www.cyberark.com Open in urlscan Pro
104.18.190.184 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Submission: On June 22 via manual (June 22nd 2023, 6:23:29 pm UTC) from JP — Scanned from JP

Summary HTTP 238 Redirects Links 41 Behaviour Indicators

Summary

This website contacted 47 IPs in 4 countries across 45 domains to perform 238 HTTP transactions. The main IP is 104.18.190.184, located in and belongs to CLOUDFLARENET, US. The main domain is www.cyberark.com. The Cisco Umbrella rank of the primary domain is 462387.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 31st 2023. Valid for: a year.

This is the only time www.cyberark.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
30	104.18.190.184 104.18.190.184	13335 (CLOUDFLAR...) (CLOUDFLARENET)
28	99.84.140.18 99.84.140.18	16509 (AMAZON-02) (AMAZON-02)
9	13.32.50.97 13.32.50.97	16509 (AMAZON-02) (AMAZON-02)
4	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	172.217.175.74 172.217.175.74	15169 (GOOGLE) (GOOGLE)
7	23.39.216.225 23.39.216.225	16625 (AKAMAI-AS) (AKAMAI-AS)
4	142.251.42.136 142.251.42.136	15169 (GOOGLE) (GOOGLE)
3 7	34.111.234.236 34.111.234.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	23.34.103.199 23.34.103.199	16625 (AKAMAI-AS) (AKAMAI-AS)
2	172.217.175.67 172.217.175.67	15169 (GOOGLE) (GOOGLE)
1	54.187.122.125 54.187.122.125	16509 (AMAZON-02) (AMAZON-02)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
2 5	18.177.126.76 18.177.126.76	16509 (AMAZON-02) (AMAZON-02)
10 10	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
2 2	52.77.115.171 52.77.115.171	16509 (AMAZON-02) (AMAZON-02)
2 3	18.176.247.126 18.176.247.126	16509 (AMAZON-02) (AMAZON-02)
9	23.200.55.30 23.200.55.30	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	23.35.124.205 23.35.124.205	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.225.183.101 13.225.183.101	16509 (AMAZON-02) (AMAZON-02)
7	13.32.50.10 13.32.50.10	16509 (AMAZON-02) (AMAZON-02)
2	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
6	172.217.26.238 172.217.26.238	15169 (GOOGLE) (GOOGLE)
1	18.179.253.189 18.179.253.189	16509 (AMAZON-02) (AMAZON-02)
1 1	52.77.41.185 52.77.41.185	16509 (AMAZON-02) (AMAZON-02)
2	63.140.50.17 63.140.50.17	16509 (AMAZON-02) (AMAZON-02)
1	13.33.174.94 13.33.174.94	16509 (AMAZON-02) (AMAZON-02)
1	142.251.170.156 142.251.170.156	15169 (GOOGLE) (GOOGLE)
1	103.43.90.114 103.43.90.114	29990 (ASN-APPNEX) (ASN-APPNEX)
1	23.200.55.8 23.200.55.8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
5	192.28.146.116 192.28.146.116	15224 (OMNITURE) (OMNITURE)
2	142.250.196.100 142.250.196.100	15169 (GOOGLE) (GOOGLE)
2	216.58.220.99 216.58.220.99	15169 (GOOGLE) (GOOGLE)
65	13.33.174.58 13.33.174.58	16509 (AMAZON-02) (AMAZON-02)
1	142.250.196.130 142.250.196.130	15169 (GOOGLE) (GOOGLE)
2	23.33.33.145 23.33.33.145	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	31.13.82.7 31.13.82.7	32934 (FACEBOOK) (FACEBOOK)
4	13.32.50.9 13.32.50.9	16509 (AMAZON-02) (AMAZON-02)
1 2	142.251.42.166 142.251.42.166	15169 (GOOGLE) (GOOGLE)
4	3.210.10.81 3.210.10.81	14618 (AMAZON-AES) (AMAZON-AES)
1 2	18.176.186.29 18.176.186.29	16509 (AMAZON-02) (AMAZON-02)
5 5	54.174.246.206 54.174.246.206	14618 (AMAZON-AES) (AMAZON-AES)
2 2	23.44.52.187 23.44.52.187	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 3	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
2 2	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	142.251.42.162 142.251.42.162	15169 (GOOGLE) (GOOGLE)
1	13.33.174.32 13.33.174.32	16509 (AMAZON-02) (AMAZON-02)
3 4	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	99.84.138.44 99.84.138.44	16509 (AMAZON-02) (AMAZON-02)
2 2	13.228.126.19 13.228.126.19	16509 (AMAZON-02) (AMAZON-02)
1 1	69.173.158.64 69.173.158.64	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	142.251.42.130 142.251.42.130	15169 (GOOGLE) (GOOGLE)
2	31.13.82.36 31.13.82.36	32934 (FACEBOOK) (FACEBOOK)
1	216.58.220.98 216.58.220.98	15169 (GOOGLE) (GOOGLE)
2	54.147.21.139 54.147.21.139	14618 (AMAZON-AES) (AMAZON-AES)
238	47

30 104.18.190.184 (None, )

ASN13335 (CLOUDFLARENET, US)

www.cyberark.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 99.84.140.18 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-140-18.nrt57.r.cloudfront.net

content.cdntwrk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 13.32.50.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-50-97.nrt57.r.cloudfront.net

cihost.uberflip.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.175.74 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt20s20-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 23.39.216.225 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-216-225.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.251.42.136 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.111.234.236 (Kansas City, United States) 3 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.234.111.34.bc.googleusercontent.com

ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.34.103.199 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-34-103-199.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.175.67 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt20s20-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.187.122.125 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-187-122-125.us-west-2.compute.amazonaws.com

in.ml314.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

316-czp-275.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.177.126.76 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-177-126-76.ap-northeast-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 35.71.131.137 (United States) 10 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.77.115.171 (Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-77-115-171.ap-southeast-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.176.247.126 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-176-247-126.ap-northeast-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 23.200.55.30 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-55-30.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.35.124.205 (Tokyo, Japan)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-124-205.deploy.static.akamaitechnologies.com

sjrtp6-cdn.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtp-static.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.183.101 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-183-101.nrt57.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 13.32.50.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-50-10.nrt57.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.65.140 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.26.238 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s51-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.179.253.189 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-179-253-189.ap-northeast-1.compute.amazonaws.com

cyberark.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.77.41.185 (Singapore) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-77-41-185.ap-southeast-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.50.17 (United States)

ASN16509 (AMAZON-02, US)

cyberark.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cyberark.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.174.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-174-94.nrt57.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.170.156 (United States)

ASN15169 (GOOGLE, US)
PTR: tc-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.43.90.114 (Singapore)

ASN29990 (ASN-APPNEX, US)
PTR: 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.55.8 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-200-55-8.deploy.static.akamaitechnologies.com

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.28.146.116 (United States)

ASN15224 (OMNITURE, US)

sjrtp6.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.196.100 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s35-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.220.99 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s30-in-f3.1e100.net

www.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

65 13.33.174.58 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-174-58.nrt57.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.196.130 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.33.33.145 (United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-33-33-145.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.82.7 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-nrt1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.50.9 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-50-9.nrt57.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.42.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f6.1e100.net

9920016.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.210.10.81 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-10-81.compute-1.amazonaws.com

tags.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.176.186.29 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-176-186-29.ap-northeast-1.compute.amazonaws.com

cnv.event.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.174.246.206 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-174-246-206.compute-1.amazonaws.com

cs.choozle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.44.52.187 (Tokyo, Japan) 2 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-44-52-187.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.42.162 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s46-in-f2.1e100.net

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.174.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-174-32.nrt57.r.cloudfront.net

cdn.linkedin.oribi.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.107.42.14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.138.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-138-44.nrt57.r.cloudfront.net

d1eoo1tco6rr5e.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.228.126.19 (Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-13-228-126-19.ap-southeast-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.158.64 (Singapore) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.42.130 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: nrt12s45-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 31.13.82.36 (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-nrt1.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.220.98 (United States)

ASN15169 (GOOGLE, US)
PTR: syd10s01-in-f98.1e100.net

adservice.google.co.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.147.21.139 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-147-21-139.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
65	driftt.com js.driftt.com — Cisco Umbrella Rank: 6585	756 KB
30	cyberark.com www.cyberark.com — Cisco Umbrella Rank: 462387	416 KB
28	cdntwrk.com content.cdntwrk.com — Cisco Umbrella Rank: 68686	3 MB
10	6sc.co j.6sc.co — Cisco Umbrella Rank: 6484 c.6sc.co — Cisco Umbrella Rank: 9628 ipv6.6sc.co — Cisco Umbrella Rank: 6605 b.6sc.co — Cisco Umbrella Rank: 4269	15 KB
10	adsrvr.org 10 redirects match.adsrvr.org — Cisco Umbrella Rank: 375 insight.adsrvr.org — Cisco Umbrella Rank: 592	6 KB
9	marketo.com sjrtp6-cdn.marketo.com — Cisco Umbrella Rank: 116616 rtp-static.marketo.com — Cisco Umbrella Rank: 18244 sjrtp6.marketo.com — Cisco Umbrella Rank: 103687	91 KB
9	uberflip.com cihost.uberflip.com — Cisco Umbrella Rank: 96576	323 KB
8	ml314.com 3 redirects ml314.com — Cisco Umbrella Rank: 1986 in.ml314.com — Cisco Umbrella Rank: 9992	13 KB
7	trustarc.com consent.trustarc.com — Cisco Umbrella Rank: 2977	117 KB
7	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 398	104 KB
6	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 124 googleads.g.doubleclick.net — Cisco Umbrella Rank: 57 9920016.fls.doubleclick.net cm.g.doubleclick.net — Cisco Umbrella Rank: 244	4 KB
6	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
6	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 218 cyberark.demdex.net — Cisco Umbrella Rank: 800224	8 KB
5	choozle.com 5 redirects cs.choozle.com — Cisco Umbrella Rank: 8968	3 KB
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 408 www.linkedin.com — Cisco Umbrella Rank: 563	4 KB
4	stackadapt.com tags.srv.stackadapt.com — Cisco Umbrella Rank: 3195	7 KB
4	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3081	12 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 82	146 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 80	181 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 263	137 KB
3	rlcdn.com 2 redirects idsync.rlcdn.com — Cisco Umbrella Rank: 426	921 B
3	google.co.jp www.google.co.jp — Cisco Umbrella Rank: 18644 adservice.google.co.jp — Cisco Umbrella Rank: 87800	1 KB
3	google.com www.google.com — Cisco Umbrella Rank: 3 adservice.google.com — Cisco Umbrella Rank: 107	1 KB
3	eyeota.net 2 redirects ps.eyeota.net — Cisco Umbrella Rank: 1137	2 KB
3	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 4000	7 KB
2	drift.com bootstrap.api.drift.com — Cisco Umbrella Rank: 7709 metrics.api.drift.com	713 B
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	235 B
2	yahoo.com 2 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 340	615 B
2	openx.net 2 redirects us-u.openx.net — Cisco Umbrella Rank: 492	665 B
2	bluekai.com 2 redirects tags.bluekai.com — Cisco Umbrella Rank: 653	851 B
2	bidr.io 1 redirects cnv.event.prod.bidr.io — Cisco Umbrella Rank: 9815	1 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 176	136 KB
2	licdn.com snap.licdn.com — Cisco Umbrella Rank: 960	6 KB
2	omtrdc.net cyberark.tt.omtrdc.net cyberark.sc.omtrdc.net — Cisco Umbrella Rank: 758610	1 KB
2	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 749 script.hotjar.com — Cisco Umbrella Rank: 1067	73 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net — Cisco Umbrella Rank: 948	864 B
2	gstatic.com fonts.gstatic.com	60 KB
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 381	915 B
1	cloudfront.net d1eoo1tco6rr5e.cloudfront.net	668 B
1	oribi.io cdn.linkedin.oribi.io — Cisco Umbrella Rank: 1027	376 B
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 476	574 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1590	637 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1106	517 B
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1426	8 KB
1	mktoresp.com 316-czp-275.mktoresp.com	318 B
238	45

	Domain	Requested by
65	js.driftt.com	www.cyberark.com js.driftt.com
30	www.cyberark.com	www.cyberark.com content.cdntwrk.com
28	content.cdntwrk.com	www.cyberark.com content.cdntwrk.com
9	cihost.uberflip.com	www.cyberark.com cihost.uberflip.com
8	match.adsrvr.org	8 redirects
7	consent.trustarc.com	www.cyberark.com consent.trustarc.com
7	ml314.com	3 redirects www.cyberark.com ml314.com
7	assets.adobedtm.com	www.cyberark.com assets.adobedtm.com
6	b.6sc.co	www.cyberark.com
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
5	cs.choozle.com	5 redirects
5	sjrtp6.marketo.com	sjrtp6-cdn.marketo.com rtp-static.marketo.com
5	dpm.demdex.net	2 redirects www.cyberark.com assets.adobedtm.com
4	tags.srv.stackadapt.com	www.cyberark.com tags.srv.stackadapt.com
4	nexus.ensighten.com	www.googletagmanager.com nexus.ensighten.com
4	www.googletagmanager.com	www.cyberark.com www.googletagmanager.com
4	fonts.googleapis.com	www.cyberark.com cihost.uberflip.com
4	cdnjs.cloudflare.com	www.cyberark.com cdnjs.cloudflare.com
3	px.ads.linkedin.com	2 redirects
3	idsync.rlcdn.com	2 redirects
3	rtp-static.marketo.com	sjrtp6-cdn.marketo.com
3	ps.eyeota.net	2 redirects www.cyberark.com
3	munchkin.marketo.net	www.cyberark.com munchkin.marketo.net
2	www.facebook.com
2	cm.g.doubleclick.net	1 redirects d1eoo1tco6rr5e.cloudfront.net
2	ups.analytics.yahoo.com	2 redirects
2	insight.adsrvr.org	2 redirects
2	us-u.openx.net	2 redirects
2	tags.bluekai.com	2 redirects
2	cnv.event.prod.bidr.io	1 redirects
2	9920016.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	connect.facebook.net	www.cyberark.com connect.facebook.net
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	www.google.co.jp	www.cyberark.com
2	www.google.com	www.cyberark.com
2	j.6sc.co	www.googletagmanager.com j.6sc.co
2	sync.crwdcntrl.net	2 redirects
2	fonts.gstatic.com	fonts.googleapis.com
1	metrics.api.drift.com	js.driftt.com
1	bootstrap.api.drift.com	js.driftt.com
1	adservice.google.co.jp	adservice.google.com
1	pixel.rubiconproject.com	1 redirects
1	d1eoo1tco6rr5e.cloudfront.net	nexus.ensighten.com
1	www.linkedin.com	1 redirects
1	cdn.linkedin.oribi.io	snap.licdn.com
1	adservice.google.com	9920016.fls.doubleclick.net
1	cyberark.sc.omtrdc.net	assets.adobedtm.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	ipv6.6sc.co	j.6sc.co
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	stats.g.doubleclick.net	www.google-analytics.com
1	alb.reddit.com	www.cyberark.com
1	script.hotjar.com	static.hotjar.com
1	cyberark.tt.omtrdc.net	assets.adobedtm.com
1	cm.everesttech.net	1 redirects
1	cyberark.demdex.net	assets.adobedtm.com
1	www.redditstatic.com	www.cyberark.com
1	static.hotjar.com	www.cyberark.com
1	sjrtp6-cdn.marketo.com	www.cyberark.com
1	316-czp-275.mktoresp.com	munchkin.marketo.net
1	in.ml314.com	ml314.com
238	62

This site contains links to these domains. Also see Links.

Domain
cyberark-customers.force.com
cyberark.com
labs.cyberark.com
careers.cyberark.com
www.conjur.org
docs.cyberark.com
www.facebook.com
twitter.com
www.linkedin.com
share.transistor.fm
lp.cyberark.com
investors.cyberark.com
www.youtube.com

Subject Issuer	Validity	Valid
www.cyberark.com Cloudflare Inc ECC CA-3	`2023-03-31` - `2024-03-29`	a year	crt.sh
content.cdntwrk.com Amazon RSA 2048 M01	`2022-10-24` - `2023-11-22`	a year	crt.sh
*.uberflip.com Amazon RSA 2048 M01	`2023-02-20` - `2023-08-03`	5 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-03` - `2023-08-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
ml314.com GTS CA 1D4	`2023-06-07` - `2023-09-05`	3 months	crt.sh
*.marketo.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.ml314.com Amazon RSA 2048 M01	`2023-02-07` - `2023-12-12`	10 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-05` - `2023-11-05`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
6sc.co R3	`2023-05-25` - `2023-08-23`	3 months	crt.sh
*.marketo.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-06` - `2024-02-05`	a year	crt.sh
*.hotjar.com Amazon ECDSA 256 M01	`2023-03-09` - `2024-04-06`	a year	crt.sh
*.trustarc.com Amazon RSA 2048 M02	`2023-04-17` - `2024-05-14`	a year	crt.sh
www.redditstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-12` - `2023-10-08`	6 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-19` - `2023-10-15`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.google.co.jp GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
drift.com Amazon RSA 2048 M02	`2023-03-01` - `2023-09-21`	7 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-02-01` - `2024-01-31`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-04-01` - `2023-06-30`	3 months	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
*.srv.stackadapt.com Amazon RSA 2048 M02	`2023-02-27` - `2023-11-07`	8 months	crt.sh
*.sc.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-03-08`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-05-22` - `2023-08-14`	3 months	crt.sh
linkedin.oribi.io Amazon RSA 2048 M01	`2023-06-08` - `2024-07-07`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Frame ID: 6FDDF7965DA7B4FDFADD2CF9686DFFB9
Requests: 164 HTTP requests in this frame

Frame: https://cyberark.demdex.net/dest5.html?d_nsid=0
Frame ID: 76748BE3C241EE8DDA3A7186AA9B761E
Requests: 1 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com
Frame ID: 0CF1049CAABD3E42A6FC4AECB0F1966E
Requests: 1 HTTP requests in this frame

Frame: https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Frame ID: 02634B20AE6F672D32E8C8669D15760D
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Frame ID: 4CBA75A97EA23ECF692CC4963EB071D4
Requests: 1 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Frame ID: 201E6AF48873FF94E3DBE41A442AE7C4
Requests: 2 HTTP requests in this frame

Frame: https://adservice.google.co.jp/ddm/fls/i/dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Frame ID: 874A0EFB11968B64E049A39DE3EB582A
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Frame ID: 3793EB4921B4D55C0A54FDA48DFF142C
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
Frame ID: E76E028B2D2190FA94B2018C46F4731C
Requests: 34 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 9E7E0E77B177676BACC20549F01B2D20
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Chatting Our Way Into Creating a Polymorphic Malware

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

238
Requests

96 %
HTTPS

0 %
IPv6

45
Domains

62
Subdomains

47
IPs

4
Countries

5856 kB
Transfer

11734 kB
Size

71
Cookies

41 Outgoing links

These are links going to different origins than the main page.

URL: https://cyberark-customers.force.com/mplace/s/
Title: Marketplace

Search URL Search Domain Scan URL

URL: https://cyberark.com/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://cyberark.com/careers/
Title: Careers

Search URL Search Domain Scan URL

URL: https://labs.cyberark.com/
Title: CyberArk Labs

Search URL Search Domain Scan URL

URL: https://careers.cyberark.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://www.conjur.org/
Title: Conjur Secrets Manager Open Source

Search URL Search Domain Scan URL

URL: https://cyberark-customers.force.com/s/
Title: Technical Community

Search URL Search Domain Scan URL

URL: https://docs.cyberark.com/
Title: Product Documentation

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&url=https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware&title=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&summary=Abstract%20ChatGPT%20took%20the%20world%20by%20storm%20being%20released%20less%20than%20two%20months%20ago,%20it%20has%20become%20prominent%20and%20is%20used%20everywhere,%20for%20a%20wide%20variety%20of%20tasks%20%E2%80%93%20from%20automation%20tasks%20to%20the...
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&via=CyberArk
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&title=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&summary=Abstract%20ChatGPT%20took%20the%20world%20by%20storm%20being%20released%20less%20than%20two%20months%20ago%2C%20it%20has%20become%20prominent%20and%20is%20used%20everywhere%2C%20for%20a%20wide%20variety%20of%20tasks%20%E2%80%93%20from%20automation%20tasks%20to%20the...
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://share.transistor.fm/s/7cab31ac
Title: Trust Issues podcast interview

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=Check%20out%20what%27s%20happening%20at%20CyberArk%21&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2F&via=CyberArk
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2F&title=English%20%E2%80%93%20CyberArk%20Software%20Inc%27s&summary=Check%20out%20what%27s%20happening%20at%20CyberArk%21
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://lp.cyberark.com/Stay-in-touch.html
Title: Tell Me How

Search URL Search Domain Scan URL

URL: https://cyberark.com/services-support/contact-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://cyberark.com/services-support/professional-services/training-certification/
Title: Training & Certification

Search URL Search Domain Scan URL

URL: https://cyberark.com/customer-support/
Title: Customer Support

Search URL Search Domain Scan URL

URL: https://cyberark.com/products/privileged-account-security-solution/endpoint-privilege-manager/endpoint-privilege-manager-software-service/
Title: EPM SaaS Register / Login

Search URL Search Domain Scan URL

URL: https://cyberark.com/product-security/
Title: Product Security

Search URL Search Domain Scan URL

URL: https://cyberark.com/resources
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://cyberark.com/blueprint/
Title: CyberArk Blueprint

Search URL Search Domain Scan URL

URL: https://cyberark.com/discover-privileged-accounts-exist-cyberark-dna/
Title: Scan Your Network

Search URL Search Domain Scan URL

URL: https://cyberark-customers.force.com/partner/s/login/
Title: Partner Community

Search URL Search Domain Scan URL

URL: https://cyberark.com/partner-finder/
Title: Partner Finder

Search URL Search Domain Scan URL

URL: https://cyberark.com/partners/alliance-partners/
Title: Alliance Partner

Search URL Search Domain Scan URL

URL: https://investors.cyberark.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/management-team/
Title: Management Team

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/board-of-directors/
Title: Board of Directors

Search URL Search Domain Scan URL

URL: https://cyberark.com/newsroom/
Title: Newsroom

Search URL Search Domain Scan URL

URL: https://cyberark.com/company/#office-locations
Title: Office Locations

Search URL Search Domain Scan URL

URL: https://twitter.com/CyberArk

Search URL Search Domain Scan URL

URL: https://www.facebook.com/CyberArk

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/cyber-ark-software

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/cyberarksoftware

Search URL Search Domain Scan URL

URL: https://cyberark.com/terms-conditions/
Title: Terms and Conditions

Search URL Search Domain Scan URL

URL: https://cyberark.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 84

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3636573452440698880&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3636573452440698880&redir=

Request Chain 85

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent= HTTP 302
https://ml314.com/csync.ashx?fp=96f50d30-c297-4c94-9993-08e5b51e832d&person_id=3636573452440698880&eid=53819

Request Chain 86

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3636573452440698880 HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3636573452440698880 HTTP 302
https://ml314.com/csync.ashx?fp=400dc49b75022846349e2da2cc2fd8da&eid=50146&person_id=3636573452440698880

Request Chain 87

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2BnCWxf7wX-GD_duWsOk8o0_HfbaaAeviK3FpPn76qNU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
https://ml314.com/csync.ashx?fp=2BnCWxf7wX-GD_duWsOk8o0_HfbaaAeviK3FpPn76qNU&person_id=3636573452440698880&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referrer_pid%3dr8hrb20 HTTP 302
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

Request Chain 103

https://cm.everesttech.net/cm/dd?d_uuid=58286644819232201762838274099520942256 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJSRmgAAAHHfcwN1

Request Chain 135

https://9920016.fls.doubleclick.net/activityi;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware HTTP 302
https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Request Chain 137

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER] HTTP 303
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

Request Chain 146

https://cs.choozle.com/dp/chz/24646?d=www.cyberark.com&cb=773987549 HTTP 302
https://cs.choozle.com/sync HTTP 302
https://cs.choozle.com/sync?v=true&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89 HTTP 302
https://tags.bluekai.com/site/48443?id=7e65acbd-5a84-49fa-a0fc-8583e0235a89&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3D7e65acbd-5a84-49fa-a0fc-8583e0235a89 HTTP 302
https://cs.choozle.com/sync?pid=$_BK_UUID&dpsync=bk&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89 HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_puid=7e65acbd-5a84-49fa-a0fc-8583e0235a89&ttd_pid=gdmv7qs&ttd_tpi=1 HTTP 302
https://cs.choozle.com/sync?pid=96f50d30-c297-4c94-9993-08e5b51e832d&dpsync=ttd&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89 HTTP 302
https://idsync.rlcdn.com/459489.gif?partner_uid=7e65acbd-5a84-49fa-a0fc-8583e0235a89 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJDdlNjVhY2JkLTVhODQtNDlmYS1hMGZjLTg1ODNlMDIzNWE4ORAAGg0In6PSpAYSBQjoBxAAQgBKAA HTTP 307
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D HTTP 302
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=83b270cf-06ba-4a4b-8edf-86412513faad

