d01f1c011cf121b359f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTU3MTM4NDM5NCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjUwNDkwNDgiLCJleHAiOjE3MjczMTY0OTQsImlhdCI6MTY5NTY5NDA5NH0.-2suDGg4m_efX-990QRK76s_43ZnCK53HveFwNQ7YZ48ZrEDN0b5k02iBw4SnoWKnVjvXV49ScgYHqTYxaSzjw User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/json Response headers date Tue, 26 Sep 2023 02:08:15 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip server istio-envoy requestid 8fc955752f75406d access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 2 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 398
OPTIONS H2	200	evaluate_with_log targeting.api.drift.com/targeting/ Frame	0 0	159ms 128ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/targeting/evaluate_with_log Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 26 Sep 2023 02:08:15 GMT requestid drift753d56a424ba6fe7c55cffff12d server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 1
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	225ms 225ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223134%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:15 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	render_initial_v3 Show response flow.api.drift.com/flows/ Frame 8916	4 KB 2 KB	163ms 162ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://flow.api.drift.com/flows/render_initial_v3 Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash 6b74a299f022930d90326971a069fe59352920d91f176396d582521076e5eed9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTU3MTM4NDM5NCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjUwNDkwNDgiLCJleHAiOjE3MjczMTY0OTQsImlhdCI6MTY5NTY5NDA5NH0.-2suDGg4m_efX-990QRK76s_43ZnCK53HveFwNQ7YZ48ZrEDN0b5k02iBw4SnoWKnVjvXV49ScgYHqTYxaSzjw User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/json Response headers date Tue, 26 Sep 2023 02:08:15 GMT strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip server istio-envoy requestid 3e8d06cbc1b30dd5 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 36 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 2003
OPTIONS H2	200	render_initial_v3 flow.api.drift.com/flows/ Frame	0 0	158ms 126ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://flow.api.drift.com/flows/render_initial_v3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 26 Sep 2023 02:08:15 GMT requestid driftd11601b4556b3ec2b58e7b09634 server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 2
OPTIONS H2	200	widget targeting.api.drift.com/impressions/ Frame	0 0	127ms 126ms	Preflight text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/impressions/widget Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://js.driftt.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-max-age 1209600 allow POST,OPTIONS content-length 13 content-type text/plain date Tue, 26 Sep 2023 02:08:15 GMT requestid drift98554704eeea4cf798abcefbfe4 server istio-envoy strict-transport-security max-age=31536000; includeSubDomains x-envoy-upstream-service-time 1
POST H2	204	widget Show response targeting.api.drift.com/impressions/ Frame 8916	0 37 B	133ms 132ms	XHR text/plain	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://targeting.api.drift.com/impressions/widget Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 Authorization Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiIxOTU3MTM4NDM5NCIsImNsaWVudElkIjoiZjZ6dWl6ZHloeHJtN3IiLCJ1c2VySWRUeXBlIjoiTEVBRCIsInNjb3BlIjoibGVhZCIsImlzcyI6IjUwNDkwNDgiLCJleHAiOjE3MjczMTY0OTQsImlhdCI6MTY5NTY5NDA5NH0.-2suDGg4m_efX-990QRK76s_43ZnCK53HveFwNQ7YZ48ZrEDN0b5k02iBw4SnoWKnVjvXV49ScgYHqTYxaSzjw User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/json Response headers date Tue, 26 Sep 2023 02:08:15 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid 951c354147ddec51 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info access-control-allow-credentials true x-envoy-upstream-service-time 7 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