Request Chain 151

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cookiesTest=true HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1687458205674%26url%3Dhttps%253A%252F%252Fwww.cyberark.com%252Fresources%252Fthreat-research-blog%252Fchatting-our-way-into-creating-a-polymorphic-malware%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cookiesTest=true&liSync=true

Request Chain 154

https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe HTTP 303
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

Request Chain 157

https://insight.adsrvr.org/track/pxl/?adv=0v1kpom&ct=0:u9beit9&fmt=3 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=96f50d30-c297-4c94-9993-08e5b51e832d&_origin=1&redir=true&gdpr=0&gdpr_consent= HTTP 302
https://ups.analytics.yahoo.com/ups/55953/sync?uid=96f50d30-c297-4c94-9993-08e5b51e832d&_origin=1&redir=true&gdpr=0&gdpr_consent=&verify=true HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-pMPMZrRE2uIGR4439hVMgjkvd8vw0bo-~A&gdpr=0 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
https://tags.bluekai.com/site/5386?id=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai HTTP 302
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d HTTP 302
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d&google_gid=CAESEMqinPYUDW9SnVOcBWeUqy0&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d

238 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request chatting-our-way-into-creating-a-polymorphic-malware Show response
www.cyberark.com/resources/threat-research-blog/ 285 KB
54 KB 460ms
375ms Document
text/html 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49fea9c50e35f8cc13649bd4c5f20237481289792d127d4691457776c63e8064

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

cf-cache-status: DYNAMIC
cf-ray: 7db685986b6fafe7-NRT
content-encoding: gzip
content-language: en
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/;
content-type: text/html; charset=UTF-8
date: Thu, 22 Jun 2023 18:23:20 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
referrer-policy: unsafe-url
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 lato.css
content.cdntwrk.com/css/google-fonts/ 6 KB
961 B 105ms
27ms Stylesheet
text/css 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/css/google-fonts/lato.css?v=075928935a99
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 00:22:58 GMT
content-encoding: gzip
via: 1.1 1f847795211a5a70895179ec7900ecf4.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C3
age: 260107
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 27 Apr 2023 19:31:57 GMT
server: AmazonS3
etag: W/"37291223d8c6a87c6435a8740e28f134"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: -O3YGnkikSgd_c_QHntvZWe2E4NzWBtrxmhsXIVya-D7RJ24GYLlww==

GET
H2 200 hubs.d67c3a950547b2eda292.css
content.cdntwrk.com/css/hubs/ 262 KB
44 KB 105ms
28ms Stylesheet
text/css 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/css/hubs/hubs.d67c3a950547b2eda292.css
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 179d0300a0006e7947f938a609866e0c4754f53e38e227ceff0386f80fd36434

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 18:06:19 GMT
content-encoding: gzip
via: 1.1 1f847795211a5a70895179ec7900ecf4.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C3
age: 173822
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jun 2023 17:59:42 GMT
server: AmazonS3
etag: W/"da3f316b4721c1b3fb1ee994bc967b15"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: jwEy4kmvwH5ErNKpDtLLsYI3ttUMgaYgYT4M_-722TSlI4nT4YMKzA==

GET
H2 200 en.css
cihost.uberflip.com/cyberArk/master/build/en/ 512 KB
76 KB 519ms
38ms Stylesheet
text/css 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 918e8441bee23ad58f7206b828f06c95a47a8e3ba6ae2e29b6483c610e06e470

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 03:43:54 GMT
content-encoding: gzip
via: 1.1 e5907f334714433599a0e1b9c57f44d6.cloudfront.net (CloudFront)
last-modified: Mon, 10 Apr 2023 14:03:49 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1681135423/ctime:1681135423/gid:123/gname:docker/md5:a4014bd22c32ffc9c3ddcdb8fd230299/mode:33188/mtime:1681135423/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
age: 52768
etag: W/"a4014bd22c32ffc9c3ddcdb8fd230299"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
x-amz-cf-id: QWflSXnl-iO9j2qI5c36eFFPRbCTyF6zjVtuFG2W_fOcWNIA8ZOIEw==

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/ 46 KB
9 KB 415ms
38ms Stylesheet
text/css 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1382157
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8281
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-b752"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VOYX734G4JB%2BYaIMuUbv2ak9PPhG%2FjasIC4f%2FCFLlCr1qav4m9mUnDnSYv34hrIiMqn%2BMsanT2xy%2BUBHevAAcBSYDRNQ79Hw0K13zZRwNdBqJ3St0xhsnWeNUur1Buh8TJ7R%2FVR2"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7db6859d2a218a69-NRT
expires: Tue, 11 Jun 2024 18:23:21 GMT

GET
H2 200 css
fonts.googleapis.com/ 6 KB
766 B 478ms
74ms Stylesheet
text/css 172.217.175.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400&display=swap

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f10.1e100.net

Software

ESF /

Resource Hash

b0b6da5eebb0023cddb0d5fa35708f6f44bd8e3661da0ea0dfa79b00f3e9229f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 18:23:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Jun 2023 18:23:21 GMT

GET
H2 200 enlighterjs.min.css
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 78 KB
9 KB 41ms
38ms Stylesheet
text/css 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.css?ver=5.4.2

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 31 Aug 2020 16:20:25 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30229030
etag: W/"5f4d2349-13634"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859acc7eafe7-NRT
expires: Fri, 21 Jun 2024 18:23:20 GMT

GET
H2 200 enlighterjs.min.js Show response
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 57 KB
17 KB 42ms
39ms Script
application/javascript 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.js?ver=5.4.2

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Mon, 31 Aug 2020 16:20:25 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 570607
etag: W/"5f4d2349-e307"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859acc80afe7-NRT
expires: Fri, 21 Jun 2024 18:23:20 GMT

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
1009 B 475ms
72ms Stylesheet
text/css 172.217.175.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Mono&display=swap

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f10.1e100.net

Software

ESF /

Resource Hash

e602984a721696845784c79ebc0f223e15c24d446fd59b314cbf1f2b4f300e96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 18:23:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Jun 2023 18:23:21 GMT

GET
H2 200 launch-e8e6adf0fe30.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/ 298 KB
88 KB 574ms
36ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ab18bf1a95e663a02efb06d340273f20f21316e497746c2c69344267c56f3f7c

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
last-modified: Fri, 16 Jun 2023 15:11:16 GMT
server: AkamaiNetStorage
etag: "9f818cb0931af7ac63f2da375f6d252e:1686928276.611372"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 89648
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H2 200 logo.svg
cihost.uberflip.com/cyberArk/OB-8671/build/assets/ 14 KB
5 KB 44ms
31ms Image
image/svg+xml 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberArk/OB-8671/build/assets/logo.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 952f35790a58d6c58cd01db0b7994f8b1e3f2d4328f8dd2ed423c01579d403c6

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 10:22:33 GMT
content-encoding: gzip
via: 1.1 e5907f334714433599a0e1b9c57f44d6.cloudfront.net (CloudFront)
last-modified: Mon, 12 Dec 2022 14:33:49 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1670855619/ctime:1670855619/gid:123/gname:docker/md5:f86c6ef84b83b048b2a5521fb36ab761/mode:33188/mtime:1670855619/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
age: 28849
x-amz-server-side-encryption: AES256
etag: W/"f86c6ef84b83b048b2a5521fb36ab761"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: 45DYsgRWwJbv_VlY6-wcO2PF7RD_M91KmpWX_TGXnGx_FR5Sy3nWFQ==

GET
H2 200 WhyCA_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 25 KB
26 KB 66ms
54ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/WhyCA_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b96b944dbdb9c2afcdecae184e3bdc4717c30dc4f5d4624cfd1727461d6569fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 30229483
cf-polished: origFmt=png, origSize=39669
content-disposition: inline; filename="WhyCA_Menu-LeftHandCallOut.webp"
content-length: 25958
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:17:47 GMT
server: cloudflare
etag: "6019b36b-9af5"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db6859f4ebcafe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Assets-Icons-Industries-Medical.png
www.cyberark.com/wp-content/uploads/2020/12/ 362 B
591 B 66ms
55ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Assets-Icons-Industries-Medical.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e6098f9e4e64f667bc006876813632d5ac79ac56e5284a95c9c821870907cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 30229483
cf-polished: origFmt=png, origSize=997
content-disposition: inline; filename="Assets-Icons-Industries-Medical.webp"
content-length: 362
cf-bgj: imgq:85,h2pri
last-modified: Wed, 23 Dec 2020 22:10:13 GMT
server: cloudflare
etag: "5fe3c045-3e5"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db6859f4ebdafe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Products_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 15 KB
18 KB 61ms
49ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/Products_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08330120c6d9d4407fd599bae49187289878c557ed68e58d0e091fd5e1ac6c7f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1799926
cf-polished: origFmt=png, origSize=22261
content-disposition: inline; filename="Products_Menu-LeftHandCallOut.webp"
content-length: 15210
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:10:12 GMT
server: cloudflare
etag: "6019b1a4-56f5"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db6859f4ebeafe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Privilege.svg
www.cyberark.com/wp-content/uploads//2021/02/ 3 KB
1 KB 75ms
63ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/Privilege.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b0e7a4bdf115afb8e8c5b9b671b0dc4441236f8cf56906d146b7d46a0ee14a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 20:54:15 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 21760726
etag: W/"6019bbf7-c52"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ebfafe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Access.svg
www.cyberark.com/wp-content/uploads//2021/02/ 5 KB
2 KB 74ms
63ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/Access.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8e7fd76994e9fe7f19af8a2234efc259debc6e67de4ae8bf2f0e7471132bd02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:31:38 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 846831
etag: W/"6019c4ba-12ba"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec0afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 DevSecOps.svg
www.cyberark.com/wp-content/uploads//2021/02/ 6 KB
2 KB 65ms
54ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/DevSecOps.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91b7152c2708e116677591b018f23ed2910c747e932f8985b704f1884d807990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:31:31 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30229483
etag: W/"6019c4b3-185c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec1afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 finance.svg
www.cyberark.com/wp-content/uploads//2021/02/ 7 KB
3 KB 64ms
53ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/finance.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

234f5e6b36c41a209c87e64949d11927b6360603b94ce3511c53df5bac0f4c26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:33:34 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30229483
etag: W/"6019c52e-1a41"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec2afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 insurance.svg
www.cyberark.com/wp-content/uploads//2021/02/ 3 KB
1 KB 66ms
55ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/insurance.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e70999bd0ed2afbb2967ca63898c752fc3e66ba8a86a4ac341723be85bb7319

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:34:37 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2400044
etag: W/"6019c56d-c9f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec3afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 healthcare.svg
www.cyberark.com/wp-content/uploads//2021/02/ 4 KB
2 KB 66ms
55ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/healthcare.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a654dbffdb656aacce15df139a6d2701ccae809fe7baab1ec042714bb6336eb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:34:01 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30229483
etag: W/"6019c549-10bb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec4afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 government.svg
www.cyberark.com/wp-content/uploads//2021/02/ 2 KB
1 KB 73ms
62ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads//2021/02/government.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

634358d77171f485bb1738fce1bf1e715e2cd0a94b2c4f3d5c6dafccd0d1031a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 02 Feb 2021 21:34:22 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 24922362
etag: W/"6019c55e-881"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec5afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Nav-Image-ServicesSupport-e1609108892195.png
www.cyberark.com/wp-content/uploads/2020/12/ 21 KB
21 KB 69ms
58ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Nav-Image-ServicesSupport-e1609108892195.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0637a5486005822934814400cc9f0989ead659268f2add3521f63f1b49876913

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 25450164
cf-polished: origFmt=png, origSize=36292
content-disposition: inline; filename="Nav-Image-ServicesSupport-e1609108892195.webp"
content-length: 21468
cf-bgj: imgq:85,h2pri
last-modified: Sun, 27 Dec 2020 22:41:32 GMT
server: cloudflare
etag: "5fe90d9c-8dc4"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db6859f4ec6afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 TryBuy_Menu-LeftHandCallOut.png
www.cyberark.com/wp-content/uploads/2021/02/ 26 KB
29 KB 68ms
57ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/02/TryBuy_Menu-LeftHandCallOut.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8aab45b2e3226eb83ceed37f3f622529d0a6ca0a82d8dd9a4d1fb8e46ba84f83

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 2410106
cf-polished: origFmt=png, origSize=39090
content-disposition: inline; filename="TryBuy_Menu-LeftHandCallOut.webp"
content-length: 26540
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Tue, 02 Feb 2021 20:19:11 GMT
server: cloudflare
etag: "6019b3bf-98b2"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db6859f4ec7afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Icons-Globe@2x.png
www.cyberark.com/wp-content/uploads/2020/12/ 456 B
619 B 64ms
53ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2020/12/Icons-Globe@2x.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

45aca110620ac12009925cac1e38aa4e71426a2b83ee7f356010069b45539d56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 17527715
cf-polished: origFmt=png, origSize=1147
content-disposition: inline; filename="Icons-Globe@2x.webp"
content-length: 456
cf-bgj: imgq:85,h2pri
last-modified: Wed, 30 Dec 2020 23:04:11 GMT
server: cloudflare
etag: "5fed076b-47b"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 7db6859f4ec8afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H3 200 ajax-loader-white-2x.gif
content.cdntwrk.com/img/hubs/ 3 KB
3 KB 60ms
53ms Image
image/gif 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/ajax-loader-white-2x.gif?v=19a554b579c4
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 17:56:15 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
age: 433627
x-amz-cf-pop: NRT57-C3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 2707
last-modified: Thu, 15 Jun 2023 16:01:07 GMT
server: AmazonS3
etag: "5217392f882b27d35ec2e72946f2df7e"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/gif
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: Ey_kyG_AcEbCZeS0XTLMRPqsNlk-fczQ1OZhRb241wbEnyAB07us1g==

GET
H3 200 chevron-down-64x64.png
content.cdntwrk.com/img/hubs/ 760 B
1 KB 69ms
62ms Image
image/png 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/chevron-down-64x64.png?v=78668873251b
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 17:56:16 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
age: 433626
x-amz-cf-pop: NRT57-C3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 760
last-modified: Thu, 15 Jun 2023 16:01:07 GMT
server: AmazonS3
etag: "26818bdf0706c780af4a52b44ea17fdc"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: lXVzEFDWHH1_R_-VkmHc7xrd61WWFCv_BfQF9bjrmzXwB5uVNtO02w==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 298 KB
98 KB 662ms
97ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

04a94e1aab3f32c23113cdd44e704af7b760c119572a86e921e4065562fb222f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99412
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Jun 2023 18:23:22 GMT

GET
H3 200 mediaproxy
content.cdntwrk.com/ 208 KB
208 KB 69ms
62ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F01%2Fhero-tr-digital-world-map.jpg&size=1&version=1683738229&sig=3e7a9d80e0704d415b9cdbcd1facc882&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: b658635cd3cbb7f049ecc5f7d5fa35af6933525db79ee7843e2c75ebe186c3a3

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 26 May 2023 02:18:36 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Fri, 26 May 2023 02:18:27 GMT
age: 2390684
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="hero-tr-digital-world-map.webp"
alt-svc: h3=":443"; ma=86400
content-length: 212842
x-amz-cf-id: 1Jm3ZfTdv-4b2LVUj-ucXDH1jou_HSh0JZte4QKwPOZO35cXO6O0Ew==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 112 KB
112 KB 116ms
109ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F12%2Fthreat-research-blog-hero.jpeg&size=1&version=1683738216&sig=677f43b759df1dcd92e3d6f1e9352a7e&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 564e0b056a4f799d5d6cf7a396c73abe01ce72446945b38faa0a2df6370adffd

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 18 Jun 2023 15:09:16 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 18 Jun 2023 15:09:07 GMT
age: 357244
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-blog-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 114836
x-amz-cf-id: CngRixbZGv6a2jxiHBFgEZf3sMluHXuIrYrWs2KaSCatnspSoY5ecw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 144 KB
145 KB 70ms
63ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F05%2Fhow-to-write-a-poc-for-an-uninitialized-heade-image.jpg&size=1&version=1684174986&sig=46d5a23397f3bf5f04c01ec382814547&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 8242e73795aa5b9757183fc6b9969c3e9a898f2e8f1e4d224d2bf9c982054e73

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 28 May 2023 08:29:27 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 28 May 2023 08:29:17 GMT
age: 2195634
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="how-to-write-a-poc-for-an-uninitialized-heade-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 147774
x-amz-cf-id: NM-oxoRmVd5RwOmhUGlhsXPfpWGdYP6p7veL67MWgJqS18SB33lEWQ==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 137 KB
138 KB 70ms
63ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fwhite-pheonix-blog.png&size=1&version=1683552188&sig=2aa5057c0f72373f10e0a61733c97e78&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: c48e0d3f95034cda3ba46d64e2a0b9b588b9d567fa498c1ac7887a6ddd40b7a7

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 28 May 2023 08:29:27 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 28 May 2023 08:29:18 GMT
age: 2195633
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="white-pheonix-blog.webp"
alt-svc: h3=":443"; ma=86400
content-length: 140518
x-amz-cf-id: De8esTC3gb6Lmon5bSya9WHfSFBITYkL5NuWAypWytyk8aHsd1gnjw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 66 KB
67 KB 69ms
62ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F05%2Ffantastic-rootkits-pt-2_header-image.png&size=1&version=1683552175&sig=f997830d148d4528d849228bd5baf047&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 1e20c277f9215eea696595f6dbb57825b4a7f87cddfec2f565379bf742252ecb

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 21 May 2023 03:33:52 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 21 May 2023 03:33:42 GMT
age: 2818169
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="fantastic-rootkits-pt-2_header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 68084
x-amz-cf-id: fhO9rsCbYGSVjL-u170dUdoPd6Ki3fF4DiM-UmCPbLpz4GkGMfoJpg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 224 KB
225 KB 68ms
61ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fbreaking-docker-header-image.png&size=1&version=1683738256&sig=f5613159e26de60a642bf10ef1528964&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 027ca73659dab51fe9987fd4d19b9eedd940202da076fec561dab2b297dfa820

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 28 May 2023 08:29:27 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 28 May 2023 08:29:17 GMT
age: 2195634
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="breaking-docker-header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 229772
x-amz-cf-id: aJM3UHlOGD8uWfeNXRYx_1dDk1Uks6Ry9Kc9r7HVki3h8BjpZiiZxg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 149 KB
149 KB 69ms
62ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F04%2Fheader-image-.png&size=1&version=1683738254&sig=a46b9af764031fa7a116226801aa269c&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 7be1b3df507b34b7d05c60510836564455b0f85be0871e96e48201e4947d4cfd

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 28 May 2023 08:29:27 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 28 May 2023 08:29:17 GMT
age: 2195634
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="header-image-.webp"
alt-svc: h3=":443"; ma=86400
content-length: 152128
x-amz-cf-id: 0j54uNSLT-SCTd-unq_EprJnxsUi9BTRsMU7S6imroW_E6BrNFBUvA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 245 KB
246 KB 68ms
62ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Fpersistence-header-image.jpg&size=1&version=1683738244&sig=d64aa8345dc0d04b607965263e15c4ee&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: ab342cf55dbb1241ef27cc92303a4266de2f8ec5734d4f7f97285c8562079ab9

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 10 May 2023 17:43:38 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Wed, 10 May 2023 17:43:29 GMT
age: 3717582
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="persistence-header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 251184
x-amz-cf-id: aLlqTd-Ju6fvTXb0nWD0EOqDcoTulZAzkbAm2gtANmvZsuBRQpbtvg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 92 KB
92 KB 113ms
106ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Ftr-phishing-service-hero.jpg&size=1&version=1683738240&sig=824efa6b6cf7a03e5537fc567ba38e44&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: c1457d6417251decf61b55c38e54c05f42f0d3855d31dbf51699728b2131aefd

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 03:15:37 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 25 May 2023 03:15:28 GMT
age: 2473663
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="tr-phishing-service-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 94086
x-amz-cf-id: Ol5ZHhrVCTuJyl8HtRP9Pz02Z94qtxpSnCR7el2HNI4YXfA_3TnovA==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 91 KB
92 KB 113ms
106ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Flinux-kernel-hero.png&size=1&version=1683738235&sig=78cbecc2e4b109fd5eaf14eea5ac3117&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 8642675885c3a57a6673d673550ef1b5cb983e7b8232e00cf7d804cbe6a1f034

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 18 May 2023 09:15:17 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 09:15:07 GMT
age: 3056884
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="linux-kernel-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 93428
x-amz-cf-id: eIO73cO5n3RPN9Kb7m_1EPHswF7Ic4fbPUUa98BeNCDsyF6rOe8Txg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 201 KB
202 KB 142ms
136ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2023%2F02%2Fdocker-desktop-privilege-escalation-1.jpg&size=1&version=1683738234&sig=67e14639d00684bcfcfe06204a155c22&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 6f756350e67238ef627d83acd8c4697791eaade9b8304e92f0b0b611920a7fde

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 18 May 2023 09:15:17 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 09:15:07 GMT
age: 3056884
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="docker-desktop-privilege-escalation-1.webp"
alt-svc: h3=":443"; ma=86400
content-length: 206302
x-amz-cf-id: pWI4hmgtj3Ny6mJ2SDV_4yPCn4kR2okMI4qPRsEPBXC0l3H57rUsyg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 196 KB
196 KB 143ms
136ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F12%2Fthreat-research-hero.jpeg&size=1&version=1683738215&sig=2b48ecf6ee2b28409921d72f8ae45be0&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 86e8b37fa004ddf5f2a20b33ffec6905866feb64aae71c065524e17fd5687f38

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 13 May 2023 07:05:07 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sat, 13 May 2023 07:04:57 GMT
age: 3496694
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 200412
x-amz-cf-id: 6JfX04z5UvggEgpXPbQfIXBU6zGBz_kAzKY-HtLq8SWAdwm509yPEg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 158 KB
158 KB 143ms
136ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F11%2Fthreat-research-hero.jpg&size=1&version=1683738205&sig=9cd57162c9d0829fc4a044cbe3fc9e58&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 81fec7f3b05845b84693ea9276af560503f9cdaae9735e2555944dd0a05491c1

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 23 May 2023 22:44:55 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Tue, 23 May 2023 22:44:46 GMT
age: 2576305
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="threat-research-hero.webp"
alt-svc: h3=":443"; ma=86400
content-length: 161636
x-amz-cf-id: 3X3TIfaRH6uXz1xdTYlH1rAc_cYMkk6vM2jol_s0QwtoVmLGZFlMvw==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 115 KB
115 KB 115ms
108ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F10%2FDragon-hero-trb.jpg&size=1&version=1683738194&sig=6c0de33d0ce0966f95a0bc3429012d2c&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: f8b0b2313c3727465a282de3aab6d15c25105042b60dbdb1bea029872f6dcbe7

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 03:15:38 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 25 May 2023 03:15:28 GMT
age: 2473663
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="Dragon-hero-trb.webp"
alt-svc: h3=":443"; ma=86400
content-length: 117770
x-amz-cf-id: aLKhprX_fpsE6AyVf7TZxbgNRtQ9LUbgZwgjSeascfocGk3xliaaag==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 88 KB
89 KB 112ms
106ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F09%2FAdobeStock_191432286.jpeg&size=1&version=1683738186&sig=1f6e1b927c78c6e97e0c165c4549b80a&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 0402955fd97b3d37addd83e8075bcfe5d43af7f042135aebf2efc346d1c51c93

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 13 May 2023 07:05:07 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sat, 13 May 2023 07:04:58 GMT
age: 3496693
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="AdobeStock_191432286.webp"
alt-svc: h3=":443"; ma=86400
content-length: 90452
x-amz-cf-id: z3wlD6NPhIpNVInhhOqXr5BZS8oo7b175aXM7WwkUxLtK85ZppZ_gg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 141 KB
141 KB 113ms
106ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F08%2Fcontainer.jpeg&size=1&version=1683738183&sig=92fcc576ed763c5ea1292f728303d91d&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: a5ad2caf35eef00ae4a78ea6797ae578750f35091efeca81d22443a49c5ea56b

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 18 Jun 2023 15:09:16 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 18 Jun 2023 15:09:07 GMT
age: 357244
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="container.webp"
alt-svc: h3=":443"; ma=86400
content-length: 144212
x-amz-cf-id: SCWs--81wlynfoQRg8eA64Ytd_836oS4af9inf0OHpl94xX5OI8bgg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 64 KB
64 KB 113ms
107ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F08%2Fhero-blog.jpeg&size=1&version=1683738178&sig=3a56c02646b035290c48f50f794fab58&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 134bcd1f63fe5b666d4334165aec62a186f7ae6ee6b0960f094710d8cbf4abf5

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 12:54:19 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Wed, 31 May 2023 12:54:10 GMT
age: 1920541
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="hero-blog.webp"
alt-svc: h3=":443"; ma=86400
content-length: 65712
x-amz-cf-id: nwdX6zncGu1ItVADWzXdp7CFlvaSFMn2rKev6nuO45BsuloZtBAmag==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 156 KB
157 KB 114ms
107ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F07%2Floader.jpeg&size=1&version=1683738170&sig=91c5d9b1dee1b87b0615c175a4480585&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 03504b3dc97cbaa6908c120175bdfcd4733778e9dc68031dadfbdb71e7dd35c7

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 21 May 2023 23:25:02 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Sun, 21 May 2023 23:24:53 GMT
age: 2746698
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="loader.webp"
alt-svc: h3=":443"; ma=86400
content-length: 160160
x-amz-cf-id: frMHl6C3nh8dNog5HNgQXYw9rhzD67qDmE0MWPrU0BZQo6KH9al95w==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 38 KB
38 KB 113ms
106ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F06%2Fdrain-pipe.jpeg&size=1&version=1683738156&sig=3578a80bb359e7850492f4e61cd2593d&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 17decb51bb1e2f60bc68a83ac67dcd2fbc509a13a70e0f3770358d9735f8d798

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 18 May 2023 09:15:17 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 09:15:08 GMT
age: 3056883
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="drain-pipe.webp"
alt-svc: h3=":443"; ma=86400
content-length: 38418
x-amz-cf-id: Amz8SqQokAKQkjnQX_wFUYaRXI64cu_n4rZtmOczOtZedcwvaZViGg==

GET
H3 200 mediaproxy
content.cdntwrk.com/ 62 KB
62 KB 113ms
107ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2022%2F05%2FBlue-1-header-image.png&size=1&version=1683738152&sig=918c532f9068557312f984c96942cca7&default=hubs%2Ftilebg-blogs.jpg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: f0d931b606c7b29b14d3521b9c85a9fbc153dac60f281e17689a5dfcf7b4bd19

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 18 May 2023 21:55:54 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 18 May 2023 21:55:44 GMT
age: 3011247
x-amz-cf-pop: NRT57-C3
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=1234567890
content-disposition: inline; filename="Blue-1-header-image.webp"
alt-svc: h3=":443"; ma=86400
content-length: 62982
x-amz-cf-id: 3B7LPfcBvRAQQ1n7_ER85cVc_0pVsFTmY32loaxPFdWGK7ITN0bN1A==

GET
H2 200 email-decode.min.js Show response
www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
814 B 23ms
23ms Script
application/javascript 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Thu, 15 Jun 2023 10:17:37 GMT
server: cloudflare
content-encoding: gzip
etag: W/"648ae541-4d7"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 7db6859dcdcdafe7-NRT
expires: Sat, 24 Jun 2023 18:23:21 GMT

GET
H2 200 hubs_app.d67c3a950547b2eda292.js Show response
content.cdntwrk.com/js/hubs/ 1 MB
311 KB 44ms
43ms Script
application/javascript 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f610bd2d3bd83b9efe982a5da2bf69ef23f954b90d608e428843b7ae481230e

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 18:06:20 GMT
content-encoding: gzip
via: 1.1 1f847795211a5a70895179ec7900ecf4.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C3
age: 173822
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jun 2023 17:59:53 GMT
server: AmazonS3
etag: W/"e07be320838cae13e777d3dff2f97e2e"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
vary: Accept-Encoding
x-amz-cf-id: jbFYAbBit4j7NYwYmQs6PSVPFERjt5QgFvLdsqGmzLIdIpLHKmvhuA==

GET
H2 200 en.bundle.js Show response
cihost.uberflip.com/cyberArk/master/build/en/ 295 KB
85 KB 34ms
33ms Script
text/javascript 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b09954ca25611278f310028fc7cff15ad906fd08cec78c6486978cb4f696a5bf

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 09:08:43 GMT
content-encoding: gzip
via: 1.1 e5907f334714433599a0e1b9c57f44d6.cloudfront.net (CloudFront)
last-modified: Thu, 22 Jun 2023 07:46:35 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1687419990/ctime:1687419990/gid:123/gname:docker/md5:acfaa0ecce4b200a45ca5fc2fe3a4a56/mode:33188/mtime:1687419990/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
age: 33279
etag: W/"acfaa0ecce4b200a45ca5fc2fe3a4a56"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
x-amz-cf-id: wKjODqDSTBlQ-nScsXuxHWpb5FDX9hA64dqjhgP-318P7A9Jp01oEg==

GET
H2 200 sha256.min.js Show response
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 9 KB
4 KB 794ms
77ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2422654
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 2977
last-modified: Mon, 04 May 2020 16:11:50 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec6-2339"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IVtvZzt9rAoqBH1zJpDesH83W1Dh%2FTAbRnWCsKxRk9VB9CkSc7cl7JxIJahxu7QcyIv%2BQYHO4Nwxuz1ynI4Pn%2FxteMSNwv4Jad9jc1Er074drSPVq%2FBZ3W0FifGtFQIX5AT94Y6s"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7db685a39c0a3bff-NRT
expires: Tue, 11 Jun 2024 18:23:22 GMT

GET
H2 200 External.svg
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/ 2 KB
1 KB 47ms
41ms Image
image/svg+xml 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/External.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 49bdaf43b043fdd5e79f321a889502b341e83fb3d71caa9ec286369bcb205373

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 00:59:23 GMT
content-encoding: gzip
via: 1.1 e5907f334714433599a0e1b9c57f44d6.cloudfront.net (CloudFront)
last-modified: Fri, 29 Jan 2021 17:35:02 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611941654/ctime:1611941654/gid:117/gname:docker/md5:cd7c2cec63b67d7f1108cb091b478569/mode:33188/mtime:1611941654/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
age: 62639
etag: W/"cd7c2cec63b67d7f1108cb091b478569"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-amz-cf-id: sY3ks9UBX_PPX9h9pnyoMw-0wPe8l7jR2LZTDgGEeveMFskOnpoKUg==

GET
H2 200 External-darkblue.svg
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/ 952 B
1 KB 47ms
40ms Image
image/svg+xml 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/images/External-darkblue.svg
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 10:18:43 GMT
via: 1.1 e5907f334714433599a0e1b9c57f44d6.cloudfront.net (CloudFront)
last-modified: Fri, 29 Jan 2021 20:02:50 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611950517/ctime:1611950517/gid:117/gname:docker/md5:98bf2668c3bae975ce6b211e1acc322f/mode:33188/mtime:1611950517/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
age: 29079
etag: "98bf2668c3bae975ce6b211e1acc322f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
accept-ranges: bytes
content-length: 952
x-amz-cf-id: _Uuy91ylwfSKvS2njnRf_q7b0oA71RujGAVSPoAWdrxyB-aVmVFSlw==

GET
H2 200 cyberark-logo-dark.svg
www.cyberark.com/wp-content/uploads/2021/01/ 4 KB
2 KB 68ms
62ms Image
image/svg+xml 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2021/01/cyberark-logo-dark.svg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67e2f25233ffe02ea0a70301e7440e6371d8943ca3f759b1d128b590e7e9419b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Fri, 25 Jun 2021 13:14:28 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 30229483
etag: W/"60d5d6b4-f6a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7db6859f4ec9afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 css
fonts.googleapis.com/ 14 KB
923 B 67ms
66ms Stylesheet
text/css 172.217.175.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f10.1e100.net

Software

ESF /

Resource Hash

d11f6ac62c5e0e2c0955a79615e06f561c5622f4d4598b3e7b853055c7b5643e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 18:08:09 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Jun 2023 18:23:21 GMT

GET
H2 200 css2
fonts.googleapis.com/ 667 KB
178 KB 68ms
68ms Stylesheet
text/css 172.217.175.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@100;300;400;500;700;900&display=swap

Requested by

Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f10.1e100.net

Software

ESF /

Resource Hash

202956cc224ba9381b6a1167408b11dab6198fe87f3a3ed967324f4154aa30c0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 22 Jun 2023 18:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 17:14:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Jun 2023 18:23:21 GMT

GET
H2 200 ajax_ping Show response
www.cyberark.com/resources/hubsFront/ 49 B
302 B 294ms
293ms XHR
application/json 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_ping

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
X-Requested-With: XMLHttpRequest
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/;
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 7db685a06faeafe7-NRT
x-xss-protection: 1; mode=block

GET
H2 200 stats_temp_item_680772131x73bbb80152a1905246463c9dd1a71f522a104b48c77c93f74871e31ae61b04cb1687458200fb9880d383d5d44085dab9ead8c2d8449b7d6c04c12d7873b7d543f8d882cc71
www.cyberark.com/resources/hubsFront/signalMetricsTemp/ 0
162 B 303ms
302ms Image
text/html 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/resources/hubsFront/signalMetricsTemp/stats_temp_item_680772131x73bbb80152a1905246463c9dd1a71f522a104b48c77c93f74871e31ae61b04cb1687458200fb9880d383d5d44085dab9ead8c2d8449b7d6c04c12d7873b7d543f8d882cc71?t=1687458201649

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/;
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: text/html; charset=UTF-8
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 7db685a0bfdfafe7-NRT
x-xss-protection: 1; mode=block

GET
H2 200 tag.aspx Show response
ml314.com/ 31 KB
11 KB 132ms
44ms Script
application/javascript 34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/tag.aspx?225
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 17:30:30 GMT
content-encoding: br
age: 3171
x-guploader-uploadid: ADPycdt_wE7sWhZ1Bsi4eeJQFE1ujaqizOgrVpPiXPrt1vnpVY59R-vKG3ASmcsNUtPrghbt4cWnXO-GZAQ07Gz1tNYJIg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10526
last-modified: Mon, 10 Apr 2023 17:13:24 GMT
server: UploadServer
etag: W/"b0965f051977c0dd95ffe2c736cac352"
vary: Accept-Encoding
x-goog-generation: 1681146804366265
x-goog-hash: crc32c=wVdAwA==, md5=sJZfBRl3wN2V/+LHNsrDUg==
content-type: application/javascript
cache-id: NRT-33e460bb
cache-control: public,max-age=3600
x-cache-hit: hit
x-goog-stored-content-length: 32213
accept-ranges: none

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 132ms
46ms Script
application/x-javascript 23.34.103.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.103.199 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-103-199.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:21 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H3 200 sprite-1x.png
content.cdntwrk.com/img/hubs/ 59 KB
59 KB 146ms
145ms Image
image/png 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/sprite-1x.png
Requested by: Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.d67c3a950547b2eda292.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://content.cdntwrk.com/css/hubs/hubs.d67c3a950547b2eda292.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 19:12:06 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
age: 429076
x-amz-cf-pop: NRT57-C3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 60511
last-modified: Thu, 15 Jun 2023 16:01:08 GMT
server: AmazonS3
etag: "9e7227669aa01cd19bcc27e802668929"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: 8VhvywDvIXTkip05i2g0ic2KI7ovBcGYAxPklbDThXrFCjsSPmZivw==

GET
DATA 200
OK truncated
/ 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: jp-jp,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif

GET
H3 200 uparrow.png
content.cdntwrk.com/img/hubs/ 194 B
542 B 137ms
137ms Image
image/png 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/img/hubs/uparrow.png
Requested by: Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.d67c3a950547b2eda292.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://content.cdntwrk.com/css/hubs/hubs.d67c3a950547b2eda292.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 17 Jun 2023 16:25:09 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
age: 439093
x-amz-cf-pop: NRT57-C3
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
content-length: 194
last-modified: Thu, 27 Apr 2023 19:32:06 GMT
server: AmazonS3
etag: "e5bbd7205c8f2ff1cd6c9f777f31da64"
access-control-max-age: 0
access-control-allow-methods: GET, HEAD
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
accept-ranges: bytes
x-amz-cf-id: VZ1tQbtvYag2YQJZ6pRUEtfofmRNkm6wdsav7Cg5Zs7Aa4eUN5BquA==

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v35/ 47 KB
48 KB 513ms
49ms Font
font/woff2 172.217.175.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v35/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f3.1e100.net

Software

sffe /

Resource Hash

7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:01:08 GMT
x-content-type-options: nosniff
age: 184934
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48412
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:08:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Jun 2024 15:01:08 GMT

GET
H2 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 61 KB
61 KB 55ms
54ms Font
application/octet-stream 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62738b62849a46842f34013b8528886f10c8d0e1c9aec47d636e05d631e2f60e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 2501645
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 62472
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-f408"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cBtBgxJS%2BPA7aKBTRMfHL3Pc5wR9njSqj%2FHOGQCv6KPs31JpILLk4vhb4lshN1biqbKmoEATRgWvBb6wgEoCJvLmTCyAnD3rsdAZN3ebSb%2B6QvRqHaFALSZNKrdPMmGRvzAgNGnh"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7db685a0ac678a69-NRT
expires: Tue, 11 Jun 2024 18:23:21 GMT

GET
H2 200 372722_2_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
26 KB 511ms
55ms Font
binary/octet-stream 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_2_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 06:53:12 GMT
via: 1.1 70e24e789a7f5c3f75693b4d637a2d22.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 41411
x-cache: Hit from cloudfront
content-length: 26033
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:83914a011477cb60998949144e2ac5aa/mode:33188/mtime:1590596208/uid:1001/uname:runner
etag: "83914a011477cb60998949144e2ac5aa"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: ey3l-YgxIdS1t6wfM09Vx7Cf93kMK1Tfrbw1qgQBxmShPF6yAVFd8A==

GET
H2 200 372722_4_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
25 KB 1195ms
740ms Font
binary/octet-stream 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_4_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:23 GMT
via: 1.1 70e24e789a7f5c3f75693b4d637a2d22.cloudfront.net (CloudFront)
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:da77e86db861301f9320c467d834e649/mode:33188/mtime:1590596208/uid:1001/uname:runner
x-amz-cf-pop: NRT57-C1
etag: "da77e86db861301f9320c467d834e649"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
x-cache: RefreshHit from cloudfront
accept-ranges: bytes
content-length: 25237
x-amz-cf-id: CQ20L0RZ-VQWYo1To078JHe0535YNXE06zEIwA_G1Qi3fyNS9zqgZA==

GET
H2 200 fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 63 KB
63 KB 51ms
51ms Font
application/octet-stream 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-brands-400.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5567c5a47f8bbd27707bd2cffdb1679c292a07ccf09a8578e1b9eba7ab481cf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
strict-transport-security: max-age=15780000
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 846959
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 64144
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-fa90"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yj7yKlt56P4NDlKMqX6JqGLv%2Fr6yx6z0vJaTKvJ3s%2FRoGu3ALEb6E919xuoA6t4OP%2BExOLLkg46ceWA6mEIlOFN%2B1AwuwSOnEytdps1kCmWW7cto8mtD5vVa1pjaFpqIi7%2BFhpSx"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7db685a0ac688a69-NRT
expires: Tue, 11 Jun 2024 18:23:21 GMT

GET
H2 200 372722_1_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 25 KB
26 KB 640ms
185ms Font
binary/octet-stream 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_1_unhinted_0.woff2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 00:59:28 GMT
via: 1.1 70e24e789a7f5c3f75693b4d637a2d22.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 62635
x-cache: Hit from cloudfront
content-length: 26041
last-modified: Wed, 27 May 2020 16:17:01 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:0601eae673330329b340003d42fc1c36/mode:33188/mtime:1590596208/uid:1001/uname:runner
etag: "0601eae673330329b340003d42fc1c36"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: Br6xWLcEBzPvD6CMJDt69IB7UPR2tucnlCcHNEvXJFuLlLx42ezqgQ==

GET
H2 200 L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW4.woff2
fonts.gstatic.com/s/robotomono/v22/ 12 KB
12 KB 733ms
271ms Font
font/woff2 172.217.175.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotomono/v22/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto+Mono&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.175.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt20s20-in-f3.1e100.net

Software

sffe /

Resource Hash

7295944e0067d71c5d5276d397dc0299afb519f277ba644aec0b96343e4185d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 00:09:00 GMT
x-content-type-options: nosniff
age: 152062
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12312
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 18:56:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Jun 2024 00:09:00 GMT

GET
H2 200 fontawesome-webfont.woff2
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/ 75 KB
76 KB 510ms
55ms Font
binary/octet-stream 13.32.50.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-97.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 10:18:44 GMT
via: 1.1 70e24e789a7f5c3f75693b4d637a2d22.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 29079
x-cache: Hit from cloudfront
content-length: 77160
last-modified: Wed, 27 Jan 2021 17:56:57 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1611770160/ctime:1611770160/gid:117/gname:docker/md5:af7ae505a9eed503f8b8e6982036873e/mode:33188/mtime:1611770160/uid:1001/uname:runner
etag: "af7ae505a9eed503f8b8e6982036873e"
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET, HEAD
content-type: binary/octet-stream
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: VXU93fRB9I65fMSlxHY4ry-XNm0BIUhht4C5KIYNiKJhHashWmYGFw==

GET
H2 200 hero-tr-hand-microchip.jpg
www.cyberark.com/wp-content/uploads/2023/01/ 98 KB
102 KB 76ms
75ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/hero-tr-hand-microchip.jpg

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2f43ae4516e6f0ab6ec81074e147b09b13b50793f5798b7f89eff68255703d8d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64656
cf-polished: qual=85, origFmt=jpeg, origSize=210881
content-disposition: inline; filename="hero-tr-hand-microchip.webp"
content-length: 100284
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 22:27:15 GMT
server: cloudflare
etag: "63c1dac3-337c1"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a15830afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Figure1.png
www.cyberark.com/wp-content/uploads/2023/01/ 12 KB
16 KB 151ms
150ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/Figure1.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

521db95edefbfb252db1df64ea5e30b0ccd832551227eb10742de367cb4d6f0a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64655
cf-polished: origFmt=png, origSize=32499
content-disposition: inline; filename="Figure1.webp"
content-length: 12610
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 20:33:00 GMT
server: cloudflare
etag: "63c1bffc-7ef3"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a15831afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 Figure2.png
www.cyberark.com/wp-content/uploads/2023/01/ 24 KB
28 KB 149ms
148ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/Figure2.png

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d109c60b622c7cc1a1111f553efac7f1acb1607947d474004b94c79a3c90c0b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64655
cf-polished: origFmt=png, origSize=77452
content-disposition: inline; filename="Figure2.webp"
content-length: 24966
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 20:35:46 GMT
server: cloudflare
etag: "63c1c0a2-12e8c"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a15833afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H3 200 aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE2NjUwODg4ODkmc2lnPTM1ZTA5Y2FhODQ3YmRlYTdhMDE4OGYzZjRjNTE2MjU1
content.cdntwrk.com/files/ 93 KB
93 KB 149ms
149ms Image
image/webp 99.84.140.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://content.cdntwrk.com/files/aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE2NjUwODg4ODkmc2lnPTM1ZTA5Y2FhODQ3YmRlYTdhMDE4OGYzZjRjNTE2MjU1
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.140.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-140-18.nrt57.r.cloudfront.net
Software: /
Resource Hash: 619ddc1d756bc60de4717303471873db6bbc6da6106ad99231472aecdb6c3040

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 20 May 2023 07:12:54 GMT
via: 1.1 21c2c408f4c2c958f8382e583ddedf58.cloudfront.net (CloudFront)
last-modified: Thu, 18 Feb 2021 22:21:19 GMT
age: 2891425
x-amz-cf-pop: NRT57-C3
etag: "1613686879-be99bf6a6e12dc968d17e108eb199e37"
x-cache: Hit from cloudfront
content-type: image/webp
cache-control: max-age=15552000
content-disposition: inline; filename="background_image.webp"
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: _fA_lG5Wd30P5_Vff4XsXUkfWXR8Tnsewx2v68hftvPfF6b8Adl1xQ==

POST
H2 200 ajax_updateMAPUsers Show response
www.cyberark.com/resources/hubsFront/ 126 B
211 B 246ms
245ms XHR
application/json 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_updateMAPUsers

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b98e0f76f97857fce1b3fbd8e9ed5775988e85fffd71dcc2422f8d012378ea34

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
X-Requested-With: XMLHttpRequest
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/;
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 7db685a17844afe7-NRT
x-xss-protection: 1; mode=block

GET
H2 200 tr-pm-figure3.png
www.cyberark.com/wp-content/uploads/2023/01/ 16 KB
19 KB 110ms
109ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/tr-pm-figure3.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8930d0e2e796b4778c746779c5cc7e42a90da1b58120a3bd053ab4c41f165a6b

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 65717
cf-polished: origFmt=png, origSize=55094
content-disposition: inline; filename="tr-pm-figure3.webp"
content-length: 15966
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 20:55:57 GMT
server: cloudflare
etag: "63c1c55d-d736"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a17845afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 tr-pm-figure4.png
www.cyberark.com/wp-content/uploads/2023/01/ 14 KB
17 KB 112ms
111ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/tr-pm-figure4.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e8d6785b5ed64b1f745913a02adc49d4450beb7b8f5789539d532adcce7ea591

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 65717
cf-polished: origFmt=png, origSize=47761
content-disposition: inline; filename="tr-pm-figure4.webp"
content-length: 14242
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 21:12:06 GMT
server: cloudflare
etag: "63c1c926-ba91"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a17846afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 tr-pm-figure5.png
www.cyberark.com/wp-content/uploads/2023/01/ 14 KB
18 KB 109ms
108ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/tr-pm-figure5.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58a175ad6d5f4dba2535263697247eca37b15eba561d0474c989f667dd0f27d9

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64655
cf-polished: origFmt=png, origSize=43857
content-disposition: inline; filename="tr-pm-figure5.webp"
content-length: 14562
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 21:14:27 GMT
server: cloudflare
etag: "63c1c9b3-ab51"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a17847afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 tr-pm-figure6.png
www.cyberark.com/wp-content/uploads/2023/01/ 10 KB
14 KB 108ms
107ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/tr-pm-figure6.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b6da73654c144d69f24f5354d48e426df8e2e7102fd6600a5065e96ffe11018

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64655
cf-polished: origFmt=png, origSize=32577
content-disposition: inline; filename="tr-pm-figure6.webp"
content-length: 10668
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 21:16:25 GMT
server: cloudflare
etag: "63c1ca29-7f41"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a17848afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 tr-pm-figure7.png
www.cyberark.com/wp-content/uploads/2023/01/ 8 KB
12 KB 110ms
110ms Image
image/webp 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cyberark.com/wp-content/uploads/2023/01/tr-pm-figure7.png

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4aa419e7622019ff7ff19c50440df5e5f49e1563cfc0fd71f6123dbd1065de44

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net .everesttech.net everesttech.net .demdex.net demdex.net .adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net .typekit.net typekit.net .akamaihd.net akamaihd.net s3.amazonaws.com .amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com .adnxs.com adnxs.com .baidu.com baidu.com .btttag.com btttag.com .bluekai.com bluekai.com .bootstrapcdn.com bootstrapcdn.com .cdntwrk.com cdntwrk.com .choozle.com choozle.com .cloudflare.com cloudflare.com .cloudfront.net cloudfront.net .cyberark.com cyberark.com g.doubleclick.net .doubleclick.net doubleclick.net fls.doubleclick.net .driftt.com driftt.com .ensighten.com ensighten.com .facebook.com .facebook.net facebook.com facebook.net .fontawesome.com fontawesome.com .google.ae .google.al .google.am .google.at .google.az .google.ba .google.be .google.bg .google.bj .google.bs .google.by .google.ca .google.cd .google.ch .google.ci .google.cl .google.cm .google.cn .google.com .google.cz .google.de .google.dk .google.dz .google.ee .google.es .google.fi .google.fr .google.ge .google.gr .google.hn .google.hr .google.hu .google.ie .google.im .google.iq .google.is .google.it .google.je .google.jo .google.kz .google.lk .google.lt .google.lu .google.lv .google.mg .google.mk .google.ml .google.mn .google.mu .google.nl .google.no .google.pl .google.pt .google.ro .google.rs .google.ru .google.sc .google.se .google.sk .google.sn .google.sr .google.tg .google.tn .google.tt .gstatic.com .translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com .googleapis.com googleapis.com .cloudfunctions.net cloudfunctions.net .googletagmanager.com googletagmanager.com .google-analytics.com google-analytics.com .herokuapp.com herokuapp.com .hotjar.com .hotjar.io hotjar.com hotjar.io .jquery.com jquery.com .jsdelivr.net jsdelivr.net .linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io .licdn.com licdn.com .marketo.com .marketo.net .mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com .microsoft.com microsoft.com .moz.com moz.com .myfonts.net myfonts.net .newrelic.com .nr-data.net newrelic.com nr-data.net .openx.net openx.net .rlcdn.com rlcdn.com .reddit.com .redditstatic.com reddit.com redditstatic.com .rubiconproject.com rubiconproject.com .krxd.net krxd.net .stackadapt.com srv.stackadapt.com stackadapt.com .adsrvr.org adsrvr.org .trustarc.com trustarc.com .twitter.com twitter.com .6sc.co .litix.io 6sc.co litix.io .unpkg.com unpkg.com .wistia.com wistia.com .wpengine.com wpengine.com analytics.yahoo.com .googleadservices.com .duosecurity.com duosecurity.com yoast.com .ceros.com ceros.com .transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:21 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm cnv.event.prod.bidr.io data: blob:; upgrade-insecure-requests;
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 64655
cf-polished: origFmt=png, origSize=16137
content-disposition: inline; filename="tr-pm-figure7.webp"
content-length: 8426
referrer-policy: strict-origin-when-cross-origin
cf-bgj: imgq:85,h2pri
last-modified: Fri, 13 Jan 2023 21:20:18 GMT
server: cloudflare
etag: "63c1cb12-3f09"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
permissions-policy: midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges: bytes
cf-ray: 7db685a17849afe7-NRT
expires: Fri, 21 Jun 2024 18:23:21 GMT

GET
H2 200 utsync.ashx Show response
ml314.com/ 535 B
1 KB 189ms
188ms Script
application/javascript 34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=52079&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&pv=1687458201863_kleejazoc&bl=en-us&cb=4896328&return=&ht=&d=&dc=&si=1687458201863_kleejazoc&cid=production%7C%7C108540%7C%7C6824673%7C%7C680772131&s=1600x1200&rp=&v=2.5.3.49
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?225
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 3e416f057f786d430dc0c290f27e0015ab40c7918fb9b0c3cf69fdf99084c75c

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:21 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: application/javascript; charset=utf-8
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 535
expires: 0

GET
H/1.1 200
OK ud.ashx Show response
in.ml314.com/ 20 B
482 B 675ms
124ms Script
application/javascript 54.187.122.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://in.ml314.com/ud.ashx?topiclimit=&cb=2252023&v=2.5.3.49
Requested by: Host: ml314.com
URL: https://ml314.com/tag.aspx?225
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.187.122.125 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-187-122-125.us-west-2.compute.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:21 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: public
Connection: keep-alive
Content-Length: 138
Expires: Fri, 23 Jun 2023 18:23:22 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/163/ 11 KB
5 KB 89ms
89ms Script
application/x-javascript 23.34.103.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/163/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.103.199 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-103-199.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:21 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Jan 2023 02:26:40 GMT
Server: AkamaiNetStorage
ETag: "ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4741
Expires: Sat, 30 Sep 2023 18:23:21 GMT

POST
H/1.1 200
OK visitWebPage
316-czp-275.mktoresp.com/webevents/ 2 B
318 B 1012ms
140ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://316-czp-275.mktoresp.com/webevents/visitWebPage?_mchNc=1687458201959&_mchCn=&_mchId=316-CZP-275&_mchTk=_mch-cyberark.com-1687458201959-67793&_mchHo=www.cyberark.com&_mchPo=&_mchRu=%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:22 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: c86f8e5a-12ee-4f48-b53b-36cc6f24d61d

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/
Redirect Chain

https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3636573452440698880&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3636573452440698880&redir=

42 B
942 B

35ms
35ms

Image
image/gif

18.177.126.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3636573452440698880&redir=

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

HTTP/1.1

Server

18.177.126.76 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-177-126-76.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS: dcs-prod-tyo3-1-v046-0510f35b8.edge-tyo3.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 2EGMsCQFRNE=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-tyo3-1-v046-02dd6a623.edge-tyo3.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: qV1sgBu0R+I=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3636573452440698880&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=
https://ml314.com/csync.ashx?fp=96f50d30-c297-4c94-9993-08e5b51e832d&person_id=3636573452440698880&eid=53819

43 B
60 B

57ms
57ms

Image
image/gif

34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=96f50d30-c297-4c94-9993-08e5b51e832d&person_id=3636573452440698880&eid=53819
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: image/gif
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Fri, 23 Jun 2023 14:23:22 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:21 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: image/gif
location: https://ml314.com/csync.ashx?fp=96f50d30-c297-4c94-9993-08e5b51e832d&person_id=3636573452440698880&eid=53819
p3p: CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: 0,Fri, 23 Jun 2023 14:23:22 GMT

GET
H3

200

csync.ashx
ml314.com/
Redirect Chain

https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3636573452440698880
https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3636573452440698880
https://ml314.com/csync.ashx?fp=400dc49b75022846349e2da2cc2fd8da&eid=50146&person_id=3636573452440698880

43 B
60 B

134ms
134ms

Image
image/gif

34.111.234.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ml314.com/csync.ashx?fp=400dc49b75022846349e2da2cc2fd8da&eid=50146&person_id=3636573452440698880
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H3
Server: 34.111.234.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 236.234.111.34.bc.googleusercontent.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: image/gif
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Fri, 23 Jun 2023 14:23:22 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:22 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://ml314.com/csync.ashx?fp=400dc49b75022846349e2da2cc2fd8da&eid=50146&person_id=3636573452440698880
cache-control: no-cache
x-server: 10.42.24.72
content-length: 0
expires: 0

GET
H/1.1

200
OK

match
ps.eyeota.net/
Redirect Chain

https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2BnCWxf7wX-GD_duWsOk8o0_HfbaaAeviK3FpPn76qNU&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
https://ml314.com/csync.ashx?fp=2BnCWxf7wX-GD_duWsOk8o0_HfbaaAeviK3FpPn76qNU&person_id=3636573452440698880&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referre...
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20

70 B
440 B

28ms
27ms

Image
image/gif

18.176.247.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: HTTP/1.1
Server: 18.176.247.126 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-176-247-126.ap-northeast-1.compute.amazonaws.com
Software: /
Resource Hash: de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type: image/gif
Date: Thu, 22 Jun 2023 18:23:22 GMT
Content-Length: 70
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

date: Thu, 22 Jun 2023 18:23:22 GMT
via: 1.1 google
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
content-type: text/html; charset=utf-8
location: https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 193
expires: Fri, 23 Jun 2023 14:23:22 GMT

GET
H2 200 ajax_ping Show response
www.cyberark.com/resources/hubsFront/ 49 B
132 B 252ms
251ms XHR
application/json 104.18.190.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cyberark.com/resources/hubsFront/ajax_ping

Requested by

Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.d67c3a950547b2eda292.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.190.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
X-Requested-With: XMLHttpRequest
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-security-policy: frame-ancestors 'self' https://www.cyberark.com/;
referrer-policy: unsafe-url
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-frame-options: DENY
content-type: application/json
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
content-language: en
cf-ray: 7db685a37934afe7-NRT
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 368 B
1 KB 286ms
33ms XHR
application/json 18.177.126.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=9AB97041603F3EDB0A495C66%40AdobeOrg&d_nsid=0&ts=1687458202167

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.177.126.76 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-177-126-76.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

e8a7f59bdadc9cce044ed41c774962b3dad55a83f3cd6ae6433b5070fc3eca11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-tyo3-1-v046-0e84b94e4.edge-tyo3.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: iIZNHNB1Sqg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cyberark.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 311
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 34 KB
12 KB 47ms
46ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "dfdd9e1f988805f0c2fbb10cd6b8f034:1663863409.614694"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12384
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/ 3 KB
2 KB 47ms
46ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
last-modified: Thu, 22 Sep 2022 16:16:49 GMT
server: AkamaiNetStorage
etag: "b89fcb8870ac40eecb6d3cc844d35389:1663863409.92483"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1598
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H2 200 RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/ 538 B
584 B 76ms
76ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 011052ff11712ffd8a96a3c73f6b6e129e3112938f06a4280201dd9ea6784819

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
last-modified: Fri, 16 Jun 2023 15:11:18 GMT
server: AkamaiNetStorage
etag: "72efeb6d13314918012fe880d51445b9:1686928278.148166"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 327
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H2 200 RC215bf8f3db2048f5a863a53bd773832d-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/ 429 B
534 B 32ms
32ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/RC215bf8f3db2048f5a863a53bd773832d-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a13619a5400ecc49ef7f85fc99b5a7bb5a6f2c962fac0b446c1c1a4764b73b38

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
last-modified: Fri, 16 Jun 2023 15:11:18 GMT
server: AkamaiNetStorage
etag: "72efeb6d13314918012fe880d51445b9:1686928278.148166"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 277
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H2 200 d24194f2-6101-4c07-b071-d2eb5d40f5e6.js Show response
j.6sc.co/j/ 769 B
1 KB 733ms
644ms Script
application/javascript 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/j/d24194f2-6101-4c07-b071-d2eb5d40f5e6.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-55-30.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ed5dc159c961b48f8fded6c43a02780d5559b00c1991aa217be2b0e7c96da34e

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id: 1S0pt_hBZJ9ackARqK0_qkfxNIWa8IO0
date: Thu, 22 Jun 2023 18:23:23 GMT
x-amz-cf-pop: NRT12-C4
x-amz-server-side-encryption: AES256
x-amz-meta-content-type: application/json
content-length: 769
pragma: no-cache
last-modified: Wed, 31 May 2023 20:12:56 GMT
server: AmazonS3
etag: "fea2e1dde6bfb8741e2c2b73bdd22f43"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: h0a6xVZfze82ImiidI8AaQi0JZUdN_2N5P6UXoAZsxVghHVb_N8G-g==
expires: Thu, 22 Jun 2023 18:23:23 GMT

GET
H/1.1 200
OK rtp.js Show response
sjrtp6-cdn.marketo.com/rtp-api/v1/ 152 KB
42 KB 840ms
485ms Script
application/x-javascript 23.35.124.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.35.124.205 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-35-124-205.deploy.static.akamaitechnologies.com

Software

Jetty(9.4.45.v20220203) /

Resource Hash

bd6854313df2804cabc0dcf14063b370bb8dceb9ff5df0bf8b110f036f95162c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63113904
Content-Encoding: gzip
Date: Thu, 22 Jun 2023 18:23:23 GMT
Last-Modified: Sat, 13 May 2023 01:10:17 GMT
Server: Jetty(9.4.45.v20220203)
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=UTF-8
Cache-Control: public, max-age=295
Connection: keep-alive
Content-Length: 42534

GET
H2 200 hotjar-1200039.js Show response
static.hotjar.com/c/ 9 KB
4 KB 410ms
253ms Script
application/javascript 13.225.183.101
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1200039.js?sv=6

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.183.101 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-183-101.nrt57.r.cloudfront.net

Software

Resource Hash

7f94fca134e611bd64a6dd27e85c9c85832f8f91ebca838794a99dda5f48cde1

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 ece495703bac6f634e6e16b4037affae.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C4
etag: W/607c77c92013e9e39088b723df1bbf3b
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=60
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
x-amz-cf-id: GO1m5Trcbupzp6I5DBj2sFh8hn0hAxtueG3UY3StKozGnMscobSj3w==

GET
H2 200 notice Show response
consent.trustarc.com/ 16 KB
6 KB 325ms
237ms Script
text/javascript 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

97decf2d1156aaa2ae84c22c38d63028025a06fee23c8ef33b239df18572cf64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 8433e30ac6e907a81aa2471c80b4c8cc.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
x-cache: Miss from cloudfront
cloudfront-viewer-country: JP
content-length: 5968
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
vary: Accept-Encoding, Origin
content-type: text/javascript;charset=UTF-8
cache-control: max-age=3600
cloudfront-viewer-country-region: 20
timing-allow-origin: *
x-amz-cf-id: 56krSDy99-M-U1m2tTLZf7y4n9cZRFXQXa-FlO_S51LeU-iLPlLP-g==
expires: Thu, 22 Jun 2023 19:23:22 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 25ms
25ms Script
application/x-javascript 23.34.103.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.34.103.199 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-34-103-199.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:22 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Mar 2023 01:24:48 GMT
Server: AkamaiNetStorage
ETag: "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary: Accept-Encoding
Content-Type: application/x-javascript
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 729

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 125 KB
48 KB 83ms
83ms Script
application/javascript 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-9920016

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7039ab8f947a4c8aa9b0129f458024c1d0f630de16ba83d2fca97e5e99493839

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49498
x-xss-protection: 0
last-modified: Thu, 22 Jun 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Jun 2023 18:23:22 GMT

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 428ms
31ms Script
application/javascript 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:22 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 444ms
32ms Script
text/javascript 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 22 Jun 2023 17:25:15 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 3487
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 22 Jun 2023 19:25:15 GMT

GET
H/1.1 200
OK dest5.html Show response
cyberark.demdex.net/ Frame 7674 7 KB
3 KB 189ms
34ms Document
text/html 18.179.253.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.179.253.189 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-179-253-189.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-tyo3-1-v046-0a5de9b3d.edge-tyo3.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: n2jwTHzlTcw=
content-encoding: gzip
date: Thu, 22 Jun 2023 18:23:22 GMT
last-modified: Wed, 14 Jun 2023 09:39:28 GMT
vary: accept-encoding

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZJSRmgAAAHHfcwN1
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=58286644819232201762838274099520942256
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJSRmgAAAHHfcwN1

42 B
942 B

39ms
38ms

Image
image/gif

18.177.126.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJSRmgAAAHHfcwN1

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

HTTP/1.1

Server

18.177.126.76 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-177-126-76.ap-northeast-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

DCS: dcs-prod-tyo3-2-v046-01dc98646.edge-tyo3.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: npC/ybk4SdU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZJSRmgAAAHHfcwN1
Date: Thu, 22 Jun 2023 18:23:22 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

POST
H2 200 delivery Show response
cyberark.tt.omtrdc.net/rest/v1/ 351 B
844 B 603ms
410ms XHR
application/json 63.140.50.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.tt.omtrdc.net/rest/v1/delivery?client=cyberark&sessionId=7ba27d669d084c658ba4b8dd2caa8f50&version=2.10.2

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

06d728dae2ed107e620cf386a44b591ede81aab2710da16037f291f9dc1aa174

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Jun 2023 18:23:23 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 4505d0d7-9c47-413c-9dab-44374b70279e

GET
H2 200 get Show response
consent.trustarc.com/ Frame 0CF1 7 KB
2 KB 30ms
30ms Document
text/html 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

7fe7d9054d31a9874fb36aba6a3736c02799bdaab5fed3e007ff334bc4580732

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

age: 869
cache-control: max-age=2592000
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 22 Jun 2023 18:08:52 GMT
expires: Sat, 22 Jul 2023 18:08:52 GMT
pragma: public
strict-transport-security: max-age=31536000; includeSubDomains
timing-allow-origin: *
vary: Origin
via: 1.1 8433e30ac6e907a81aa2471c80b4c8cc.cloudfront.net (CloudFront)
x-amz-cf-id: 3lDU_DgnI-lMNbSVJTS5BDUszUi_zfu2xoEvsyPIywe7wURqa9gNOg==
x-amz-cf-pop: NRT57-C1
x-cache: Hit from cloudfront

GET
H2 200 v1.7-2723 Show response
consent.trustarc.com/asset/notice.js/v/ 85 KB
26 KB 128ms
56ms Script
text/javascript 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/asset/notice.js/v/v1.7-2723

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

3513de4bf093c6b166f959edc9a64e8916ffd5c373201ef16ee41b15c07ce5fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 17:31:16 GMT
content-encoding: gzip
via: 1.1 53784e962439e344b6be04336e793994.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C1
age: 3127
x-cache: Hit from cloudfront
pragma: public
last-modified: Mon, 19 Jun 2023 03:59:43 GMT
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: FQOQ3WsIsRGYGmw7keLObyJSUxOUbvoqlirXJtro31nTD3RTiKR8Lg==
expires: Sat, 22 Jul 2023 17:31:15 GMT

GET
H2 200 log
consent.trustarc.com/ 43 B
429 B 239ms
239ms Image
image/gif 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/log?domain=cyberark.com&country=jp&state=&behavior=implied&session=c826d742-2278-4c5b-b3ca-ec59bbb58b42&userType=NEW&c=535d

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:22 GMT
via: 1.1 8433e30ac6e907a81aa2471c80b4c8cc.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C1
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: 6VgKY3SxReLizCoaZCpBOKzLjfVsGBnNGwo53k2_v3keLYewFq7ZrQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 modules.e4a2ad1c1125ca6fe735.js Show response
script.hotjar.com/ 270 KB
69 KB 129ms
45ms Script
application/javascript 13.33.174.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.e4a2ad1c1125ca6fe735.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1200039.js?sv=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-94.nrt57.r.cloudfront.net

Software

Resource Hash

69582702c9d3b8a292953b997f39cf2210ec13d6c9f34f47d1137d5c9afe7745

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 13:50:08 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=2592000; includeSubDomains
via: 1.1 e16e3b9953cb6fda06776fc1dd2f067a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 102793
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 70288
last-modified: Wed, 21 Jun 2023 13:49:37 GMT
etag: "acba85e146591ff56393886d85d64942"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: jjoRIUUaQDA2TWyQ0D-4eNt2L55MIX3lGGveAc2xmL9dsdWSIeSpyQ==

GET
H2 200 notice Show response
consent.trustarc.com/ 16 KB
5 KB 633ms
633ms Script
text/javascript 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=cyberark.com&country=jp&js=nj2&c=teconsent&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

86eb8799f937f8afa6e72b4ced1859beed57b07ff187fe19e7bdd6739e5bee13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 53784e962439e344b6be04336e793994.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
x-cache: Miss from cloudfront
cloudfront-viewer-country: JP
content-length: 4977
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=3600
cloudfront-viewer-country-region: 20
timing-allow-origin: *
x-amz-cf-id: 47XU3ZwG1z7x1fBE7JVE7E15tvMrUUorqOWlcmSsNEdQ_GzWh43_bg==
expires: Thu, 22 Jun 2023 19:23:23 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 807ms
717ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1687458202947&id=t2_o2i62ves&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=82a51669-b3cb-4b2b-b9ec-9ad6228ac595&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:23 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
209 B 64ms
64ms XHR
text/plain 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=974874542&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ul=en-us&de=UTF-8&dt=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAEK~&jid=1930409754&gjid=838212438&cid=1149250923.1687458203&tid=UA-44168172-9&_gid=697067956.1687458203&_slc=1&gtm=45He36e2n715SFWTH&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cd7=&z=1293957407

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 7 B
353 B 511ms
63ms XHR
text/plain 142.251.170.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-44168172-9&cid=1149250923.1687458203&jid=1930409754&gjid=838212438&_gid=697067956.1687458203&_u=YGBAgEABAAAAAGAEK~&z=1644531265

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.170.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

tc-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

2bd7a2c113455cb6a015b33188207c2f7f5b5e7c584ce1ea4f8b0a1e990da133

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 22 Jun 2023 18:23:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.cyberark.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 6si.min.js Show response
j.6sc.co/ 35 KB
11 KB 31ms
29ms Script
application/javascript 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/j/d24194f2-6101-4c07-b071-d2eb5d40f5e6.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 17 May 2023 00:27:16 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "64641f64-8a3f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, no-cache, proxy-revalidate
accept-ranges: bytes
content-length: 11052
expires: Thu, 22 Jun 2023 18:23:23 GMT

GET
H2 200 getuidj Show response
secure.adnxs.com/ 11 B
574 B 314ms
101ms XHR
application/json 103.43.90.114
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

103.43.90.114 , Singapore, ASN29990 (ASN-APPNEX, US),

Reverse DNS

602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
an-x-request-uuid: c545143e-94e1-4c90-8513-efe1debbf2b3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.cyberark.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 114.162.68.91; 114.162.68.91; 602.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com
content-length: 11
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 / Show response
c.6sc.co/ 7 B
194 B 33ms
27ms XHR
text/html 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-55-30.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:23 GMT
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: text/html
access-control-allow-origin: https://www.cyberark.com
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 7

GET
H2 200 / Show response
ipv6.6sc.co/ 4 B
275 B 401ms
23ms XHR
text/html 23.200.55.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.200.55.8 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-200-55-8.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: null
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="468738_399600264_68370340_20_777_21_0_-";dur=1
content-length: 4
expires: Thu, 22 Jun 2023 18:23:23 GMT

GET
H/1.1 200
OK jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/ 22 KB
4 KB 95ms
27ms Stylesheet
text/css 23.35.124.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.124.205 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-124-205.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:23 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Nov 2017 08:57:42 GMT
Server: AkamaiNetStorage
ETag: "7f5b0bee9b1f7af8413b351cbceca223:1510045062"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 3752

GET
H/1.1 200
OK trw Show response
sjrtp6.marketo.com/gw1/ 215 B
652 B 1297ms
181ms Script
application/x-javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/trw?aid=cyberarksoftware&trwv.uid=cyberarksoftware-1687458203308-4c48fc2d&trwv.vc=1&trwsa.sid=cyberarksoftware-1687458203312-9f826ca7&trwsb.cpv=1&ctzo=-00:00&uri=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-1687458201959-67793&pm=&viewedTypes=&rts=1687458203324

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

b6a545f511aab74426dc07259821b5a3976d9c431da047c7b44a54ed15935dd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:24 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 215
Content-Type: application/x-javascript;charset=utf-8

GET
H/1.1 200
OK ga-integration-2.0.4.js Show response
rtp-static.marketo.com/rtp/libs/ 17 KB
6 KB 93ms
31ms Script
application/x-javascript 23.35.124.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.124.205 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-124-205.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:23 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Jun 2021 07:56:23 GMT
Server: AkamaiNetStorage
ETag: "cfd84ea6865e772828527b0485a0eb7e:1622706982.648039"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 5540

GET
H/1.1 200
OK msg Show response
sjrtp6.marketo.com/gw1/ 0
426 B 1196ms
130ms Script
text/javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/msg?a=2&sid=cyberarksoftware-1687458203312-9f826ca7&aid=cyberarksoftware&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-1687458201959-67793&viewedTypes=&0.4713588528714272&rts=1687458203377

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:24 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 0
Content-Type: text/javascript;charset=utf-8

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 697ms
692ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=059bf2ba2b88e39bb3200769d2e411fc&svisitor=null&visitor=edcfb833-6f15-44c1-8ee0-d512af18c83a&session=ddbcacad-a9fb-43a5-8c5b-0cd308973fc8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22059bf2ba2b88e39bb3200769d2e411fc%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22d24194f2-6101-4c07-b071-d2eb5d40f5e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2022%20Jun%202023%2018%3A23%3A23%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Abstract%20ChatGPT%20took%20the%20world%20by%20storm%20being%20released%20less%20than%20two%20months%20ago%2C%20it%20has%20become%20prominent%20and%20is%20used%20everywhere%2C%20for%20a%20wide%20variety%20of%20tasks%20%E2%80%93%20from%20automation%20tasks%20to%20the...%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&pageViewId=05b6ce6e-d69f-4ef5-85cc-04ca2c35b1e2&webTagId=d24194f2-6101-4c07-b071-d2eb5d40f5e6

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:24 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 491ms
74ms Image
image/gif 142.250.196.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-44168172-9&cid=1149250923.1687458203&jid=1930409754&_u=YGBAgEABAAAAAGAEK~&z=2007852360

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.196.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.co.jp/ads/ 42 B
408 B 517ms
72ms Image
image/gif 216.58.220.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-44168172-9&cid=1149250923.1687458203&jid=1930409754&_u=YGBAgEABAAAAAGAEK~&z=2007852360

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.220.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s30-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bannermsg
consent.trustarc.com/ 43 B
427 B 228ms
228ms Image
image/gif 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/bannermsg?action=views&domain=cyberark.com&behavior=implied&country=jp&language=en&rand=0.8508295491974742&session=c826d742-2278-4c5b-b3ca-ec59bbb58b42&userType=NEW

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:23 GMT
via: 1.1 8433e30ac6e907a81aa2471c80b4c8cc.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C1
vary: Origin
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: XP2_BrGfcra1spCBJdBy7aMopArW6oKs3It7C5EMZj5m5zG4AQGVUA==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 get
consent.trustarc.com/ 127 KB
77 KB 48ms
48ms Font
application/octet-stream 13.32.50.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/get?name=OpenSans-Regular.ttf

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.50.10 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-50-10.nrt57.r.cloudfront.net

Software

Resource Hash

8bcb1671142844b9c10b5247053d513b9110ad9e3ad7ec0b751d42c977611f83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/
Origin: https://www.cyberark.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: public
date: Thu, 22 Jun 2023 17:43:07 GMT
content-encoding: gzip
via: 1.1 53784e962439e344b6be04336e793994.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C1
age: 2416
x-cache: Hit from cloudfront
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: HKQdkLHC0tEnVllc7TIce82eUb3AeWJrnaYWqkyaP00INHoKNW2Zjg==
expires: Sat, 22 Jul 2023 17:43:07 GMT

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 376ms
376ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:24 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 02:04:22 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f03226-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK msg Show response
sjrtp6.marketo.com/gw1/ 0
426 B 513ms
245ms Script
text/javascript 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:25 GMT
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Connection: close
Content-Length: 0
Content-Type: text/javascript;charset=utf-8

GET
H2 200 RC5266e3ee597a459fbc388f1132b7e943-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/ 521 B
586 B 27ms
26ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/RC5266e3ee597a459fbc388f1132b7e943-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4366b644d5f41009ff0f2b09c4fc67560f06de71b29a0d5891b0637b83c518ff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
content-encoding: gzip
last-modified: Fri, 16 Jun 2023 15:11:18 GMT
server: AkamaiNetStorage
etag: "72efeb6d13314918012fe880d51445b9:1686928278.148166"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 329
expires: Thu, 22 Jun 2023 19:23:25 GMT

GET
H/1.1 200
OK jquery-custom-ui.min.js Show response
rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/ 126 KB
35 KB 41ms
40ms Script
application/x-javascript 23.35.124.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Requested by: Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.124.205 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-124-205.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Jan 2018 12:54:21 GMT
Server: AkamaiNetStorage
ETag: "5a9f8dd85d85afd20544bd437a505338:1515502461"
Vary: Accept-Encoding
Access-Control-Max-Age: 86400
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 35484

GET
H2 200 ey22i6m9p82y.js Show response
js.driftt.com/include/1687458300000/ 211 KB
60 KB 581ms
497ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1687458300000/ey22i6m9p82y.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

cd73c8f5cb4d24993cf38fe7bcd1ba52ba658e8676e9395ec53e2b99f109a78c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
x-amz-version-id: dbHAQL2YsEX5UouJnsgQWPL7m3WwKIcc
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
x-envoy-upstream-service-time: 29
last-modified: Wed, 21 Jun 2023 22:21:53 GMT
server: istio-envoy
etag: W/"145768da45cc113adf083498c0753895"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sSWU14UhXgIXWguS7YsuxY-TRZobYeMbZ1u5mZWr9pXsVs_uXBcbjg==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/ 3 KB
2 KB 531ms
64ms Script
text/javascript 142.250.196.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1687458205172&cv=11&fst=1687458205172&bg=ffffff&guid=ON&async=1&gtm=45He36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&hn=www.googleadservices.com&frm=0&tiba=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&auid=778638953.1687458202&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.196.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s36-in-f2.1e100.net

Software

cafe /

Resource Hash

7368078c522d443161721c025fb2a779e9be819daa09d1d1402040790d449e3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1388
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 1 KB
825 B 439ms
33ms Script
application/x-javascript 23.33.33.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.33.145 , United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-33-145.deploy.static.akamaitechnologies.com

Software

Resource Hash

77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 547
date: Thu, 22 Jun 2023 18:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 22 Jun 2023 17:56:59 GMT
x-cdn: AKAM
x-edgeconnect-midmile-rtt: 0
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=84872
accept-ranges: bytes
content-length: 562

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 112 KB
29 KB 417ms
35ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-nrt1.fbcdn.net

Software

Resource Hash

b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 22 Jun 2023 18:23:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 28296
x-xss-protection: 0
pragma: public
x-fb-debug: y0ipGymVnQ4b30NTeVtApxptewsv0Po+pl0/bZIG16YiMf8uHH3yWqnjhhjsv3qGUN4X5ie6V/Xig0I5XKUzmA==
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/choozle/14963/ 28 KB
10 KB 151ms
36ms Script
application/javascript 13.32.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-9.nrt57.r.cloudfront.net
Software: CloudFront /
Resource Hash: 6151f62c314340a55f5cc5fb650538f2325f9516b69da4e3feb300515fc4072e

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 06 Jan 2023 05:59:54 GMT
x-amz-version-id: TyBQf2qSagJta4AIHKpeV6mRRAvIotjd
content-encoding: gzip
via: 1.1 d5447b27e44e9452384c28aa80912a8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 14473412
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Fri, 10 Sep 2021 17:02:44 GMT
server: CloudFront
etag: W/"374a48ffc505abf84a47ee66770c76f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: 6y_KOvF0YkWFEKX3SiQTtayU5vSOEsO4ZUWSP1umJ1X_vEaUVrQ7qg==

GET
H2

200

activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3... Show response
9920016.fls.doubleclick.net/ Frame 0263
Redirect Chain

https://9920016.fls.doubleclick.net/activityi;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https...
https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;u...

615 B
529 B

155ms
153ms

Document
text/html

142.251.42.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9920016

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f6.1e100.net

Software

cafe /

Resource Hash

dda8fcc2e307fd97d26215fda28cd77a1524c9b465ab88e006ad2cfd426be80d

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 353
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 18:23:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 18:23:25 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 events.js Show response
tags.srv.stackadapt.com/ 17 KB
6 KB 824ms
395ms Script
text/javascript 3.210.10.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/events.js
Requested by: Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.10.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-10-81.compute-1.amazonaws.com
Software: /
Resource Hash: 650ccb5345413a793747580709faf33dde8ec50199400db4d4cd607fbb3da51a

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 22 Jun 2023 18:23:25 GMT
cache-control: max-age=5
content-encoding: gzip
content-type: text/javascript

GET
H/1.1

200
OK

cnv
cnv.event.prod.bidr.io/log/
Redirect Chain

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER]
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

43 B
796 B

26ms
25ms

Image
image/gif

18.176.186.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1

Protocol

HTTP/1.1

Server

18.176.186.29 Tokyo, Japan, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-176-186-29.ap-northeast-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
Date: Thu, 22 Jun 2023 18:23:25 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
Date: Thu, 22 Jun 2023 18:23:25 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 362ms
362ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Fri, 21 Feb 2020 18:57:20 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "5e502810-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js Show response
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/ 504 B
582 B 27ms
27ms Script
application/x-javascript 23.39.216.225
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/0a735c82474e/RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.39.216.225 Tokyo, Japan, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-216-225.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 485f287e270265f1a646a4589c357a3d124305a54ac7eaa928c0cf0463b693b6

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
content-encoding: gzip
last-modified: Fri, 16 Jun 2023 15:11:18 GMT
server: AkamaiNetStorage
etag: "72efeb6d13314918012fe880d51445b9:1686928278.148166"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.cyberark.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 325
expires: Thu, 22 Jun 2023 19:23:25 GMT

GET
H/1.1 200
OK visitor Show response
sjrtp6.marketo.com/gw1/rtp/api/v1_1/ 578 B
1 KB 632ms
131ms XHR
application/json 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/rtp/api/v1_1/visitor?sid=cyberarksoftware-1687458203312-9f826ca7&aid=cyberarksoftware&1687458205226

Requested by

Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

002b1c0ccce224b5075de6a5411c7a5a68eac4737b98baccb4d6bf5436ee562c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma: No-cache
Date: Thu, 22 Jun 2023 18:23:25 GMT
Strict-Transport-Security: max-age=63113904
Last-Modified: Thu Jun 22 13:23:25 CDT 2023
Server: Jetty(9.4.45.v20220203)
Vary: Origin
Transfer-Encoding: chunked
Content-Type: application/json
Access-Control-Allow-Origin: https://www.cyberark.com
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
Connection: close
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sgm Show response
sjrtp6.marketo.com/gw1/ga/ 778 B
1 KB 657ms
132ms XHR
text/json 192.28.146.116
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp6.marketo.com/gw1/ga/sgm?sid=cyberarksoftware-1687458203312-9f826ca7&1687458205227

Requested by

Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.28.146.116 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(9.4.45.v20220203) /

Resource Hash

b7661d1399a600f4024ba515585b0d3ac26b772488761291851204e8a88481e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date: Thu, 22 Jun 2023 18:23:25 GMT
Strict-Transport-Security: max-age=63113904
Server: Jetty(9.4.45.v20220203)
Content-Type: text/json;charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: close
Content-Length: 778

POST
H2 200 s63139943615272 Show response
cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.23.0-LDQM/ 43 B
390 B 215ms
30ms XHR
image/gif 63.140.50.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.23.0-LDQM/s63139943615272

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EPbf7b42aa08bc4f10879b1484195e80d1/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.50.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:25 GMT
x-content-type-options: nosniff
last-modified: Fri, 23 Jun 2023 18:23:25 GMT
server: jag
etag: 3623788903409385472-4619630848498743734
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.cyberark.com
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 21 Jun 2023 18:23:25 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/choozle/14963/ 407 B
715 B 48ms
48ms Script
text/javascript 13.32.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/14963/code/&publishedOn=Fri%20Sep%2010%2017:02:39%20GMT%202021&ClientID=923&PageID=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-9.nrt57.r.cloudfront.net
Software: CloudFront /
Resource Hash: e90c8d0b3106d62cd056189b3a9f025284c8e003ff0c3a89baa49541a6794dd3

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
via: 1.1 d5447b27e44e9452384c28aa80912a8a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: NRT57-C1
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
content-length: 407
x-amz-cf-id: -vdxsNSaUx7WkHI7G7L0P3GNXegVZAzPuK_SmWKE8x0w2tjDi80T3Q==
expires: Thu, 22 Jun 2023 18:23:24 GMT

GET
H2 200 662433978d45e21970b804bbfa51742f.js Show response
nexus.ensighten.com/choozle/14963/code/ 1 KB
1 KB 28ms
26ms Script
application/javascript 13.32.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/code/662433978d45e21970b804bbfa51742f.js?conditionId0=4910939&conditionId1=4910940
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-9.nrt57.r.cloudfront.net
Software: CloudFront /
Resource Hash: e2007f491cf8805ceb2604c0b9aeb1adc383791b679f523665fb75a8aad1ea1c

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 07 Jun 2023 05:51:20 GMT
x-amz-version-id: .HDgNBMtyeldon8XYKIFOVut_y90kYAl
content-encoding: br
via: 1.1 d5447b27e44e9452384c28aa80912a8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 1341126
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 17 Aug 2021 20:02:58 GMT
server: CloudFront
etag: W/"1a30bb178f0ba4caee2d0a69ed0c5627"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: Ign6xtlZ6qBDy6F04vWQrTMxJtbytR7SGy2tOLgQRyGbM5qFnaGp2A==

GET
H2 200 7e3bcccbe9be6061a65a6eb142929580.js Show response
nexus.ensighten.com/choozle/14963/code/ 2 KB
854 B 37ms
37ms Script
application/javascript 13.32.50.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/choozle/14963/code/7e3bcccbe9be6061a65a6eb142929580.js?conditionId0=421905
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.50.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-50-9.nrt57.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 07 Jun 2023 09:09:23 GMT
x-amz-version-id: 2qpHT3Mfre2gibxJy2uyesrW3J5FKny0
content-encoding: gzip
via: 1.1 d5447b27e44e9452384c28aa80912a8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C1
age: 1329243
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 17 Aug 2021 20:01:10 GMT
server: CloudFront
etag: W/"45d815f98cb1ba2123f41b1c2cacac1e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: sVX-7jAyyqtYQqN55dbzPBuEMEptDICbpAmjQClRL4cNLHYQkq804Q==

GET
H3

200

396846.gif
idsync.rlcdn.com/
Redirect Chain

https://cs.choozle.com/dp/chz/24646?d=www.cyberark.com&cb=773987549
https://cs.choozle.com/sync
https://cs.choozle.com/sync?v=true&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89
https://tags.bluekai.com/site/48443?id=7e65acbd-5a84-49fa-a0fc-8583e0235a89&limit=1&redir=https%3A%2F%2Fcs.choozle.com%2Fsync%3Fpid%3D%24_BK_UUID%26dpsync%3Dbk%26cid%3D7e65acbd-5a84-49fa-a0fc-8583e...
https://cs.choozle.com/sync?pid=$_BK_UUID&dpsync=bk&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89
https://match.adsrvr.org/track/cmf/generic?ttd_puid=7e65acbd-5a84-49fa-a0fc-8583e0235a89&ttd_pid=gdmv7qs&ttd_tpi=1
https://cs.choozle.com/sync?pid=96f50d30-c297-4c94-9993-08e5b51e832d&dpsync=ttd&cid=7e65acbd-5a84-49fa-a0fc-8583e0235a89
https://idsync.rlcdn.com/459489.gif?partner_uid=7e65acbd-5a84-49fa-a0fc-8583e0235a89
https://idsync.rlcdn.com/1000.gif?memo=COGFHBIwCiwIARCp7AEaJDdlNjVhY2JkLTVhODQtNDlmYS1hMGZjLTg1ODNlMDIzNWE4ORAAGg0In6PSpAYSBQjoBxAAQgBKAA
https://us-u.openx.net/w/1.0/cm?id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://us-u.openx.net/w/1.0/cm?cc=1&id=e508c905-ddce-4732-92a4-0b0f5b72a28f&r=https%3A%2F%2Fidsync.rlcdn.com%2F396846.gif%3Fserved_by%3Devergreen%26partner_uid%3D
https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=83b270cf-06ba-4a4b-8edf-86412513faad

42 B
60 B

149ms
149ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=83b270cf-06ba-4a4b-8edf-86412513faad
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:28 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 22 Jun 2023 18:23:28 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://idsync.rlcdn.com/396846.gif?served_by=evergreen&partner_uid=83b270cf-06ba-4a4b-8edf-86412513faad
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 13 KB
5 KB 38ms
37ms Script
application/x-javascript 23.33.33.145
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.beta.min.js

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.33.33.145 , United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-33-33-145.deploy.static.akamaitechnologies.com

Software

Resource Hash

87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 21 Jun 2023 22:23:45 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=40340
accept-ranges: bytes
content-length: 4807

GET
H2 200 286320195733404 Show response
connect.facebook.net/signals/config/ 376 KB
107 KB 231ms
230ms Script
application/x-javascript 31.13.82.7
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/286320195733404?v=2.9.108&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.82.7 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-nrt1.fbcdn.net

Software

Resource Hash

71ce37998e08d18a96119069ce594408077bc7ef92fa20637a7cb842776851e7

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Thu, 22 Jun 2023 18:23:25 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: KX0hrqXUQM1jplgw7w//Wv8UyKnmxiqTYbhFABNIYzsa70IockmjmZyL9eGL9sHyVCd4xuRdE9z4UUAzTs1bYw==
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww... Show response
adservice.google.com/ddm/fls/i/ Frame 4CBA 617 B
735 B 458ms
63ms Document
text/html 142.251.42.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Requested by

Host: 9920016.fls.doubleclick.net
URL: https://9920016.fls.doubleclick.net/activityi;dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s46-in-f2.1e100.net

Software

cafe /

Resource Hash

1accabb6cb91b6a9b6edf56093785910e2f63743c165fbd547046d6ff89860d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://9920016.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 360
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 18:23:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 token Show response
cdn.linkedin.oribi.io/partner/17906/domain/cyberark.com/ 36 B
376 B 461ms
28ms XHR
application/json 13.33.174.32
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.linkedin.oribi.io/partner/17906/domain/cyberark.com/token
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.33.174.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-33-174-32.nrt57.r.cloudfront.net
Software: /
Resource Hash: 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept: *
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 17:29:54 GMT
content-encoding: gzip
via: 1.1 bcaa73dd9eb58937e5bb422fc78109e0.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3212
vary: accept-encoding
x-cache: Hit from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=3600
x-amz-cf-id: O31bwEs8E0KoE7OGEfmTjBhi6BSxjzOg7SxdIr96kar8kmHzvDijWA==

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malw...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1687458205674%26url%3Dhttps%253A%252F%252Fwww.cyberark.com%252Fres...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malw...

0
398 B

129ms
129ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cookiesTest=true&liSync=true
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:26 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 4BD5627DDA3D48F995664CF61AE60F48 Ref B: TYO01EDGE3321 Ref C: 2023-06-22T18:23:26Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX+u/r5bGiqtgfax8u1Cw==

Redirect headers

strict-transport-security: max-age=31536000
content-security-policy: default-src 'none'; connect-src 'self' *.licdn.com *.linkedin.com cdn.linkedin.oribi.io dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.microsoft.com *.adnxs.com; script-src 'report-sample' 'sha256-SSoodjUD3LGm2FfFCVHGqEb8D4UM3OOigidT2UKDcYg=' 'sha256-cKTgdnmO6+hXd85a9wKg1effVfVzenUAtUCyOKY9bQE=' 'sha256-DwtT8+ZZKpxH9pqZNAmJ3GdbLAh5SsYaXR3omTXPCns=' 'sha256-sV9jZa797T0QWBzcU/CNd4tpBhTnh+TFdLnfjlitl28=' 'sha256-aa/Q8CRBDSqTQbCIyioPhZaz+G+dbPyu7BzsjInEmiU=' 'sha256-THuVhwbXPeTR0HszASqMOnIyxqEgvGyBwSPBKBF/iMc=' 'sha256-zTIusdVJJeXz9+iox2a+pdDglzbpRpFVRzEwvW4AONk=' 'sha256-iC8MPqNLw0FDnsBf4DlSkFLNTwhkI85aouiAEB819ic=' 'sha256-2EqrEvcPzl8c6/TSGVvaVMEe7lg700MAz/te4/3kTYY=' 'sha256-y5uW69VItKj51mcc7UD9qfptDVUqicZL+bItEpvVNDw=' 'sha256-DatsFGoJ8gFkzzxo47Ou76WZ+3QBPOQHtBu9p9b3DhA=' 'sha256-k95cyM8gFgPziZe5VQ2IvJvBUVyd5zFt2CokIUwqdHE=' 'sha256-PyCXNcEkzRWqbiNr087fizmiBBrq9O6GGD8eV3P09Ik=' 'sha256-2SQ55Erm3CPCb+k03EpNxU9bdV3XL9TnVTriDs7INZ4=' 'sha256-S/KSPe186K/1B0JEjbIXcCdpB97krdzX05S+dHnQjUs=' 'sha256-3RIGhhApBii1KY+aW1xk7kFyoQY8vSVE5DfT7E9SJUc=' 'sha256-9pXOIwF4N0gPltLd3AI69lkCjSC2H/Eb3sc5zdmUyYU=' 'sha256-jou6v/Nleyzoc+LXktAv1Fp8M807dVVxy7E/yzVljHc=' 'sha256-6E4e/3dSvj/8JZT2S2yR91mspqM6MyOpKl5lrhHsZa8=' 'sha256-3woF8BZ54TeXM+czaH3aXoaJsVpiamuAKFsXDykAR/Q=' 'sha256-vIfNcKb8ixJg1cfJIoNNYjWcm0lezj1/XpUNFiZyVsU=' 'sha256-cLsHUHFgT/VGX04cZrJ9xgm4HbzTR7ptutkxK+7BlMk=' 'sha256-BwU8jMnQYUhjOpsDVABpfddV/DlP1ZYrFcTumYw7x54=' 'sha256-wz6ika9i3WU3bpUPdhYDZeO/NrDQniDyiscN0LWnyaY=' 'sha256-wy4DvlEW9PHPIGvQJW6Wv4woBSa/0LJHs8LHsBVVXCs=' 'sha256-065A0cJTDQ+hyKvufSL/flW02hIbgLndOINLRWux6To=' 'sha256-Ga5SLB8hPdWUE8Wb6LgZ05D9Z5vrdLAaPbDBW2m3BI8=' snap.licdn.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; img-src data: blob: * android-webview-video-poster:; font-src data: *; style-src 'self' 'unsafe-inline' static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; media-src 'self' *.licdn.com *.lynda.com; worker-src 'self' blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com; frame-src 'self' www.youtube.com/embed/ www.youtube-nocookie.com/embed/ lnkd.demdex.net smartlock.google.com accounts.google.com player.vimeo.com *.linkedin.com www.slideshare.net *.megaphone.fm *.omny.fm *.sounder.fm msit.powerbi.com app.powerbi.com linkedin.github.io *.licdn.com *.adnxs.com acdn.adnxs-simple.com radar.cedexis.com; frame-ancestors 'self' *.www.linkedin.com:*; manifest-src 'self'; report-uri https://www.linkedin.com/security/csp?f=default
x-content-type-options: nosniff
date: Thu, 22 Jun 2023 18:23:26 GMT
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAX+u/r3QugE9qo/FoCvNA==
pragma: no-cache
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 7A7371810E124AB19525C289CF530B57 Ref B: TYO01EDGE3321 Ref C: 2023-06-22T18:23:26Z
x-frame-options: sameorigin
x-li-fabric: prod-lor1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1687458205674&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cookiesTest=true&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1071691665/ 42 B
154 B 62ms
62ms Image
image/gif 142.250.196.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1071691665/?random=1687458205172&cv=11&fst=1687456800000&bg=ffffff&guid=ON&async=1&gtm=45He36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&frm=0&tiba=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&fmt=3&is_vtc=1&random=1512145930&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.196.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s35-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.co.jp/pagead/1p-user-list/1071691665/ 42 B
154 B 66ms
66ms Image
image/gif 216.58.220.99
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.co.jp/pagead/1p-user-list/1071691665/?random=1687458205172&cv=11&fst=1687456800000&bg=ffffff&guid=ON&async=1&gtm=45He36e2&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&frm=0&tiba=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&fmt=3&is_vtc=1&random=1512145930&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.220.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s30-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

iframe Show response
d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/ Frame 201E
Redirect Chain

https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

138 B
668 B

93ms
25ms

Document
text/html

99.84.138.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/code/662433978d45e21970b804bbfa51742f.js?conditionId0=4910939&conditionId1=4910940
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.138.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-138-44.nrt57.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

Accept-Ranges: bytes
Age: 26234
Cache-Control: max-age=86400
Connection: keep-alive
Content-Length: 138
Content-Type: text/html
Date: Thu, 22 Jun 2023 11:06:12 GMT
ETag: "d45046dc61fcd53aaf217c2c9496ec77"
Last-Modified: Fri, 01 Oct 2021 23:43:18 GMT
Server: AmazonS3
Via: 1.1 591400b2958a6516fdef3d2bc0ac208e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: ISMMT6_0KkA1ifPh_g25-fPW8SPbwnuu-p6IkuAWwMWk3VzI1OrWsg==
X-Amz-Cf-Pop: NRT57-C3
X-Cache: Hit from cloudfront
x-amz-server-side-encryption: AES256

Redirect headers

content-length: 183
content-type: text/html; charset=UTF-8
date: Thu, 22 Jun 2023 18:23:25 GMT
location: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET

GET
H2 200 a
www.googletagmanager.com/ 0
59 B 68ms
68ms Image
text/html 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=36479641&rv=36e2&cid=2025662&qi=0&l=2025662.EC1.TC0.HTC0~*~AWCT4383

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 a
www.googletagmanager.com/ 0
49 B 106ms
106ms Image
text/html 142.251.42.136
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=1548260035&rv=36e2&cid=GTM-5SFWTH&qi=0&l=GTM-5SFWTH.L518.S2.Y2.E3376.EC7.TC44.HTC17~gtm.init.S0.E747.TS5html.TI291.TE0~gtm.js.S0.E667.TS5ua.TI2.TE1.TS5html.TI26.TE0.TS5gclidw.TI34.TE2.TS6paused.TI36.TE0.TS5html.TI61.TE0.TS5html.TI75.TE0.TS5html.TI78.TE0.TS5html.TI80.TE0.TS5html.TI82.TE0.TS5html.TI252.TE0.TS5html.TI318.TE1.TS5html.TI327.TE0.TS5cl.TI341.TE0.TS5cl.TI342.TE0.TS5hl.TI345.TE0.TS5hl.TI346.TE0.TS5lcl.TI347.TE0.TS5lcl.TI348.TE0.TS5lcl.TI349.TE0.TS5lcl.TI350.TE0.TS5lcl.TI351.TE0.TS5lcl.TI352.TE0.TS5lcl.TI353.TE0.TS5lcl.TI354.TE0.TS5lcl.TI355.TE0.TS5lcl.TI356.TE0.TS5hl.TI357.TE0.TS5cl.TI358.TE0~gtm.dom.S0.E6.TS5html.TI200.TE0.TS5ytl.TI343.TE0~*.S0.E3~gtm.load.S2.E619.TS5sp.TI4.TE10.TS5bzi.TI15.TE3.TS6paused.TI29.TE0.TS6paused.TI59.TE0.TS5html.TI195.TE2.TS5html.TI196.TE1.TS6paused.TI309.TE0.TS5html.TI310.TE0.TS6paused.TI311.TE0.TS5html.TI317.TE11.TS5html.TI322.TE0.TS5html.TI337.TE0.TS5sdl.TI344.TE0~*.S0.E5~gtm.init_consent.S1.E16

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.42.136 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:25 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 201E
Redirect Chain

https://insight.adsrvr.org/track/pxl/?adv=0v1kpom&ct=0:u9beit9&fmt=3
https://dpm.demdex.net/ibs:dpid=903&dpuuid=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
https://ups.analytics.yahoo.com/ups/55953/sync?uid=96f50d30-c297-4c94-9993-08e5b51e832d&_origin=1&redir=true&gdpr=0&gdpr_consent=
https://ups.analytics.yahoo.com/ups/55953/sync?uid=96f50d30-c297-4c94-9993-08e5b51e832d&_origin=1&redir=true&gdpr=0&gdpr_consent=&verify=true
https://match.adsrvr.org/track/cmf/generic?ttd_pid=rightmedia&yahoo_id=y-pMPMZrRE2uIGR4439hVMgjkvd8vw0bo-~A&gdpr=0
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
https://tags.bluekai.com/site/5386?id=96f50d30-c297-4c94-9993-08e5b51e832d&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbluekai
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bluekai
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b...
https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d&google_gid=CAESEMqinPYUDW9SnVOcBWeUqy0&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d

170 B
243 B

69ms
68ms

Image
image/png

142.251.42.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d

Requested by

Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe

Protocol

Server

142.251.42.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s45-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://d1eoo1tco6rr5e.cloudfront.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Jun 2023 18:23:27 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=OTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJk&google_push&gdpr=0&gdpr_consent=&ttd_tdid=96f50d30-c297-4c94-9993-08e5b51e832d
content-type: text/html
cache-control: private,no-cache, must-revalidate
content-length: 423

GET
H2 200 collect
www.google-analytics.com/ 35 B
132 B 23ms
22ms Image
image/gif 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=974874542&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ul=en-us&de=UTF-8&dt=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP&ea=Organization&el=(not%20set)&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=1149250923.1687458203&tid=UA-44168172-9&_gid=697067956.1687458203&gtm=45He36e2n715SFWTH&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cd7=&cd1=(not%20set)&z=837804818

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 01:19:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61410
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 25ms
22ms Image
image/gif 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=974874542&t=event&ni=1&_s=3&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ul=en-us&de=UTF-8&dt=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=All%20visitors&el=Open%20Computer%20Network&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=1149250923.1687458203&tid=UA-44168172-9&_gid=697067956.1687458203&gtm=45He36e2n715SFWTH&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cd7=&cd1=(not%20set)&z=850211053

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 01:19:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61410
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 34ms
31ms Image
image/gif 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=974874542&t=event&ni=1&_s=4&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ul=en-us&de=UTF-8&dt=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Gartner%20MQ%202020&el=Open%20Computer%20Network&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=1149250923.1687458203&tid=UA-44168172-9&_gid=697067956.1687458203&gtm=45He36e2n715SFWTH&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cd7=&cd1=(not%20set)&z=654095305

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 01:19:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61410
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 35ms
32ms Image
image/gif 172.217.26.238
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=974874542&t=event&ni=1&_s=5&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&ul=en-us&de=UTF-8&dt=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=RTP-Segments&ea=Opt-In%20Campaign%20Audience&el=Open%20Computer%20Network&_u=aHBAgEABAAAAAGAEK~&jid=&gjid=&cid=1149250923.1687458203&tid=UA-44168172-9&_gid=697067956.1687458203&gtm=45He36e2n715SFWTH&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&cd7=&cd1=(not%20set)&z=1371881752

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.26.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

nrt12s51-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Jun 2023 01:19:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 61410
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 414ms
25ms Image
text/plain 31.13.82.36
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=286320195733404&ev=PageView&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&rl=&if=false&ts=1687458205978&sw=1600&sh=1200&v=2.9.108&r=stable&ec=0&o=30&fbp=fb.1.1687458205976.366848030&cs_est=true&it=1687458205655&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-nrt1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 22 Jun 2023 18:23:26 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 sa.css
tags.srv.stackadapt.com/ 65 B
203 B 416ms
415ms Stylesheet
text/css 3.210.10.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.css
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.10.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-10-81.compute-1.amazonaws.com
Software: /
Resource Hash: 8d3dc176c0f11904372addebfcd309b1940e367f4e12818a59801dd42f35045f

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 22 Jun 2023 18:23:26 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 65
content-type: text/css

GET
H2 200 sa.jpeg Show response
tags.srv.stackadapt.com/ 0
793 B 794ms
388ms Fetch
image/jpeg 3.210.10.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/sa.jpeg
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.10.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-10-81.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 22 Jun 2023 18:23:26 GMT
cache-control: only-if-cached, no-transform, private, max-age=7776000
content-length: 651
content-type: image/jpeg

GET
H2 200 dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww... Show response
adservice.google.co.jp/ddm/fls/i/ Frame 874A 194 B
515 B 609ms
70ms Document
text/html 216.58.220.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.co.jp/ddm/fls/i/dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CLyOpNe_1_8CFZHKfAodKboDDA;src=9920016;type=websi0;cat=websi0;ord=3693614295316;gtm=45fe36e2;auiddc=778638953.1687458202;uaa=;uab=;uafvl=;uam=;uamb=0;uap=;uapv=;uaw=0;~oref=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.220.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd10s01-in-f98.1e100.net

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 18:23:26 GMT
expires: Thu, 22 Jun 2023 18:23:26 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 368ms
367ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:26 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 05 Jun 2021 07:56:05 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "60bb2e15-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 core Show response
js.driftt.com/ Frame 3793 2 KB
1 KB 182ms
182ms Document
text/html 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1687458300000/ey22i6m9p82y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a674125d95e3fc480b38edd114b4ca43a7489de13ae1e50e263978e90d7a73a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 22 Jun 2023 18:23:26 GMT
etag: W/"4fdc11167f8e0cafa2e3cac12489c6b2"
last-modified: Wed, 21 Jun 2023 22:21:38 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-id: G8ZMpRlRbP3S2PRoRx302ypx60nxTpOlMOGLyysbcWTpsDuEiy9SMw==
x-amz-cf-pop: NRT57-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: orfU27a3eiMkQgvtDm5kk5ZqAtpGNhx6
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 41

GET
H2 200 chat Show response
js.driftt.com/core/ Frame E76E 2 KB
1 KB 474ms
474ms Document
text/html 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1687458300000/ey22i6m9p82y.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a674125d95e3fc480b38edd114b4ca43a7489de13ae1e50e263978e90d7a73a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 22 Jun 2023 18:23:26 GMT
etag: W/"4fdc11167f8e0cafa2e3cac12489c6b2"
last-modified: Wed, 21 Jun 2023 22:21:38 GMT
server: istio-envoy
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-id: C0Y5YNvElmZtlmiZ5lWEpPLZLGnRgs7H5OLnxlm0ywlG-oETx6E4ug==
x-amz-cf-pop: NRT57-C2
x-amz-server-side-encryption: AES256
x-amz-version-id: orfU27a3eiMkQgvtDm5kk5ZqAtpGNhx6
x-cache: RefreshHit from cloudfront
x-envoy-upstream-service-time: 22

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 9E7E 0
50 B 26ms
25ms Document
text/plain 31.13.82.36
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

31.13.82.36 Tokyo, Japan, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-nrt1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.cyberark.com
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: jp-jp,jp;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.cyberark.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Thu, 22 Jun 2023 18:23:26 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 saq_pxl Show response
tags.srv.stackadapt.com/ 160 B
355 B 207ms
207ms XHR
text/plain 3.210.10.81
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.srv.stackadapt.com/saq_pxl?uid=hLcqEj_jyS_TFE6yvRCw0w&is_js=true&landing_url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware&t=Chatting%20Our%20Way%20Into%20Creating%20a%20Polymorphic%20Malware&tip=A5xYxKrom4IXjMDWs6kmB2GmJAGhClS506I855jtvaQ&host=https://www.cyberark.com&sa-user-id-v2=s%253AMmzy58uKWzxNAfEgcklnG3KiRFs.Yh401U6zYg2qr1jqu8mh8DuSb504NjMSt8W3Tp8vuCo&sa-user-id=s%253A0-326cf2e7-cb8a-5b3c-4d01-f1207249671b.q990TwhWhXwNKwVWkT9XAYZdz78%252F%252BDZ2D2HxEIm1iFI
Requested by: Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.10.81 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-10-81.compute-1.amazonaws.com
Software: /
Resource Hash: 082f95fd455fbcd0b92dd51c6ff3e433324f2b1027a6e66126c1347ea32b83eb

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin: https://www.cyberark.com
date: Thu, 22 Jun 2023 18:23:26 GMT
access-control-allow-credentials: true
access-control-allow-headers: *
content-length: 160
access-control-allow-methods: GET
content-type: text/plain; charset=utf-8

GET
H2 200 runtime~main.29e7bbc8.js Show response
js.driftt.com/core/assets/js/ Frame 3793 6 KB
3 KB 27ms
25ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c06dafd8194732d9deac86a56f43764a14a677e8b22a6013a84e253103468ae7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: PnpSeQ0FMEKpfW2skbhDKEP5EYpToQ7Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Wed, 21 Jun 2023 21:49:08 GMT
server: istio-envoy
etag: W/"8c947065e705c50acc9f65784a2764e6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3FXJpTUmH1WZm09pq5TGLhn7Al1QTZKHPAwTIwR6z5AGlkRTgIIsiQ==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 35 KB
13 KB 30ms
28ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:17 GMT
x-amz-version-id: b6XJbkuvZEEn7J7htsXc1Vl79.l.eS2r
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886169
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 75
last-modified: Wed, 31 May 2023 20:40:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DCoSgPe43oBg3rfKXyLSRdvUgcCrD63v2AeFBlUUgceZT9htIjOFug==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 7 KB
3 KB 27ms
26ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: _6ChWa7QfxwgvKvHcksc0_7OHMp8jBKX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Tue, 20 Jun 2023 14:23:11 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aKkCO5AAkB9C6yrQsa7pYnMHymjXOWNJNf2jJORXV0nSdVGXkaiEkQ==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 23 KB
8 KB 33ms
32ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: i9K3oMJ4lcwzs7L1H0uHqTODCH9yxDX0
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: okcrGP2FUM9Z0wGybzxDcNv8URIyDv_yhMhEQ0ayS8FA4NxWK0qY_Q==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 36 KB
10 KB 32ms
31ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: qqlJ.jGYvjV.ksdTGdfk4WqAJUVMxq7Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 35
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: inJV102ZCH1gZfhNQN8KFkCD4Dit1XBG8FaryihI7as2DqGmODrpPA==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 32 KB
11 KB 32ms
32ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: zK.I5gIdSwLDVz8paigwY_NlFGMXuMgL
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Tue, 20 Jun 2023 14:23:09 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Wr4D6rkTJVXX9tb_CPRDIiGt50S9Z4Ysdg7U0NGi7HuBiaeHtrKSpw==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 17 KB
6 KB 32ms
31ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 15 May 2023 05:46:49 GMT
x-amz-version-id: A8PCvRLuKRqx56PjqjFJFLVzcOvxh1UH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3328597
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Fri, 12 May 2023 15:27:54 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HFfml90d61HvXArKS0h2RmK8mURvdNIlb8EhA_1QbYqBmOLkAvLDFg==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 25 KB
8 KB 38ms
37ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: XkvCriUrDEXSIfI2d4TJkh5K7LOJmj_E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 49
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9iCQ3yTa432Iw7XKPhFdNz0VE19t2mSTlZuYaOELFC_fDxdOpiMhIQ==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 74 KB
23 KB 50ms
50ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: p9cKi2v1ZeS6O9D0eHwytrFdtYVe5.j_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 65
last-modified: Wed, 31 May 2023 20:40:09 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2PYHeIg1z9FfDe452LvFbsgCBiKnG_SRscwKUcWywQHvQZ1_TMopIA==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 66 KB
20 KB 38ms
38ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: 2JZ9N3raOho8E83aJvHQu2bBRB60Stlp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Fri, 26 May 2023 19:24:42 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: w9VsUQ4xyUMCgRytkfpkVoROYgKAz_I5fDS8QC9PSxxGoGF1rY8VlQ==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 91 KB
28 KB 52ms
51ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:10:37 GMT
x-amz-version-id: X8NULpqxgWLAUvarKeoi6Wl_LVZDdp3S
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2412769
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 83
last-modified: Wed, 24 May 2023 17:52:52 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2E0LwxYqXES_X2JD1egLn-UBy3b458CaLGrcdz7-7BCSYSGHcLNFDA==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 23 KB
7 KB 32ms
32ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: 9ooik34XGyDf1uwzLLsqwhLNSCBMPtxI
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Wed, 31 May 2023 20:40:08 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ldoe7ngiCQk4ItiBXpZ-UKA8nuxo6VrQTqB6G7Z-7CpxqmKWNe7NzQ==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 62 KB
20 KB 50ms
50ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:56:43 GMT
x-amz-version-id: 2Y2C15EWisAbHkSluWpbvqf6zrYBWlCL
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2723203
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Fri, 19 May 2023 21:02:47 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QvlV4owEpGNx1bKLMNTxH9mNJVjt4fHtVPtrA132cDLkCq5cV4kZgQ==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 105 KB
34 KB 69ms
69ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 19 May 2023 20:34:07 GMT
x-amz-version-id: 02HNhnNSkVMTEGOMzac4ZRs9nu3NIUdU
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2929759
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Fri, 19 May 2023 20:29:44 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PTOk4VOH2ytHA1JgxTHN7jgSYuTTsWY0yBI3IgPZeEOlmLCBMC7QOw==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 12 KB
4 KB 53ms
52ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: u7HhgLuDaUaTVOr2B0i4rf5P0MUAguC5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 47
last-modified: Fri, 26 May 2023 19:24:43 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: EdDcJJoIfchtagBQuAKibSOwR_YgIDV28gulo0NyZZoudaLhImU-vg==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 13 KB
6 KB 53ms
53ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: z2E8fntGEC6KdVybKcw_W_bTDQ7KMyTm
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Fri, 26 May 2023 19:24:43 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: y6zisN5E3kC6rJiut1_iQieTZ2hG3h-kwgpTp0-Rkhcky17nzxNoCA==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 17 KB
7 KB 53ms
52ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 12 May 2023 13:09:32 GMT
x-amz-version-id: B1mykqCE9wypmwFjSVTi8fOhqWzBquxj
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3561233
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 11 May 2023 20:21:36 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1H1XRXex91SRavApvD66CtaE60ejoB_t0OrZ6d_PDDd9lbbYS6BbmA==

GET
H2 200 8.b5c2854f.chunk.css
js.driftt.com/core/assets/css/ Frame 3793 31 KB
4 KB 53ms
52ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.b5c2854f.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

178c7e0dd0c602d457b8d91dd18b916c3f4220794fccb6067cac187f0c753795

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: 9O.tQkQ_hMWQ2q5xsgJUvZyZlXW1qId4
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 24
last-modified: Wed, 31 May 2023 20:40:07 GMT
server: istio-envoy
etag: W/"9ef689f5d4cb5dab3b0e463418857c2f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: yhL_7Zr7TtV1LKcPXO-Oh8HgQ-HlB6x-9YDOHTfw-fEHv-VWKjE2Vg==

GET
H2 200 8.59031137.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 81 KB
26 KB 60ms
60ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.59031137.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5e6ecec8d78c9d3f391fac9bde08b4f66048ab4ce9d97d3774b3d223f18b43a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:41:46 GMT
x-amz-version-id: mX6rE2o9yEuyyc5.e0Eljqe1UZq6B.fq
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1464100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Mon, 05 Jun 2023 18:44:53 GMT
server: istio-envoy
etag: W/"c01af04dcc374efd61d695b2f1e6a2c5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QJDEh8jFR5dc4KAgtXHxqL7aUIvoay9fntnISw29rvlcps4mGgR40A==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 3793 24 B
696 B 51ms
50ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 21:11:07 GMT
x-amz-version-id: 1y7pXKIu70VmaUQD0WR8r5c4woyvE2.v
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C2
age: 1890739
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 80
content-length: 24
last-modified: Wed, 31 May 2023 20:40:07 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: n4Ok939vn3Vr88idWvgQCPjBSg1sqwzKbYfcIDbQVlvBpD_e9Y9YmA==

GET
H2 200 16.644983a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 91 KB
23 KB 50ms
49ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.644983a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

004745e1b78507d7532c693dd27969eb13234ffd30bec47fabad8a8283039ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: Bl84ZF5FNLU913swnAHHTbDJC4uSct.E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 54
last-modified: Tue, 20 Jun 2023 14:23:08 GMT
server: istio-envoy
etag: W/"598efa302706d87c112018b709fed2fe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7eU_ZOeqMHU5cGVOomxL41f-Cgb-RtZouqcDgoj_-dKphhsn-1697w==

GET
H2 200 24.eb377d6e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 50 KB
14 KB 50ms
49ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.eb377d6e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ee8ca8c91fcd24f08020ebf661c983c9b2cbd4f53beda1d8cb06564caa53306c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: P1W94I8vD4zB1jXj9xsS2chKQyB0t6gr
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Wed, 21 Jun 2023 21:49:06 GMT
server: istio-envoy
etag: W/"e57776f125522bfc8521f443d064a442"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CUDOlXzYDX1Al8Tk1iHh2LwnX75e8uK2zioZj1SNN6nelOKL0fS8-A==

GET
H2 200 17.50bc2056.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 40 KB
13 KB 49ms
49ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.50bc2056.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dab54de58d19c5f357ddc3063394e63d42980b087b8be19aa2303b67fb0aaee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: 0ljQUI3VBI6Z4zCulpGMaML_5wz39icP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Wed, 21 Jun 2023 21:49:05 GMT
server: istio-envoy
etag: W/"6898197a036dec9c2dc962b5bf091df9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2EAebN8J2psJj4O0h5aEd_mqbCje-NjVqKvfbmbFc8mc-BSVhWBC9g==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 9 KB
3 KB 28ms
28ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 09 May 2023 19:52:47 GMT
x-amz-version-id: 9txt1e7t.mN3CfE_7JSf4I0op6bADUL6
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3796239
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 09 May 2023 18:32:21 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MkEQBCrTPubq9KsGVIdNx9ydLVyXIhWqTOvrMG2vjzyKUtdVtT-WbQ==

GET
H2 200 27.01c2bea5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 35 KB
10 KB 29ms
28ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.01c2bea5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 17:30:52 GMT
x-amz-version-id: oxbZPLoS235ekxTU4zXMGRASV29eRINr
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2422353
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 49
last-modified: Wed, 24 May 2023 17:36:06 GMT
server: istio-envoy
etag: W/"04a233a42dcf8c50a83bfecea8ba552d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3X_L0F6jJcGnlhB4lyvH7WvufvyuW6OGSeESwqb6qUoSiQUlbwFVOQ==

GET
H2 200 28.9bf46b67.chunk.css
js.driftt.com/core/assets/css/ Frame 3793 8 KB
2 KB 27ms
26ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/28.9bf46b67.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:21 GMT
x-amz-version-id: WMsknmRH75RDnU0QttMsA6qSziFQYpzP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886165
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Wed, 31 May 2023 20:40:07 GMT
server: istio-envoy
etag: W/"4f21faf2ba450e5fcdf7eda90813e185"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Pc4CpjMv1yJIJZyhEOe8Rc5mZaufrKayKU8S_01h30tk8FhqeWBk2w==

GET
H2 200 28.bdd92ff2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 14 KB
6 KB 27ms
27ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.bdd92ff2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:48 GMT
x-amz-version-id: FN2mK9FP.1iG0EPXu5GaP7vFrDcTGt2G
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183698
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Tue, 20 Jun 2023 14:23:09 GMT
server: istio-envoy
etag: W/"260fbabe310bd2cae5c44538f3d833ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uJgoDfX0nuwfBwHOAvbSzsbIjy3ZtE0gLNLG15RJpAAXSB7DwNqH1g==

GET
H2 200 25.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 3793 365 B
1 KB 27ms
27ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:48 GMT
x-amz-version-id: ZuuQmAv287PLv09x8YJDQ63ijAfFLcLS
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C2
age: 183698
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 20
content-length: 365
last-modified: Tue, 20 Jun 2023 14:23:06 GMT
server: istio-envoy
etag: "06b2963b029c0824382815165bfea73e"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WG23Fp0nD9lo8IRg_fwDkXst9MYJV_RV1EjQXsOCX9bU0fcslYkt6Q==

GET
H2 200 25.fd3790b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3793 90 KB
24 KB 29ms
29ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.fd3790b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d90ec1f3b6ea093b95658573d1937e85ef196d6322f8f2a61f879640f980fcf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core?d=1&embedId=ey22i6m9p82y&eId=ey22i6m9p82y&region=US&forceShow=false&skipCampaigns=false&sessionId=cc181a9b-e165-4d74-908f-363b0dbfd8e4&sessionStarted=1687458206.377&campaignRefreshToken=e6bcaf06-d41b-4a6f-a14b-3556cd6736bf&hideController=false&pageLoadStartTime=1687458201230&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:48 GMT
x-amz-version-id: o_Ra3W5ht6TYHMvlfZ0bnFiPHq6XUlQ2
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183697
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 20 Jun 2023 14:23:09 GMT
server: istio-envoy
etag: W/"3f7270d4b2ad9d23b9781e7911c6e9b9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oHW5VsIUNrNFoD9Wu0oAy01U69RCqa4pTzQX7xpDcjUSZk7v8DEGkw==

GET
H2 200 runtime~main.29e7bbc8.js Show response
js.driftt.com/core/assets/js/ Frame E76E 6 KB
3 KB 24ms
23ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c06dafd8194732d9deac86a56f43764a14a677e8b22a6013a84e253103468ae7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: PnpSeQ0FMEKpfW2skbhDKEP5EYpToQ7Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Wed, 21 Jun 2023 21:49:08 GMT
server: istio-envoy
etag: W/"8c947065e705c50acc9f65784a2764e6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3d7zXn87DoQZK_Jh0m6-HX3TGsLYBACr4paC7-gxvXy8iStYv60eJQ==

GET
H2 200 9.4a3e9801.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 35 KB
13 KB 34ms
32ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.4a3e9801.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:17 GMT
x-amz-version-id: b6XJbkuvZEEn7J7htsXc1Vl79.l.eS2r
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886169
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 75
last-modified: Wed, 31 May 2023 20:40:11 GMT
server: istio-envoy
etag: W/"c6f58dd3d60f07462254b842dd4f9ca1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: emREtoZ9GOSq6R0kY1gUvtFzAw1SPywNTIaSSAdmnF_JdQbxtLo7KQ==

GET
H2 200 main~493df0b3.d2a43907.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 7 KB
3 KB 36ms
35ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.d2a43907.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
Origin: https://js.driftt.com
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: _6ChWa7QfxwgvKvHcksc0_7OHMp8jBKX
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 37
last-modified: Tue, 20 Jun 2023 14:23:11 GMT
server: istio-envoy
etag: W/"e094b276ad2035c3a46871991c258c2d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Wq702b5lDfXN8xRUZzQfiX750rmbtIksnqqEHPHHzVOtMmjI7ifiiA==

GET
H2 200 51.558be3c5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 23 KB
8 KB 27ms
22ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: i9K3oMJ4lcwzs7L1H0uHqTODCH9yxDX0
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"fa281fcbe4b2e35558d60fae3e316367"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8hnnBOSXFcEEgofALDPnP6eUa3xHemcGfbxp-5llIRVQu35OWeXhCQ==

GET
H2 200 35.d0f1ccda.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 36 KB
10 KB 35ms
23ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.d0f1ccda.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: qqlJ.jGYvjV.ksdTGdfk4WqAJUVMxq7Z
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 35
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"46fa5a7bc37a22544a908e4ad950309c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3oU2qwhZPdlwuS0jt7rsKJUQaUbdIpa7hIJ30jpdSFbZPOyxqyKGnQ==

GET
H2 200 22.6b9a301a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 32 KB
11 KB 37ms
26ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.6b9a301a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: zK.I5gIdSwLDVz8paigwY_NlFGMXuMgL
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Tue, 20 Jun 2023 14:23:09 GMT
server: istio-envoy
etag: W/"d8739a9fe9a3a42936f5cd86c8727494"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vLfvUcrGwn-jQ1b4NYhP4bnF4EvZaJlaAbanS5gEhQo0zj8R5IDPhQ==

GET
H2 200 19.6f85b843.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 17 KB
6 KB 36ms
26ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.6f85b843.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 15 May 2023 05:46:49 GMT
x-amz-version-id: A8PCvRLuKRqx56PjqjFJFLVzcOvxh1UH
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3328597
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 41
last-modified: Fri, 12 May 2023 15:27:54 GMT
server: istio-envoy
etag: W/"e28ebc3391b56e8f01ea063dc089e9d3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WHSsqay5HnRb7PpE_r4hvXLorqpP1-ifKQ6xVK8GMs2-uXMdADr-xA==

GET
H2 200 41.b4fc4de2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 25 KB
8 KB 37ms
27ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.b4fc4de2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: XkvCriUrDEXSIfI2d4TJkh5K7LOJmj_E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 49
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"a2ace4f65aa7b34dedb884f6cfe9df8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8bRop4tDv-lmhPXqryPhEtksT7D00PV8c0SGxGWSxZ89TYFdawd6Tg==

GET
H2 200 20.8c21ea18.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 74 KB
23 KB 37ms
28ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: p9cKi2v1ZeS6O9D0eHwytrFdtYVe5.j_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 65
last-modified: Wed, 31 May 2023 20:40:09 GMT
server: istio-envoy
etag: W/"6d77a76055d81227033363af2f18caf8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: opisJ2e7H_cwKycTVnJQPZfD3pYGOg_y79L2i1E1Lxjp9dfQPaeDwQ==

GET
H2 200 26.04e7f30b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 66 KB
20 KB 41ms
31ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.04e7f30b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: 2JZ9N3raOho8E83aJvHQu2bBRB60Stlp
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 25
last-modified: Fri, 26 May 2023 19:24:42 GMT
server: istio-envoy
etag: W/"49ce5445ddcf5d24ef3badc4eb1a11dd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IqNDELoDW6PJz_EL94k7op-g0T2lKvQlYvL4rV4vDNoyo0A0K_S8cQ==

GET
H2 200 14.e24a6190.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 91 KB
28 KB 43ms
33ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.e24a6190.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:10:37 GMT
x-amz-version-id: X8NULpqxgWLAUvarKeoi6Wl_LVZDdp3S
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2412769
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 83
last-modified: Wed, 24 May 2023 17:52:52 GMT
server: istio-envoy
etag: W/"16d7ae86e21434a32157d3226ac9bb77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uhLaZrKVramPjQbOrmAOp61O3dV-5uapWP--kgB_do7Yz0zpm2g6MQ==

GET
H2 200 11.639238ba.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 23 KB
7 KB 44ms
34ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.639238ba.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:19 GMT
x-amz-version-id: 9ooik34XGyDf1uwzLLsqwhLNSCBMPtxI
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886167
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Wed, 31 May 2023 20:40:08 GMT
server: istio-envoy
etag: W/"4049f38c00add1738dc4806148ff8829"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: b7UF3wnsOR0AatabDKD6Eh9_jqq5KdcspAGcMxMjkYwhpTKgdNnXnA==

GET
H2 200 18.9c1bd1fb.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 62 KB
20 KB 52ms
42ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c1bd1fb.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 22 May 2023 05:56:43 GMT
x-amz-version-id: 2Y2C15EWisAbHkSluWpbvqf6zrYBWlCL
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2723203
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Fri, 19 May 2023 21:02:47 GMT
server: istio-envoy
etag: W/"02f09379c544befa413d22eb57ed41de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dbduDvYL2O1AY7dVzmun2HJiOzg6ziFnX6lsTQHQ9pE4jnV4VKr2cA==

GET
H2 200 49.f7274268.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 105 KB
34 KB 53ms
44ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/49.f7274268.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 19 May 2023 20:34:07 GMT
x-amz-version-id: 02HNhnNSkVMTEGOMzac4ZRs9nu3NIUdU
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2929759
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Fri, 19 May 2023 20:29:44 GMT
server: istio-envoy
etag: W/"e268d36b98f0119a2bb1a15f69fd4ffe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: G5D4kz90ezaqPNyxe6jIQDDV9RWLzpLosU-ysu8qng7B8mOKpKbIAg==

GET
H2 200 40.31ef8dbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 12 KB
4 KB 54ms
45ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.31ef8dbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: u7HhgLuDaUaTVOr2B0i4rf5P0MUAguC5
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 47
last-modified: Fri, 26 May 2023 19:24:43 GMT
server: istio-envoy
etag: W/"b0793fa46e8c0ae1846b7be8a833da35"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8LzRzWKqPH4zn1-bb65w6o-VE5tLZpo15hWBJ3gfGVRS3u43fpFh_Q==

GET
H2 200 29.31d09948.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 13 KB
6 KB 53ms
45ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.31d09948.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:40 GMT
x-amz-version-id: z2E8fntGEC6KdVybKcw_W_bTDQ7KMyTm
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 33
last-modified: Fri, 26 May 2023 19:24:43 GMT
server: istio-envoy
etag: W/"455157cb49065fb85fed54901ddaeb0e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MLpFa7T9ac8DHs3SNM4IDl5W2eUeArn-CBXrktbl9D_GLKOFFyd3lQ==

GET
H2 200 21.b8c41db9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 17 KB
7 KB 53ms
46ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 12 May 2023 13:09:32 GMT
x-amz-version-id: B1mykqCE9wypmwFjSVTi8fOhqWzBquxj
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3561233
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Thu, 11 May 2023 20:21:36 GMT
server: istio-envoy
etag: W/"65e5c965272e021ae33ff8bc39565ef5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AySKpE0iglsZeV_dh-_y8kHlHPA6_3gKewlZVQUwdtsVc2mBrLD1gg==

GET
H2 200 8.b5c2854f.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 31 KB
4 KB 49ms
43ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.b5c2854f.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

178c7e0dd0c602d457b8d91dd18b916c3f4220794fccb6067cac187f0c753795

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:18 GMT
x-amz-version-id: 9O.tQkQ_hMWQ2q5xsgJUvZyZlXW1qId4
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886168
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 24
last-modified: Wed, 31 May 2023 20:40:07 GMT
server: istio-envoy
etag: W/"9ef689f5d4cb5dab3b0e463418857c2f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5T4XJc8SC_faTZkF6FFo6piLSJzCWvUNYjRxjhn1KC9KQ2cXbBJILg==

GET
H2 200 8.59031137.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 81 KB
26 KB 56ms
50ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.59031137.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5e6ecec8d78c9d3f391fac9bde08b4f66048ab4ce9d97d3774b3d223f18b43a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:41:46 GMT
x-amz-version-id: mX6rE2o9yEuyyc5.e0Eljqe1UZq6B.fq
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1464100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 42
last-modified: Mon, 05 Jun 2023 18:44:53 GMT
server: istio-envoy
etag: W/"c01af04dcc374efd61d695b2f1e6a2c5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: LTNvDVxtNflksGXYJ_URtbJgnhGGFWQzC-RT3v622RUDAcEmQd9Rqg==

GET
H2 200 16.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 24 B
696 B 49ms
43ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/16.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 21:11:07 GMT
x-amz-version-id: 1y7pXKIu70VmaUQD0WR8r5c4woyvE2.v
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-pop: NRT57-C2
age: 1890739
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 80
content-length: 24
last-modified: Wed, 31 May 2023 20:40:07 GMT
server: istio-envoy
etag: "0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kisb_9cWYA6DN6gLrSzk2O3yWZU3g9uzOCdMkx4lIabJ0mZK1aksmg==

GET
H2 200 16.644983a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 91 KB
23 KB 57ms
52ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.644983a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

004745e1b78507d7532c693dd27969eb13234ffd30bec47fabad8a8283039ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 15:21:47 GMT
x-amz-version-id: Bl84ZF5FNLU913swnAHHTbDJC4uSct.E
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 183699
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 54
last-modified: Tue, 20 Jun 2023 14:23:08 GMT
server: istio-envoy
etag: W/"598efa302706d87c112018b709fed2fe"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: OCsFT6n1hq6Ou-Z7R-aWVzwsXFp5Hm5DM1a6MhV0l6G6Lqq5duw0QQ==

GET
H2 200 24.eb377d6e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 50 KB
14 KB 58ms
53ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.eb377d6e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

ee8ca8c91fcd24f08020ebf661c983c9b2cbd4f53beda1d8cb06564caa53306c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: P1W94I8vD4zB1jXj9xsS2chKQyB0t6gr
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 15
last-modified: Wed, 21 Jun 2023 21:49:06 GMT
server: istio-envoy
etag: W/"e57776f125522bfc8521f443d064a442"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6ErEpRPdPClqg0xxdbOftvh40O4rjMCvpAoJwYcKWk8uKvEAWw7gaA==

GET
H2 200 17.50bc2056.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 40 KB
13 KB 58ms
54ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.50bc2056.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dab54de58d19c5f357ddc3063394e63d42980b087b8be19aa2303b67fb0aaee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 21 Jun 2023 22:21:38 GMT
x-amz-version-id: 0ljQUI3VBI6Z4zCulpGMaML_5wz39icP
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 72108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Wed, 21 Jun 2023 21:49:05 GMT
server: istio-envoy
etag: W/"6898197a036dec9c2dc962b5bf091df9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _5NFW4C5a2B12bZ0S8QDiVZOcUKHI6PuYpSuljsbe1X7lhnTq-SOag==

GET
H2 200 37.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 3 KB
1 KB 41ms
41ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/37.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 25 May 2023 17:55:39 GMT
x-amz-version-id: 9FbuEscQOmGB47toXM_4tv233QWBtNaO
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2420868
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 52
last-modified: Wed, 24 May 2023 17:52:51 GMT
server: istio-envoy
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WUSgKq7FSh80q14EI-BhOnZHMdyOHnmi43UCY2t6ucciedMIHIFN2Q==

GET
H2 200 37.298cbb69.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 3 KB
2 KB 42ms
42ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.298cbb69.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 22 May 2023 22:25:38 GMT
x-amz-version-id: HEnYLfcEsyXJrOvM_yE3DW_BUj6412I_
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2663869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 61
last-modified: Fri, 19 May 2023 16:58:22 GMT
server: istio-envoy
etag: W/"86b289eeb2bf9d30034f30d9794e8041"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: diy2ss-h6T7TdWP0QkfnHYcCmbq84tkMHKu2D6SiJJdPaFdTUdAIXQ==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 9 KB
3 KB 26ms
25ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 09 May 2023 19:52:47 GMT
x-amz-version-id: 9txt1e7t.mN3CfE_7JSf4I0op6bADUL6
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 3796240
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 19
last-modified: Tue, 09 May 2023 18:32:21 GMT
server: istio-envoy
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _Nal0LlQYWXA01YtLYK24MnyzQ5VPyRY5eUiuKe4_5mU9MqKJPRXVA==

GET
H2 200 3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 7 KB
2 KB 27ms
26ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 29 May 2023 06:27:41 GMT
x-amz-version-id: u3cDjCK2qRCXB7vQvmDyL9.B6zZ7HylF
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2116546
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Fri, 26 May 2023 19:24:40 GMT
server: istio-envoy
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p_-SUC5LV33LzdRPwOu5xv7FrYQa9lqoEFQDUgbgyrEdBPHpUh_uvg==

GET
H2 200 3.f50b964b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 54 KB
15 KB 26ms
25ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 22:27:21 GMT
x-amz-version-id: GnZ3JKaloOgHBFt_mkV4zz0TtajeQf3n
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1886166
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 40
last-modified: Wed, 31 May 2023 20:40:10 GMT
server: istio-envoy
etag: W/"1ac37bf2b93050f29058b66a9ad43e10"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: P-0hWl6vujw3pEAnm6L-vA-anrc0437hML5JDvEk4npLUwHGL8M_YQ==

GET
H2 200 1.573fce08.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 44 KB
7 KB 32ms
32ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.573fce08.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6ca4f32f43694ee56dda6581a83ef02225af274dc0aee381e86284c091911913

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 16 Jun 2023 14:59:04 GMT
x-amz-version-id: XdFniRGgVHIu8.3BmgbjhB8YM7.t.OSn
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 530663
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 31
last-modified: Fri, 16 Jun 2023 14:07:10 GMT
server: istio-envoy
etag: W/"21db740ef8d5ab04f559239c11897518"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: boZmCZe1YF0wGVPtwma6fhryZA2QQk-qH-OHvILKNsqdIQijrOLUsA==

GET
H2 200 1.8a107c9e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 54 KB
17 KB 26ms
25ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.8a107c9e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

0259ae631427786951bb46b638b6c9607a8460331ca60fe1a8912e058c8cb19f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 16 Jun 2023 14:59:04 GMT
x-amz-version-id: CjIxxWMR53UPB_jmNgKS_PSktCb5IxMv
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 530663
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 24
last-modified: Fri, 16 Jun 2023 14:07:11 GMT
server: istio-envoy
etag: W/"cd10f635726fbe9480c69c78e988a39f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NCWtpqVrZsoOx_TTxpeY5yn7fGZQou65oKgPjLIhqzFeZOL9lOx5BQ==

GET
H2 200 4.df982179.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 23 KB
10 KB 33ms
32ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.df982179.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

6882bb97b25bf71ecd9de333bcaa4eea46fd9f6763b383d07eff4c73b9c7ba30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:41:47 GMT
x-amz-version-id: EOVbfnrsTrIQ8NFWsQ8ZOxAK.5aO8WSS
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1464100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 21
last-modified: Mon, 05 Jun 2023 18:44:53 GMT
server: istio-envoy
etag: W/"714f93293759e579de42cfdc6c40fe53"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: I7RR0bZgWi2f_3U1LzM1MpjG2R8479GPz97oc_vKz_sjeVRpCexzZw==

GET
H2 200 34.a3318c5e.chunk.css
js.driftt.com/core/assets/css/ Frame E76E 14 KB
3 KB 32ms
31ms Stylesheet
text/css 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/34.a3318c5e.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 27 May 2023 08:18:39 GMT
x-amz-version-id: bwlTy09lobw5c0lfRCnlT2n0Da8buzva
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 2282687
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 17
last-modified: Fri, 26 May 2023 19:24:40 GMT
server: istio-envoy
etag: W/"b06e02b360914b25e58305b1b9b954dc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TIQ-FiZnopxqN-P75w4vdXSR6z6RWQp9vmAeqKQBkK64XKUjOlNkOQ==

GET
H2 200 34.3fee3c03.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E76E 12 KB
5 KB 31ms
30ms Script
application/javascript 13.33.174.58
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.3fee3c03.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.29e7bbc8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.174.58 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-174-58.nrt57.r.cloudfront.net

Software

istio-envoy /

Resource Hash

30addc9d73a2827ba55e8c495cd6765101d360a2ba24978382909312ae672f1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1687458201230
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Mon, 05 Jun 2023 19:41:47 GMT
x-amz-version-id: yo299Njnv65cVTNb.hdB4JAnPZYP1F0H
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 e4404fd3b1d2ac38d3124fbc6bbedc8a.cloudfront.net (CloudFront)
x-amz-cf-pop: NRT57-C2
age: 1464100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-envoy-upstream-service-time: 23
last-modified: Mon, 05 Jun 2023 18:44:53 GMT
server: istio-envoy
etag: W/"6d91f1b96a5a6247935f7e3735fa44ac"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xo8BB9JAlvSQ3R4zQi0hQa50NplOSH6k5vElf_VTNyDdB3PWD5dhOA==

POST
H2 200 v2 Show response
bootstrap.api.drift.com/widget_bootstrap/ping/ Frame 3793 162 B
602 B 606ms
196ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

b8f62e67333c47bda5644ad6c9a9dbfb884daca66790d3a5ce391315219381e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 22 Jun 2023 18:23:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: ac029dda64e88b5f
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 2
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 162

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
484 B 365ms
364ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:27 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 00:49:36 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f020a0-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 200 v3 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 3793 25 B
111 B 1060ms
1055ms XHR
application/json 54.147.21.139
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/51.558be3c5.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-147-21-139.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
accept-language: jp-jp,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 22 Jun 2023 18:23:28 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: istio-envoy
requestid: a7a76da60ee9b38
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
vary: Accept-Encoding
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25

POST widget_bootstrap
bootstrap.api.drift.com/ Frame 3793 0
0

GET
H2 200 img.gif
b.6sc.co/v1/beacon/ 43 B
485 B 365ms
364ms Image
image/gif 23.200.55.30
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.200.55.30 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a23-200-55-30.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-jp,jp;q=0.9
Referer: https://www.cyberark.com/resources/threat-research-blog/chatting-our-way-into-creating-a-polymorphic-malware
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 18:23:28 GMT
x-content-type-options: nosniff
content-length: 43
pragma: no-cache
last-modified: Sat, 18 Feb 2023 01:45:17 GMT
server: nginx/1.14.0 (Ubuntu)
etag: "63f02dad-2b"
access-control-max-age: 86400
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: *
expires: Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bootstrap.api.drift.com
URL: https://bootstrap.api.drift.com/widget_bootstrap

Verdicts & Comments Add Verdict or Comment

205 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

71 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.cyberark.com/	1969-12-31 23:59:59	Name: _MGZ_ Value: 1744duujbkvq2jaguhr7ruivg7
www.cyberark.com/	1970-01-20 21:29:54	Name: pdf_event Value: WyJbe1widXVpZFwiOjIyMzQwNTk1MTR9LDE3MTg5OTQyMDBdIiwiNWQzZjAzOGZiMTkzYzJlYjEwNWQ1N2JjOWRmODU2ZDgiXQ%3D%3D
.www.cyberark.com/	1970-01-20 21:29:54	Name: _ufav Value: 8a5dbe0dbfad4d13b11aeb850c8ba2da
.www.cyberark.com/	1970-01-20 12:44:21	Name: _ufas Value: 220b0730cfe6407c99e3287ddb52091d
www.cyberark.com/	1970-01-20 12:44:20	Name: ufentry Value: 20230622.145321
.cyberark.com/	1970-01-20 21:29:54	Name: _mkto_trk Value: id:316-CZP-275&token:_mch-cyberark.com-1687458201959-67793
.ml314.com/	1970-01-20 12:44:18	Name: u Value: aHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9jaGF0dGluZy1vdXItd2F5LWludG8tY3JlYXRpbmctYS1wb2x5bW9ycGhpYy1tYWx3YXJl
.ml314.com/	1970-01-20 21:31:20	Name: pi Value: 3636573452440698880
.ml314.com/	1970-01-20 13:04:27	Name: tp Value: 3%3b6%2f22%2f2023+2%3a23%3a22+PM%3b0
.cyberark.com/	1969-12-31 23:59:59	Name: at_check Value: true
.adsrvr.org/	1970-01-20 21:31:20	Name: TDID Value: 96f50d30-c297-4c94-9993-08e5b51e832d
.eyeota.net/	1970-01-20 21:31:20	Name: mako_uid Value: 188e458c270-43650000010e5852
.eyeota.net/	1970-01-20 12:44:18	Name: SERVERID Value: 22610~DM
.cyberark.com/	1970-01-20 14:53:54	Name: _gcl_au Value: 1.1.778638953.1687458202
.demdex.net/	1970-01-20 17:03:30	Name: demdex Value: 00918483426505055193043380391235235047
.cyberark.com/	1969-12-31 23:59:59	Name: AMCVS_9AB97041603F3EDB0A495C66%40AdobeOrg Value: 1
.dpm.demdex.net/	1970-01-20 17:03:30	Name: dpm Value: 00918483426505055193043380391235235047
.crwdcntrl.net/	1970-01-20 19:13:04	Name: _cc_dc Value: 2
.crwdcntrl.net/	1970-01-20 19:13:04	Name: _cc_id Value: 400dc49b75022846349e2da2cc2fd8da
.cyberark.com/	1970-01-20 12:44:20	Name: TAsessionID Value: c826d742-2278-4c5b-b3ca-ec59bbb58b42\|NEW
.cyberark.com/	1969-12-31 23:59:59	Name: notice_behavior Value: implied,eu
.cyberark.com/	1970-01-20 14:53:54	Name: _rdt_uuid Value: 1687458202946.82a51669-b3cb-4b2b-b9ec-9ad6228ac595
.everesttech.net/	1970-01-20 21:29:54	Name: everest_g_v2 Value: g_surferid~ZJSRmgAAAHHfcwN1
.cyberark.com/	1970-01-20 22:20:18	Name: _ga Value: GA1.2.1149250923.1687458203
.cyberark.com/	1970-01-20 12:45:44	Name: _gid Value: GA1.2.697067956.1687458203
.cyberark.com/	1970-01-20 12:44:18	Name: _dc_gtm_UA-44168172-9 Value: 1
.cyberark.com/	1970-01-20 21:29:54	Name: _hjSessionUser_1200039 Value: eyJpZCI6Ijk3MTY4ZDkxLWVlYjctNWY3NC1hYmY0LTk5N2NhZTJiZTVkOCIsImNyZWF0ZWQiOjE2ODc0NTgyMDMwNTksImV4aXN0aW5nIjpmYWxzZX0=
.cyberark.com/	1970-01-20 12:44:20	Name: _hjFirstSeen Value: 1
.cyberark.com/	1970-01-20 12:44:18	Name: _hjIncludedInSessionSample_1200039 Value: 0
.cyberark.com/	1970-01-20 12:44:20	Name: _hjSession_1200039 Value: eyJpZCI6IjQzNDk3MWI1LWU4MDMtNDBkNy04ZDA0LWY4NmE0YWExMWM2NyIsImNyZWF0ZWQiOjE2ODc0NTgyMDMwNjgsImluU2FtcGxlIjpmYWxzZX0=
.cyberark.com/	1970-01-20 12:44:20	Name: _hjAbsoluteSessionInProgress Value: 0
.cyberark.com/	1970-01-20 22:20:18	Name: AMCV_9AB97041603F3EDB0A495C66%40AdobeOrg Value: 179643557%7CMCIDTS%7C19531%7CMCMID%7C64914183712731682533284855490319083293%7CMCAAMLH-1688063002%7C11%7CMCAAMB-1688063002%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1687465402s%7CNONE%7CMCSYNCSOP%7C411-19538%7CvVersion%7C5.5.0
.cyberark.com/	1970-01-20 22:20:18	Name: mbox Value: session#7ba27d669d084c658ba4b8dd2caa8f50#1687460064\|PC#7ba27d669d084c658ba4b8dd2caa8f50.32_0#1750703004
.cyberark.com/	1970-01-20 22:20:18	Name: trwv.uid Value: cyberarksoftware-1687458203308-4c48fc2d%3A1
.cyberark.com/	1970-01-20 12:44:20	Name: trwsa.sid Value: cyberarksoftware-1687458203312-9f826ca7%3A1
www.cyberark.com/	1970-01-20 22:20:18	Name: _gd_visitor Value: edcfb833-6f15-44c1-8ee0-d512af18c83a
www.cyberark.com/	1970-01-20 12:44:32	Name: _gd_session Value: ddbcacad-a9fb-43a5-8c5b-0cd308973fc8
www.cyberark.com/	1970-01-20 12:54:23	Name: _an_uid Value: 0
.6sc.co/	1970-01-20 22:20:18	Name: 6suuid Value: 9e6ad11747af2c009c9194645b0000000eac0400
.cyberark.com/	1970-01-20 12:44:20	Name: gpv_c51 Value: https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fchatting-our-way-into-creating-a-polymorphic-malware
.cyberark.com/	1970-01-20 13:27:30	Name: s_nr30 Value: 1687458205370-New
.cyberark.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.bidr.io/	1970-01-20 22:12:51	Name: bito Value: AABKqE7JKSMAAGdwuRGsFQ
.bidr.io/	1970-01-20 22:12:51	Name: bitoIsSecure Value: ok
.cyberark.com/	1970-01-20 14:53:54	Name: _fbp Value: fb.1.1687458205976.366848030
tags.srv.stackadapt.com/	1970-01-20 21:29:54	Name: sa-user-id Value: s%3A0-326cf2e7-cb8a-5b3c-4d01-f1207249671b.q990TwhWhXwNKwVWkT9XAYZdz78%2F%2BDZ2D2HxEIm1iFI
tags.srv.stackadapt.com/	1970-01-20 21:29:54	Name: sa-user-id-v2 Value: s%3AMmzy58uKWzxNAfEgcklnG3KiRFs.Yh401U6zYg2qr1jqu8mh8DuSb504NjMSt8W3Tp8vuCo
.srv.stackadapt.com/	1970-01-20 21:29:54	Name: sa-user-id-v2 Value: s%3AMmzy58uKWzxNAfEgcklnG3KiRFs.Yh401U6zYg2qr1jqu8mh8DuSb504NjMSt8W3Tp8vuCo
www.cyberark.com/	1970-01-20 21:29:54	Name: sa-user-id Value: s%253A0-326cf2e7-cb8a-5b3c-4d01-f1207249671b.q990TwhWhXwNKwVWkT9XAYZdz78%252F%252BDZ2D2HxEIm1iFI
www.cyberark.com/	1970-01-20 21:29:54	Name: sa-user-id-v2 Value: s%253AMmzy58uKWzxNAfEgcklnG3KiRFs.Yh401U6zYg2qr1jqu8mh8DuSb504NjMSt8W3Tp8vuCo
www.cyberark.com/	1970-01-20 12:45:44	Name: ln_or Value: eyIxNzkwNiI6ImQifQ%3D%3D
.linkedin.com/	1970-01-20 14:53:54	Name: li_sugr Value: be373d39-d204-4542-9413-cdce1a2f731d
.linkedin.com/	1970-01-20 21:29:54	Name: bcookie Value: "v=2&93985a17-6837-4fe3-8c87-93f3d54fb241"
.linkedin.com/	1970-01-20 12:45:44	Name: lidc Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2780:u=1:x=1:i=1687458206:t=1687544606:v=2:sig=AQGxmI7CkEtrzSGO1kgts3H8WPNXSTu3"
.linkedin.com/	1970-01-20 13:27:30	Name: UserMatchHistory Value: AQJjxE9Z11tBbgAAAYjkWNI7LBrKBwfeYvIwLgxXec_c8n41zcnAPjy4jKpMeP-yiHGal03C27oLzg
.linkedin.com/	1970-01-20 13:27:30	Name: AnalyticsSyncHistory Value: AQKEaeDJMir90wAAAYjkWNI7QRFrAy3NtbQ2gaJT96gNlzfoWcCt7tKn93I3MKsYXd9zYx217cwJQhJGPbPsGg
www.cyberark.com/	1970-01-20 12:44:20	Name: drift_campaign_refresh Value: e6bcaf06-d41b-4a6f-a14b-3556cd6736bf
.yahoo.com/	1970-01-20 21:30:15	Name: A3 Value: d=AQABBJ6RlGQCEFeDa0HjGlCQSWurc73JTdYFEgEBAQHjlWSeZGCTyyMA_eMAAA&S=AQAAArDgNAk3RhXJe2UedsR8bu0
.www.linkedin.com/	1970-01-20 21:29:54	Name: bscookie Value: "v=1&20230622182326fa7334ee-a195-41ee-8941-2cc3cbf62f16AQE8q0XXigWg-UxzXUPCOmLx34YW5F9B"
.analytics.yahoo.com/	1970-01-20 21:29:54	Name: IDSYNC Value: 1769~2cd6
.bluekai.com/	1970-01-20 17:07:49	Name: bku Value: mf699JIHksx3pWR4
.rubiconproject.com/	1970-01-20 21:29:54	Name: khaos Value: LJ7H1POD-E-43JE
.rubiconproject.com/	1970-01-20 21:29:54	Name: audit Value: 1\|fMi74wznGtzvkvVq9/xHLGcivNItqRUP7uPlWHkymQFJ20JWj7QkbCZYY6FRssJ1BeqL6T2FiC6M1KxoLazIt9i2Wk5FrGos0XY24Ec+XLvX2nt6aV1YQCdFIJct8s/qyyr+3K8F1XPXu8Nq+rAikBPaguavjTHNjgh0ef9QhZZbOz6AjJtUa8ZnH3r7x5VAdeodiyl5GGjkt77VmXBK7kiCfUmSYXqD+ohH/uuQN8oOr/S07bYDcYQkZmofZQkSVSwKu1RXSJT0/fhu8/pkBO4VeIulq+4M1TRwmTZWV3Xc6UO785F0Pw==
.doubleclick.net/	1970-01-20 22:20:18	Name: IDE Value: AHWqTUkSLy-xy1kmzI7fsRo1qUYky5KUmj3Np2_X-V_rcL5xIOTMd50NZj1PMLv1_ks
.choozle.com/	1970-01-20 13:27:30	Name: chzdpsync Value: eyJjaG9vemxlQ29va2llSWQiOiI3ZTY1YWNiZC01YTg0LTQ5ZmEtYTBmYy04NTgzZTAyMzVhODkiLCJwcm92aWRlckNvb2tpZU1ldGEiOnsiT1JBQ0xFIjp7InByb3ZpZGVyIjoiT1JBQ0xFIiwicHJvdmlkZXJDb29raWVJZCI6IiRfQktfVVVJRCIsInByb3ZpZGVyUmVkaXJlY3RSZXF1ZXN0ZWQiOmZhbHNlLCJwcm92aWRlclJlZGlyZWN0U2VudCI6ZmFsc2V9LCJUVEQiOnsicHJvdmlkZXIiOiJUVEQiLCJwcm92aWRlckNvb2tpZUlkIjoiOTZmNTBkMzAtYzI5Ny00Yzk0LTk5OTMtMDhlNWI1MWU4MzJkIiwicHJvdmlkZXJSZWRpcmVjdFJlcXVlc3RlZCI6ZmFsc2UsInByb3ZpZGVyUmVkaXJlY3RTZW50IjpmYWxzZX19LCJ2ZXJpZmllZCI6dHJ1ZSwic3BlY2lmaWNQcm92aWRlcnMiOltdfQ==
.adsrvr.org/	1970-01-20 21:31:20	Name: TDCPM Value: CAESFgoHZDB0cm8xahILCO6ZmLP51fk7EAUSEgoDYWFtEgsI5Lnk9b-j7jsQBRIZCgpyaWdodG1lZGlhEgsIqO671vnV-TsQBRIWCgdydWJpY29uEgsIrL7m3PnV-TsQBRIWCgdibHVla2FpEgsIjLWR4fnV-TsQBRIVCgZnb29nbGUSCwjCi6vl-dX5OxAFGAEgAigCMgsI5pSGkJDW-TsQBTgBWgdnZG12N3FzYAI.
.rlcdn.com/	1970-01-20 21:29:54	Name: rlas3 Value: paWg97w8kZNUQDjn9vg/IXLjuRVnNU8X0x3cpvZf2SY=
www.cyberark.com/	1970-01-20 22:20:18	Name: drift_aid Value: 63cd0580-d5fa-4cd7-9a61-b3272867ec06
www.cyberark.com/	1970-01-20 22:20:18	Name: driftt_aid Value: 63cd0580-d5fa-4cd7-9a61-b3272867ec06
.rlcdn.com/	1970-01-20 14:10:42	Name: pxrc Value: CJ+j0qQGEgUI6AcQABIGCLjrARAA
.openx.net/	1970-01-20 21:29:54	Name: i Value: 05d830f0-627a-43dc-8b70-ce5a78afa888\|1687458208

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js Message: Specifying 'overflow: visible' on img, video and canvas tags may cause them to produce visual content outside of the element bounds. See https://github.com/WICG/view-transitions/blob/main/debugging_overflow_on_images.md for details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' https://www.cyberark.com/;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

316-czp-275.mktoresp.com
9920016.fls.doubleclick.net
adservice.google.co.jp
adservice.google.com
alb.reddit.com
assets.adobedtm.com
b.6sc.co
bootstrap.api.drift.com
c.6sc.co
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
cihost.uberflip.com
cm.everesttech.net
cm.g.doubleclick.net
cnv.event.prod.bidr.io
connect.facebook.net
consent.trustarc.com
content.cdntwrk.com
cs.choozle.com
cyberark.demdex.net
cyberark.sc.omtrdc.net
cyberark.tt.omtrdc.net
d1eoo1tco6rr5e.cloudfront.net
dpm.demdex.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
idsync.rlcdn.com
in.ml314.com
insight.adsrvr.org
ipv6.6sc.co
j.6sc.co
js.driftt.com
match.adsrvr.org
metrics.api.drift.com
ml314.com
munchkin.marketo.net
nexus.ensighten.com
pixel.rubiconproject.com
ps.eyeota.net
px.ads.linkedin.com
rtp-static.marketo.com
script.hotjar.com
secure.adnxs.com
sjrtp6-cdn.marketo.com
sjrtp6.marketo.com
snap.licdn.com
static.hotjar.com
stats.g.doubleclick.net
sync.crwdcntrl.net
tags.bluekai.com
tags.srv.stackadapt.com
ups.analytics.yahoo.com
us-u.openx.net
www.cyberark.com
www.facebook.com
www.google-analytics.com
www.google.co.jp
www.google.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
bootstrap.api.drift.com
103.43.90.114
104.17.24.14
104.18.190.184
13.107.42.14
13.225.183.101
13.228.126.19
13.32.50.10
13.32.50.9
13.32.50.97
13.33.174.32
13.33.174.58
13.33.174.94
142.250.196.100
142.250.196.130
142.251.170.156
142.251.42.130
142.251.42.136
142.251.42.162
142.251.42.166
151.101.65.140
172.217.175.67
172.217.175.74
172.217.26.238
18.176.186.29
18.176.247.126
18.177.126.76
18.179.253.189
192.28.146.116
192.28.147.68
216.58.220.98
216.58.220.99
23.200.55.30
23.200.55.8
23.33.33.145
23.34.103.199
23.35.124.205
23.39.216.225
23.44.52.187
3.210.10.81
31.13.82.36
31.13.82.7
34.111.234.236
34.98.64.218
35.190.60.146
35.71.131.137
52.77.115.171
52.77.41.185
54.147.21.139
54.174.246.206
54.187.122.125
63.140.50.17
69.173.158.64
99.84.138.44
99.84.140.18
002b1c0ccce224b5075de6a5411c7a5a68eac4737b98baccb4d6bf5436ee562c
004745e1b78507d7532c693dd27969eb13234ffd30bec47fabad8a8283039ecd
011052ff11712ffd8a96a3c73f6b6e129e3112938f06a4280201dd9ea6784819
0259ae631427786951bb46b638b6c9607a8460331ca60fe1a8912e058c8cb19f
027ca73659dab51fe9987fd4d19b9eedd940202da076fec561dab2b297dfa820
03504b3dc97cbaa6908c120175bdfcd4733778e9dc68031dadfbdb71e7dd35c7
0402955fd97b3d37addd83e8075bcfe5d43af7f042135aebf2efc346d1c51c93
04a94e1aab3f32c23113cdd44e704af7b760c119572a86e921e4065562fb222f
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
0637a5486005822934814400cc9f0989ead659268f2add3521f63f1b49876913
06d728dae2ed107e620cf386a44b591ede81aab2710da16037f291f9dc1aa174
082f95fd455fbcd0b92dd51c6ff3e433324f2b1027a6e66126c1347ea32b83eb
08330120c6d9d4407fd599bae49187289878c557ed68e58d0e091fd5e1ac6c7f
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0f610bd2d3bd83b9efe982a5da2bf69ef23f954b90d608e428843b7ae481230e
134bcd1f63fe5b666d4334165aec62a186f7ae6ee6b0960f094710d8cbf4abf5
178c7e0dd0c602d457b8d91dd18b916c3f4220794fccb6067cac187f0c753795
179d0300a0006e7947f938a609866e0c4754f53e38e227ceff0386f80fd36434
17decb51bb1e2f60bc68a83ac67dcd2fbc509a13a70e0f3770358d9735f8d798
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1accabb6cb91b6a9b6edf56093785910e2f63743c165fbd547046d6ff89860d6
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
1e20c277f9215eea696595f6dbb57825b4a7f87cddfec2f565379bf742252ecb
1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d
1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2
202956cc224ba9381b6a1167408b11dab6198fe87f3a3ed967324f4154aa30c0
234f5e6b36c41a209c87e64949d11927b6360603b94ce3511c53df5bac0f4c26
23f95a90d6e6ba09a92bd4eae99823b0a6b0137a9abe10e3c050c062fb15efe4
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7
2a674125d95e3fc480b38edd114b4ca43a7489de13ae1e50e263978e90d7a73a
2a8a441d8086f20a64563edc759aba1de84d932e34ff77b8bb0279a730cdb428
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2bd7a2c113455cb6a015b33188207c2f7f5b5e7c584ce1ea4f8b0a1e990da133
2f43ae4516e6f0ab6ec81074e147b09b13b50793f5798b7f89eff68255703d8d
2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f
30addc9d73a2827ba55e8c495cd6765101d360a2ba24978382909312ae672f1d
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a
3513de4bf093c6b166f959edc9a64e8916ffd5c373201ef16ee41b15c07ce5fc
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31
3e416f057f786d430dc0c290f27e0015ab40c7918fb9b0c3cf69fdf99084c75c
4366b644d5f41009ff0f2b09c4fc67560f06de71b29a0d5891b0637b83c518ff
45aca110620ac12009925cac1e38aa4e71426a2b83ee7f356010069b45539d56
481baffabb9011ae6ffd10103983908ebc2c06e6f6be7797d226ccee04c2172f
485f287e270265f1a646a4589c357a3d124305a54ac7eaa928c0cf0463b693b6
49bdaf43b043fdd5e79f321a889502b341e83fb3d71caa9ec286369bcb205373
49fea9c50e35f8cc13649bd4c5f20237481289792d127d4691457776c63e8064
4aa419e7622019ff7ff19c50440df5e5f49e1563cfc0fd71f6123dbd1065de44
4aec96eddab69454e554bb60664da2e5043c363ebef6921644f619523e7274d7
4b6da73654c144d69f24f5354d48e426df8e2e7102fd6600a5065e96ffe11018
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
521db95edefbfb252db1df64ea5e30b0ccd832551227eb10742de367cb4d6f0a
5567c5a47f8bbd27707bd2cffdb1679c292a07ccf09a8578e1b9eba7ab481cf3
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
564e0b056a4f799d5d6cf7a396c73abe01ce72446945b38faa0a2df6370adffd
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58a175ad6d5f4dba2535263697247eca37b15eba561d0474c989f667dd0f27d9
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec
5e6ecec8d78c9d3f391fac9bde08b4f66048ab4ce9d97d3774b3d223f18b43a1
6151f62c314340a55f5cc5fb650538f2325f9516b69da4e3feb300515fc4072e
619ddc1d756bc60de4717303471873db6bbc6da6106ad99231472aecdb6c3040
62738b62849a46842f34013b8528886f10c8d0e1c9aec47d636e05d631e2f60e
634358d77171f485bb1738fce1bf1e715e2cd0a94b2c4f3d5c6dafccd0d1031a
650ccb5345413a793747580709faf33dde8ec50199400db4d4cd607fbb3da51a
66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4
67e2f25233ffe02ea0a70301e7440e6371d8943ca3f759b1d128b590e7e9419b
6861a320271e0fda832800e20d53b858ef409f88d9bc9c1a48953888289d1ea3
6882bb97b25bf71ecd9de333bcaa4eea46fd9f6763b383d07eff4c73b9c7ba30
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
69582702c9d3b8a292953b997f39cf2210ec13d6c9f34f47d1137d5c9afe7745
6c9c6406c9bd9814cf84974221433003377b67f071ec5411fddbcba4ec109bca
6ca4f32f43694ee56dda6581a83ef02225af274dc0aee381e86284c091911913
6d109c60b622c7cc1a1111f553efac7f1acb1607947d474004b94c79a3c90c0b
6e6098f9e4e64f667bc006876813632d5ac79ac56e5284a95c9c821870907cad
6eabf982ec86c7a2d08d260cdd257c9d1f1d9b589cb52a812be0dc5c7cf1af9a
6f756350e67238ef627d83acd8c4697791eaade9b8304e92f0b0b611920a7fde
7039ab8f947a4c8aa9b0129f458024c1d0f630de16ba83d2fca97e5e99493839
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
71ce37998e08d18a96119069ce594408077bc7ef92fa20637a7cb842776851e7
7295944e0067d71c5d5276d397dc0299afb519f277ba644aec0b96343e4185d1
7368078c522d443161721c025fb2a779e9be819daa09d1d1402040790d449e3f
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595
7641f066c35d0ca15d4897bfe49d640ed4c143ff8f04030c2020cbb2acfa7b0b
77cf16e1867991ea4ed7fb6d470e613528693de636fb0f1352936cc480e180ae
78c1c1baf0d964522f8afab09cfc754685c1648826a7f9967fd52b774b4ec5aa
7b0e7a4bdf115afb8e8c5b9b671b0dc4441236f8cf56906d146b7d46a0ee14a8
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7be1b3df507b34b7d05c60510836564455b0f85be0871e96e48201e4947d4cfd
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c7818c25a18e8a38553fcbcbc2ad0b5e964103a7d2e494f82815e3f70bf3fc5
7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9
7f94fca134e611bd64a6dd27e85c9c85832f8f91ebca838794a99dda5f48cde1
7fe7d9054d31a9874fb36aba6a3736c02799bdaab5fed3e007ff334bc4580732
81fec7f3b05845b84693ea9276af560503f9cdaae9735e2555944dd0a05491c1
8242e73795aa5b9757183fc6b9969c3e9a898f2e8f1e4d224d2bf9c982054e73
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8642675885c3a57a6673d673550ef1b5cb983e7b8232e00cf7d804cbe6a1f034
86e8b37fa004ddf5f2a20b33ffec6905866feb64aae71c065524e17fd5687f38
86eb8799f937f8afa6e72b4ced1859beed57b07ff187fe19e7bdd6739e5bee13
87ca2d8adbd10be0e5e89784dbb7aa8bb67f77247471f437e6af535009955f8c
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f
8930d0e2e796b4778c746779c5cc7e42a90da1b58120a3bd053ab4c41f165a6b
8aab45b2e3226eb83ceed37f3f622529d0a6ca0a82d8dd9a4d1fb8e46ba84f83
8bcb1671142844b9c10b5247053d513b9110ad9e3ad7ec0b751d42c977611f83
8d3dc176c0f11904372addebfcd309b1940e367f4e12818a59801dd42f35045f
8f0f8792237470ee661c6afc32ca68200dd74bcc0d544d0fd54c7777af362eae
9186ad0839410bf3d20f3c5b242b36027562baac85ffb8cba18b50b6e4d7945d
918e8441bee23ad58f7206b828f06c95a47a8e3ba6ae2e29b6483c610e06e470
91b7152c2708e116677591b018f23ed2910c747e932f8985b704f1884d807990
93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4
952f35790a58d6c58cd01db0b7994f8b1e3f2d4328f8dd2ed423c01579d403c6
97decf2d1156aaa2ae84c22c38d63028025a06fee23c8ef33b239df18572cf64
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9e70999bd0ed2afbb2967ca63898c752fc3e66ba8a86a4ac341723be85bb7319
a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362
a13619a5400ecc49ef7f85fc99b5a7bb5a6f2c962fac0b446c1c1a4764b73b38
a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594
a5ad2caf35eef00ae4a78ea6797ae578750f35091efeca81d22443a49c5ea56b
a654dbffdb656aacce15df139a6d2701ccae809fe7baab1ec042714bb6336eb9
ab18bf1a95e663a02efb06d340273f20f21316e497746c2c69344267c56f3f7c
ab342cf55dbb1241ef27cc92303a4266de2f8ec5734d4f7f97285c8562079ab9
afbd41e7209fa3aef6f53c7a5713aa542a7be54c432fec2d690e0dfaccd528d1
b09954ca25611278f310028fc7cff15ad906fd08cec78c6486978cb4f696a5bf
b0af909b7ae6ad2644bfe2a60d939092aaf113b2cbc4ed2981a892869143b98a
b0b6da5eebb0023cddb0d5fa35708f6f44bd8e3661da0ea0dfa79b00f3e9229f
b13c9311dec3f49821d88065299e95cc1c4e6c26acc4b27b4ebdb380d40d8788
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b658635cd3cbb7f049ecc5f7d5fa35af6933525db79ee7843e2c75ebe186c3a3
b6a545f511aab74426dc07259821b5a3976d9c431da047c7b44a54ed15935dd1
b7661d1399a600f4024ba515585b0d3ac26b772488761291851204e8a88481e8
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b8f62e67333c47bda5644ad6c9a9dbfb884daca66790d3a5ce391315219381e4
b96b944dbdb9c2afcdecae184e3bdc4717c30dc4f5d4624cfd1727461d6569fa
b98e0f76f97857fce1b3fbd8e9ed5775988e85fffd71dcc2422f8d012378ea34
b9d9c248d1c87f59c7f19b198c5ed7310a4bfd0f57759dd87d649b00ec9fdb5b
bba54915db71fc417be4d5852ec7d138d7c3fa90356ddee98b5267a7db7e6b5b
bd6854313df2804cabc0dcf14063b370bb8dceb9ff5df0bf8b110f036f95162c
c06dafd8194732d9deac86a56f43764a14a677e8b22a6013a84e253103468ae7
c1457d6417251decf61b55c38e54c05f42f0d3855d31dbf51699728b2131aefd
c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91
c48e0d3f95034cda3ba46d64e2a0b9b588b9d567fa498c1ac7887a6ddd40b7a7
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c640d911a58cc3ef31b1a3c2090fa753c948902033b9917ab5daef4fbb33b5d2
cd73c8f5cb4d24993cf38fe7bcd1ba52ba658e8676e9395ec53e2b99f109a78c
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d11f6ac62c5e0e2c0955a79615e06f561c5622f4d4598b3e7b853055c7b5643e
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56
d6d01246a30e9d483531c27721f73f266fa4af35effdb21683ac02a620ab8aaf
d70fa5dc6c8bfe9d7824be31e669528533d0879a2b1600a7df68b880f4d44296
d90ec1f3b6ea093b95658573d1937e85ef196d6322f8f2a61f879640f980fcf3
dab54de58d19c5f357ddc3063394e63d42980b087b8be19aa2303b67fb0aaee9
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dda8fcc2e307fd97d26215fda28cd77a1524c9b465ab88e006ad2cfd426be80d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e0c6f8695589df90e63442fee1c9cf14e60dfc4fd8ce7296515b1d6db41e1d3d
e2007f491cf8805ceb2604c0b9aeb1adc383791b679f523665fb75a8aad1ea1c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e555f4b34b579e6528d6bbd4819620a634c0759b41dfa99520b7ca5aa5117b11
e602984a721696845784c79ebc0f223e15c24d446fd59b314cbf1f2b4f300e96
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
e8a7f59bdadc9cce044ed41c774962b3dad55a83f3cd6ae6433b5070fc3eca11
e8d6785b5ed64b1f745913a02adc49d4450beb7b8f5789539d532adcce7ea591
e8e7fd76994e9fe7f19af8a2234efc259debc6e67de4ae8bf2f0e7471132bd02
e90c8d0b3106d62cd056189b3a9f025284c8e003ff0c3a89baa49541a6794dd3
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ed5dc159c961b48f8fded6c43a02780d5559b00c1991aa217be2b0e7c96da34e
edf1011ad272d21b66ae82a21a9d029186dc81c9f13972203fc3107f75835d4b
ee8ca8c91fcd24f08020ebf661c983c9b2cbd4f53beda1d8cb06564caa53306c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0d931b606c7b29b14d3521b9c85a9fbc153dac60f281e17689a5dfcf7b4bd19
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
f8b0b2313c3727465a282de3aab6d15c25105042b60dbdb1bea029872f6dcbe7
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

www.cyberark.com Open in urlscan Pro 104.18.190.184 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

238 Requests

96 %HTTPS

0 %IPv6

45 Domains

62 Subdomains

47 IPs

4 Countries

5856 kBTransfer

11734 kBSize

71 Cookies

41 Outgoing links

Redirected requests

238 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cyberark.com Open in urlscan Pro
104.18.190.184 Public Scan

Screenshot
Live screenshot

Full Image

238
Requests

96 %
HTTPS

0 %
IPv6

45
Domains

62
Subdomains

47
IPs

4
Countries

5856 kB
Transfer

11734 kB
Size

71
Cookies

238 HTTP transactions
1 data transactions