GET H2	200	57.28dde8ce.chunk.js Show response js.driftt.com/core/assets/js/ Frame 8916	19 KB 7 KB	29ms 28ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=9ee8e876-21bc-42cc-bc08-e2a927794ba6&sessionStarted=1695694092.969&campaignRefreshToken=3ede7ba0-1d7f-487d-b4a0-23d3fddd2d82&hideController=false&pageLoadStartTime=1695694090453&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 19 Aug 2023 02:57:26 GMT x-amz-version-id RC9wHzNSJSUNxtwIhSrk.IaHgPmrvySk content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3280249 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 15 last-modified Fri, 18 Aug 2023 19:22:23 GMT server istio-envoy etag W/"3c4cd13822c0069a68e9f9c8240f5ba9" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id Tw7weriaWZindPRp9NbsKBNypQbEoxeTB7Ve2FYbku1kIQYRAzWaqw==
GET H2	200	57.28dde8ce.chunk.js Show response js.driftt.com/core/assets/js/ Frame F74C	19 KB 7 KB	34ms 30ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/assets/js/57.28dde8ce.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/runtime~main.250b8c3b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 594d3ade307f6f48a5ef5143228b9da7c4e78589177ac70e91d31fe75ea83d60 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1695694090453 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sat, 19 Aug 2023 02:57:26 GMT x-amz-version-id RC9wHzNSJSUNxtwIhSrk.IaHgPmrvySk content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) x-amz-cf-pop FRA56-P5 age 3280249 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 15 last-modified Fri, 18 Aug 2023 19:22:23 GMT server istio-envoy etag W/"3c4cd13822c0069a68e9f9c8240f5ba9" vary Accept-Encoding access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id bMVfSWzwzWX4-RHm83OdG2MaB8hmFJUD2_G7pfg7iNyGcGKei1h30A==
GET H2	200	https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.us-east-1.amazonaws.com%252Fcustomer-api-avatars-prod%252F5130350%252F6282c33c393dca50ce00ed9532a136bfx86feknggm7a%3Ffit%3Dmax%26fm%3Dpng%26h... driftt.imgix.net/ Frame 8916	6 KB 1 KB	237ms 28ms	Image image/svg+xml	2a04:4e42:8d::720 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://driftt.imgix.net/https%3A%2F%2Fdriftt.imgix.net%2Fhttps%253A%252F%252Fs3.us-east-1.amazonaws.com%252Fcustomer-api-avatars-prod%252F5130350%252F6282c33c393dca50ce00ed9532a136bfx86feknggm7a%3Ffit%3Dmax%26fm%3Dpng%26h%3D200%26w%3D200%26s%3De49726653dfbf5250150991290f41541?fit=max&fm=png&h=200&w=200&s=4e881ced3d8b0474e5ba24dfc021bd8c Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:8d::720 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software imgix / Resource Hash ee017c9867f533ac48e9e7eb41c93a86bd95baf1418e9e89fc0828e430e8b1c9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://js.driftt.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:15 GMT content-encoding gzip x-content-type-options nosniff age 651775 x-cache HIT, HIT x-imgix-id c918286e0e0ffbc0a859a618bfe6f3e2734733d9 cross-origin-resource-policy cross-origin content-length 1138 x-served-by cache-sjc1000134-SJC, cache-fra-eddf8230038-FRA x-imgix-render-farm 01.140328 last-modified Fri, 23 Sep 2022 07:05:03 GMT server imgix vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=315360000 accept-ranges bytes timing-allow-origin *
GET H2	200	3.ee35dea2.chunk.js Show response js.driftt.com/conductor/assets/	158 B 853 B	28ms 28ms	Script application/javascript	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1695694200000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash 3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Sun, 23 Jul 2023 23:38:44 GMT x-amz-version-id pMohofQYEF1dohPHFcPmV3oeRzVr6CuK via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 5538571 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-envoy-upstream-service-time 22 content-length 158 last-modified Fri, 21 Jul 2023 20:53:14 GMT server istio-envoy etag "e6714addd36102488fb27a980401fd36" access-control-allow-methods GET, POST, OPTIONS content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id e4Ewpv-SzWnZmwtIiTJ9OLay9W5lSa5d2B-AGxqTWzrgsTpEww6JnQ==
GET H2	206	notification.5f7c6014.mp3 js.driftt.com/conductor/assets/media/	8 KB 8 KB	30ms 30ms	Media audio/mpeg	18.66.112.39 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.39 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-39.fra56.r.cloudfront.net Software istio-envoy / Resource Hash bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Accept-Encoding identity;q=1, *;q=0 accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Range bytes=0- Response headers date Tue, 12 Sep 2023 13:18:23 GMT x-amz-version-id JS80yCaveW4uTEkLuSKxGHOpZ1PbF4bY via 1.1 5c14dc328191a14142654d833f772c6c.cloudfront.net (CloudFront) strict-transport-security max-age=31536000; includeSubDomains x-amz-cf-pop FRA56-P5 age 1169392 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront Content-Range bytes 0-7754/7755 x-envoy-upstream-service-time 19 Content-Length 7755 last-modified Thu, 07 Sep 2023 15:58:19 GMT server istio-envoy etag "5f7c6014cf73831f91963a668b71fbb9" access-control-allow-methods GET, POST, OPTIONS content-type audio/mpeg access-control-allow-origin * cache-control max-age=31536000 access-control-allow-credentials true accept-ranges bytes access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type x-amz-cf-id 1zepo9bU9r7xmH8HYydEaK6YSv6-6g8RrU7BWnLzeZXrz3D74Sh2zw==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	226ms 225ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A14%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224135%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:16 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu) etag "63f02dad-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	200	bulk Show response metrics.api.drift.com/monitoring/metrics/event3/ Frame 8916	25 B 112 B	138ms 138ms	XHR application/json	34.193.113.164 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://metrics.api.drift.com/monitoring/metrics/event3/bulk Requested by Host: js.driftt.com URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-193-113-164.compute-1.amazonaws.com Software istio-envoy / Resource Hash f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Accept application/json, text/plain, */* Referer https://js.driftt.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Tue, 26 Sep 2023 02:08:16 GMT strict-transport-security max-age=31536000; includeSubDomains server istio-envoy requestid 62493d5b79fa43b7 access-control-max-age 1209600 access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH content-type application/json;charset=utf-8 access-control-allow-origin * access-control-expose-headers X-Results-Total-Count,X-Page-Info vary Accept-Encoding access-control-allow-credentials true x-envoy-upstream-service-time 13 access-control-allow-headers origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version content-length 25
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 485 B	225ms 224ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A15%20GMT%22%2C%22timeSpent%22%3A%221008%22%2C%22totalTimeSpent%22%3A%225143%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:17 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 484 B	226ms 225ms	Image image/gif	95.101.111.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=c1b834a1-dca3-4e8f-8823-2eaa81f8a539&session=299ba4c9-ce0c-419e-85fd-73cd09e0fcb9&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2026%20Sep%202023%2002%3A08%3A16%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226145%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&pageViewId=02192008-2595-4917-8473-539ba34d897a&v=1.1.6 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers date Tue, 26 Sep 2023 02:08:18 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 54 B	35ms 34ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je39k2&_p=1974820507&cid=943503128.1695694092&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1695694091&sct=1&seg=0&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads%2F&dt=Threat%20Labs%20Security%20Advisory%3A%20New%20STARK%23VORTEX%20Attack%20Campaign%3A%20Threat%20Actors%20Use%20Drone%20Manual%20Lures%20to%20Deliver%20MerlinAgent%20Payloads%20-%20Securonix&en=6sense&_et=1688&up.buying_stage=Consideration&up.company_name=KeHE%20Distributors%20LLC&up.country=United%20States&up.domain=kehe.com&up.employee_count=5500&up.industry=Retail%20and%20Distribution&up.region=Northern%20America&up.state=Illinois&up.zip=60563&up.segments= Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.92 Safari/537.36 Response headers pragma no-cache date Tue, 26 Sep 2023 02:08:18 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.securonix.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT