cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Submission: On April 12 via api (April 12th 2021, 2:41:08 pm UTC) from US

Summary HTTP 256 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 53 IPs in 6 countries across 42 domains to perform 256 HTTP transactions. The main IP is 35.188.168.180, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is cofense.com.
TLS certificate: Issued by R3 on February 27th 2021. Valid for: 3 months.

This is the only time cofense.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	35.188.168.180 35.188.168.180	15169 (GOOGLE) (GOOGLE)
87	108.161.188.228 108.161.188.228	33438 (HIGHWINDS2) (HIGHWINDS2)
4	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
5	2a00:1450:400... 2a00:1450:4001:800::200a	15169 (GOOGLE) (GOOGLE)
1	2600:9000:218... 2600:9000:2182:fc00:c:d51b:4400:21	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	104.111.214.240 104.111.214.240	16625 (AKAMAI-AS) (AKAMAI-AS)
6	104.16.94.80 104.16.94.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
66	13.226.155.117 13.226.155.117	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	52.222.179.119 52.222.179.119	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:710... 2a02:26f0:7100:191::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	50.19.224.133 50.19.224.133	14618 (AMAZON-AES) (AMAZON-AES)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	2606:4700::68... 2606:4700::6810:650c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
1	54.197.98.98 54.197.98.98	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2620:119:50e4... 2620:119:50e4:101::6cae:b55	14413 (LINKEDIN) (LINKEDIN)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 5	184.30.24.121 184.30.24.121	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
1	3.90.171.169 3.90.171.169	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:400c:c1b::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	13.226.155.55 13.226.155.55	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
10 17	34.253.95.95 34.253.95.95	16509 (AMAZON-02) (AMAZON-02)
1	13.226.155.86 13.226.155.86	16509 (AMAZON-02) (AMAZON-02)
2	178.62.192.243 178.62.192.243	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	107.20.147.136 107.20.147.136	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	35.156.106.231 35.156.106.231	16509 (AMAZON-02) (AMAZON-02)
1 2	184.30.24.241 184.30.24.241	16625 (AKAMAI-AS) (AKAMAI-AS)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	70.42.32.95 70.42.32.95	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1 1	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	35.174.78.146 35.174.78.146	14618 (AMAZON-AES) (AMAZON-AES)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	13.226.155.93 13.226.155.93	16509 (AMAZON-02) (AMAZON-02)
6	50.16.7.188 50.16.7.188	14618 (AMAZON-AES) (AMAZON-AES)
1	3.224.7.114 3.224.7.114	14618 (AMAZON-AES) (AMAZON-AES)
2	34.204.215.213 34.204.215.213	14618 (AMAZON-AES) (AMAZON-AES)
2	54.145.60.34 54.145.60.34	14618 (AMAZON-AES) (AMAZON-AES)
256	53

3 35.188.168.180 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 180.168.188.35.bc.googleusercontent.com

cofense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

87 108.161.188.228 (United States)

ASN33438 (HIGHWINDS2, US)

qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.111.9.35 (United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2182:fc00:c:d51b:4400:21 (United States)

ASN16509 (AMAZON-02, US)

dsms0mj1bbhn4.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.214.240 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-240.deploy.static.akamaitechnologies.com

cdn.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.94.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-ab46.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

66 13.226.155.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-117.dus51.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

m9m6e2w5.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.179.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-179-119.ham50.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:7100:191::25ea (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.19.224.133 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

lltrck.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:650c (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.197.98.98 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-197-98-98.compute-1.amazonaws.com

www.shareaholic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:119:50e4:101::6cae:b55 (United States) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 184.30.24.121 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-121.deploy.static.akamaitechnologies.com

s.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.90.171.169 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-90-171-169.compute-1.amazonaws.com

analytics.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c1b::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.55 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-55.dus51.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 34.253.95.95 (Dublin, Ireland) 10 redirects

ASN16509 (AMAZON-02, US)

d.adroll.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d.adroll.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.86 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-86.dus51.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.62.192.243 (Amsterdam, Netherlands)

ASN14061 (DIGITALOCEAN-ASN, US)

hits-i.iubenda.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.20.147.136 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partner.shareaholic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.156.106.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.24.241 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-241.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 70.42.32.95 (United States) 1 redirects

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

simage2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.98.64.218 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f112:182:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.174.78.146 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.155.93 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-155-93.dus51.r.cloudfront.net

embeds.driftcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 50.16.7.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-7-188.compute-1.amazonaws.com

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.224.7.114 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-7-114.compute-1.amazonaws.com

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.204.215.213 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-204-215-213.compute-1.amazonaws.com

targeting.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.145.60.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-145-60-34.compute-1.amazonaws.com

event.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
87	netdna-ssl.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	2 MB
66	driftt.com js.driftt.com	737 KB
21	adroll.com 10 redirects s.adroll.com d.adroll.com	26 KB
11	drift.com metrics.api.drift.com bootstrap.api.drift.com targeting.api.drift.com event.api.drift.com	6 KB
9	gstatic.com fonts.gstatic.com	170 KB
7	iubenda.com cdn.iubenda.com www.iubenda.com hits-i.iubenda.com	78 KB
6	marketo.com app-ab46.marketo.com	146 KB
5	googleapis.com fonts.googleapis.com	4 KB
4	doubleclick.net 2 redirects googleads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	2 KB
4	google-analytics.com www.google-analytics.com	58 KB
4	fontawesome.com use.fontawesome.com	173 KB
3	hotjar.com static.hotjar.com script.hotjar.com vars.hotjar.com	61 KB
3	cloudflare.com cdnjs.cloudflare.com	58 KB
3	googletagmanager.com www.googletagmanager.com	146 KB
3	cofense.com cofense.com	40 KB
2	pardot.com pi.pardot.com	3 KB
2	openx.net 1 redirects us-u.openx.net	480 B
2	outbrain.com 1 redirects sync.outbrain.com	832 B
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	facebook.net connect.facebook.net	92 KB
2	google.de www.google.de	591 B
2	google.com www.google.com	458 B
2	shareaholic.com analytics.shareaholic.com partner.shareaholic.com	642 B
2	linkedin.com 1 redirects px.ads.linkedin.com www.linkedin.com	1 KB
2	marketo.net munchkin.marketo.net	7 KB
1	driftcdn.com embeds.driftcdn.com	23 KB
1	twitter.com analytics.twitter.com	281 B
1	facebook.com www.facebook.com	147 B
1	taboola.com sync.taboola.com	218 B
1	pubmatic.com simage2.pubmatic.com	806 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	advertising.com pixel.advertising.com	125 B
1	consensu.org 1 redirects d.adroll.mgr.consensu.org	137 B
1	t.co t.co	166 B
1	shareaholic.net www.shareaholic.net	2 KB
1	zoominfo.com ws.zoominfo.com	725 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	lltrck.com lltrck.com	6 KB
1	licdn.com snap.licdn.com	2 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	stackpathcdn.com m9m6e2w5.stackpathcdn.com	44 KB
1	cloudfront.net dsms0mj1bbhn4.cloudfront.net	4 KB
256	42

	Domain	Requested by
87	qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com	cofense.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
66	js.driftt.com	cofense.com js.driftt.com
16	d.adroll.com	9 redirects cofense.com
9	fonts.gstatic.com	fonts.googleapis.com
6	metrics.api.drift.com	js.driftt.com
6	app-ab46.marketo.com	cofense.com app-ab46.marketo.com
5	s.adroll.com	1 redirects www.googletagmanager.com cofense.com s.adroll.com
5	fonts.googleapis.com	cofense.com js.driftt.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cofense.com
4	cdn.iubenda.com	cofense.com cdn.iubenda.com
4	use.fontawesome.com	cofense.com use.fontawesome.com
3	cdnjs.cloudflare.com	cofense.com
3	www.googletagmanager.com	cofense.com www.googletagmanager.com
3	cofense.com	cofense.com qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
2	event.api.drift.com	js.driftt.com
2	targeting.api.drift.com	js.driftt.com
2	pi.pardot.com	cofense.com pi.pardot.com
2	cm.g.doubleclick.net	2 redirects
2	us-u.openx.net	1 redirects cofense.com
2	sync.outbrain.com	1 redirects cofense.com
2	dsum-sec.casalemedia.com	1 redirects cofense.com
2	connect.facebook.net	d.adroll.com connect.facebook.net
2	hits-i.iubenda.com	cdn.iubenda.com
2	www.google.de	cofense.com
2	www.google.com	cofense.com
2	munchkin.marketo.net	cofense.com munchkin.marketo.net
1	bootstrap.api.drift.com	js.driftt.com
1	embeds.driftcdn.com	js.driftt.com
1	analytics.twitter.com	static.ads-twitter.com
1	www.facebook.com	cofense.com
1	sync.taboola.com	cofense.com
1	simage2.pubmatic.com	cofense.com
1	pixel.rubiconproject.com	cofense.com
1	pixel.advertising.com	cofense.com
1	partner.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	vars.hotjar.com	static.hotjar.com
1	d.adroll.mgr.consensu.org	1 redirects
1	script.hotjar.com	static.hotjar.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	t.co	cofense.com
1	analytics.shareaholic.com	m9m6e2w5.stackpathcdn.com
1	www.iubenda.com	cdn.iubenda.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	www.linkedin.com	cofense.com
1	px.ads.linkedin.com	1 redirects
1	www.shareaholic.net	dsms0mj1bbhn4.cloudfront.net
1	ws.zoominfo.com	cofense.com
1	static.ads-twitter.com	cofense.com
1	lltrck.com	cofense.com
1	snap.licdn.com	www.googletagmanager.com
1	static.hotjar.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	m9m6e2w5.stackpathcdn.com	dsms0mj1bbhn4.cloudfront.net
1	dsms0mj1bbhn4.cloudfront.net	cofense.com
256	54

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
support.cofense.com
cofenselabs.com
go.cofense.com
community.cofense.com
developer.mozilla.org
en.wikipedia.org
ccbjournal.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
threatpost.com
www.bankinfosecurity.com
www.wpdownloadmanager.com

Subject Issuer	Validity	Valid
cofense.com R3	`2021-02-27` - `2021-05-28`	3 months	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-22` - `2022-03-18`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-13` - `2021-12-14`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2021-02-22` - `2022-02-21`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
www.iubenda.com DigiCert SHA2 Secure Server CA	`2021-03-26` - `2022-03-31`	a year	crt.sh
app-ab46.marketo.com Cloudflare Inc ECC CA-3	`2020-09-16` - `2021-09-16`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.stackpathcdn.com Go Daddy Secure Certificate Authority - G2	`2019-06-27` - `2021-06-27`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.hotjar.com Amazon	`2020-12-25` - `2022-01-23`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
lltrck.com Go Daddy Secure Certificate Authority - G2	`2020-09-23` - `2021-09-23`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2020-07-04` - `2021-07-04`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.shareaholic.net R3	`2021-03-16` - `2021-06-14`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2021-08-16`	6 months	crt.sh
*.adroll.com DigiCert SHA2 Secure Server CA	`2020-01-29` - `2021-04-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
shareaholic.com Amazon	`2020-07-03` - `2021-08-03`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-01-12` - `2022-01-11`	a year	crt.sh
www.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-03-16` - `2021-06-08`	3 months	crt.sh
adroll.mgr.consensu.org Amazon	`2020-10-08` - `2021-11-07`	a year	crt.sh
*.iubenda.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-31` - `2022-01-30`	2 years	crt.sh
*.shareaholic.com R3	`2021-03-16` - `2021-06-14`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2021-03-01` - `2021-08-24`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
*.outbrain.com Thawte RSA CA 2018	`2019-10-29` - `2021-11-23`	2 years	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.taboola.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2020-11-25` - `2021-12-26`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
pi.pardot.com DigiCert SHA2 Secure Server CA	`2020-12-05` - `2021-12-04`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.driftcdn.com Amazon	`2021-03-12` - `2022-04-10`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Frame ID: 2D05B0AEC6547D7754E86DA4AA643735
Requests: 171 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html
Frame ID: 1D4330D68BF499CF5C8045B100A11DD4
Requests: 1 HTTP requests in this frame

Frame: https://app-ab46.marketo.com/index.php/form/XDFrame
Frame ID: 625C457D01FF1B179C42C7475C417D51
Requests: 2 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
Frame ID: 0C9053A1F190536038EDB89D1A42D8E1
Requests: 36 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat
Frame ID: 3F0B01D210382773FC5A5DBCA1D25986
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

256
Requests

100 %
HTTPS

34 %
IPv6

42
Domains

54
Subdomains

53
IPs

6
Countries

3766 kB
Transfer

9660 kB
Size

3
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/cofense

Search URL Search Domain Scan URL

URL: https://twitter.com/cofense

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/11500065/

Search URL Search Domain Scan URL

URL: https://support.cofense.com/
Title: Customer Resource Center

Search URL Search Domain Scan URL

URL: https://cofenselabs.com/
Title: Cofense Labs

Search URL Search Domain Scan URL

URL: https://go.cofense.com/live-demo/
Title: Request a Demo

Search URL Search Domain Scan URL

URL: https://community.cofense.com/
Title: Community

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cofense/
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/phishme-inc-?trk=hb_tab_compy_id_1550880
Title:

Search URL Search Domain Scan URL

URL: https://twitter.com/phishme
Title:

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies
Title: Cookie field

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/POST_(HTTP)
Title: HTTP POST

Search URL Search Domain Scan URL

URL: https://developer.mozilla.org/en-US/docs/Learn/HTML/Forms/Sending_and_retrieving_form_data
Title: form.

Search URL Search Domain Scan URL

URL: https://ccbjournal.com/podcast/in-house-warrior-garage2global-with-rohyt-belani-ceo-of-cofense-with-cohosts-louis-lehot-of-l2counsel-and-richard-levick-and-ian-lipner-of-levick
Title: 1/04/21 In House Warrior: Garage2Global with Rohyt Belani, CEO of Cofense with cohosts Louis Lehot of L2Counsel and Richard Levick and Ian Lipner of LEVICK Corporate Counsel Business Journal

Search URL Search Domain Scan URL

URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/Telestra.pdf
Title: 12/31/2020 Telstra backs Melbourne Cofense cyber security centre to defend Asia Pacific The Australian

Search URL Search Domain Scan URL

URL: https://threatpost.com/emotet-returns-100k-mailboxes/162584/
Title: 12/23/2020 Emotet Returns to Hit 100K Mailboxes Per Day ThreatPost

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/emotet-botnet-returns-after-2-month-hiatus-a-15656
Title: 12/23/2020 Emotet Botnet Returns After 2-Month Hiatus Bank Info Security

Search URL Search Domain Scan URL

URL: http://www.wpdownloadmanager.com/
Title: WordPress Download Manager - Best Download Management Plugin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 127

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1618238450658&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1618238450658%26url%3Dhttps%253A%252F%252Fcofense.com%252Femotet-update-new-c2-communication-followed-new-infection-chain%252F%26liSync%3Dtrue

Request Chain 142

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js HTTP 302
https://s.adroll.com/j/exp/index.js

Request Chain 144

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2 HTTP 302
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2

Request Chain 149

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&pv=16738116444.035444&cookie=&adroll_s_ref=&keyw= HTTP 302
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

Request Chain 151

https://d.adroll.com/cm/aol/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.advertising.com/ups/55980/sync?uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 152

https://d.adroll.com/cm/index/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451&C=1

Request Chain 153

https://d.adroll.com/cm/n/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expires=365

Request Chain 154

https://d.adroll.com/cm/outbrain/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M HTTP 302
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&rdrctExp=true

Request Chain 155

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 156

https://d.adroll.com/cm/taboola/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M

Request Chain 162

https://d.adroll.com/cm/o/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266

Request Chain 163

https://d.adroll.com/cm/g/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT&google_nid=adroll5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=B_3vxl5aoEF2q84UUcUoMw HTTP 302
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=B_3vxl5aoEF2q84UUcUoMw&google_tc= HTTP 302
https://d.adroll.com/cm/g/in

256 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/ 209 KB
35 KB 2354ms
2100ms Document
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: 7308d99d803aabd85cf517b896e002e45e573b79c70b652e2552a14ef68162e0

Request headers

:method: GET
:authority: cofense.com
:scheme: https
:path: /emotet-update-new-c2-communication-followed-new-infection-chain/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Mon, 12 Apr 2021 14:40:49 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://cofense.com/?p=16605>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: MISS
x-cache-group: normal
content-encoding: br

GET
H2 200 cache.skin.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/ 213 B
400 B 83ms
19ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega_main_menu/src/css/cache.skin.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:02 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba2-d5"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/ 50 KB
8 KB 102ms
39ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/css/dist/block-library/style.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb0d-c88a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/ 5 KB
1 KB 152ms
88ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/libs/fontastic/styles.css?ver=2.3.7
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-1421"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/css/ 10 KB
2 KB 83ms
20ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/css/style.css?ver=1618000805
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-2678"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/ 56 KB
12 KB 126ms
63ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/fontawesome/css/all.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-dff5"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/ 56 KB
10 KB 112ms
49ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/css/bootstrap.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-e1e0"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/ 65 KB
12 KB 108ms
45ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/css/front.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-10321"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ihover.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 428 KB
76 KB 135ms
73ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ihover.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-6ae1e"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/ 1 KB
825 B 148ms
86ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:02 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba2-568"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 font-awesome.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/ 37 KB
8 KB 84ms
23ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/css/font-awesome/css/font-awesome.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:02 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba2-9226"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page-list.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/ 2 KB
790 B 126ms
64ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/page-list/css/page-list.css?ver=5.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:02 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba2-60c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/ 96 KB
11 KB 157ms
96ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:58 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9e-17e39"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 t4bnewsticker.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/ 2 KB
873 B 145ms
85ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/css/t4bnewsticker.css?v=1.2.3&ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:56 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9c-7d7"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 10 KB
2 KB 148ms
87ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/chosen.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:59 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9f-29ff"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 search-filter.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/ 24 KB
5 KB 147ms
87ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/search-filter-pro/public/assets/css/search-filter.min.css?ver=1.4.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:59 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9f-61cc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 all.css
use.fontawesome.com/releases/v5.13.0/css/ 57 KB
14 KB 28ms
21ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:20 GMT
server: NetDNA-cache/2.2
etag: W/"76cb46c10b6c0293433b371bae2414b2"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 pum-site-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/pum/ 21 KB
4 KB 129ms
69ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/pum/pum-site-styles.css?generated=1617895099&ver=1.7.30
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 3735f094cc3dea915dbe2d90905f1efa19deacabacb80c7aabf0ad8f4a8475e0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:39 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb13-53ff"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 magnific-popup.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/ 6 KB
2 KB 112ms
53ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/libs/magnific-popup/magnific-popup.min.css?ver=0.9.9
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-1802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 animate.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 67 KB
4 KB 111ms
52ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/animate.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-10cbc"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 5 KB
680 B 20ms
13ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 12:44:41 GMT
server: ESF
date: Mon, 12 Apr 2021 14:40:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 elegant-icons.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/ 4 KB
1 KB 143ms
84ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/elegant-icons/elegant-icons.min.css?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-103d"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 22 KB
3 KB 148ms
89ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-577a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 608 KB
72 KB 148ms
90ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:56 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9c-980d1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-shortcodes.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 28 KB
5 KB 94ms
36ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-shortcodes.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-6f98"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 113 KB
19 KB 118ms
59ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-1c254"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wmx-styles.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 5 KB
1 KB 111ms
53ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/wmx-styles.css?ver=1618000793
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-1572"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 responsive.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/ 102 KB
12 KB 144ms
86ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/responsive.css?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-198c3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/ 15 KB
2 KB 146ms
88ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/vendor/select2.min.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-3aed"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/ 93 KB
16 KB 125ms
68ms Stylesheet
text/css 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88bb8f201b753bea7a809832098ed1062a54d74d26aff22742d34b9e18f8b059

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-175f1"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 24 KB
1 KB 19ms
15ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7742176d36a9ea889f4db0a843e62f522ba690a8d514e91dd5aa09eccf7340ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 13:57:50 GMT
server: ESF
date: Mon, 12 Apr 2021 14:40:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v5.13.0/css/ 26 KB
5 KB 25ms
21ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/css/v4-shims.css
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Mon, 23 Mar 2020 16:09:22 GMT
server: NetDNA-cache/2.2
etag: W/"fb073a92592d70e5aa6e3cce1cf93a11"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 jquery-1.12.4-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/ 95 KB
33 KB 159ms
102ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-17a56"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate-1.4.1-wp.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/ 23 KB
8 KB 161ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-5c79"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bootstrap.bundle.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/ 79 KB
23 KB 154ms
97ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/bootstrap/js/bootstrap.bundle.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-13b0a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 39 KB
11 KB 162ms
105ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/front.js?ver=3.1.11
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-9a93"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 chosen.jquery.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/ 51 KB
9 KB 156ms
99ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/download-manager/assets/js/chosen.jquery.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-cbc3"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 core.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 4 KB
2 KB 160ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/core.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-f5b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 script.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/ 3 KB
1 KB 156ms
100ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/mega-addons-for-visual-composer/js/script.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:02 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba2-c1c"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/ 7 KB
2 KB 160ms
104ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/js/front.js?ver=3.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:58 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9e-1d3b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.liscroll.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/ 2 KB
1 KB 154ms
98ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/t4b-news-ticker/assets/js/jquery.liscroll.js?ver=1.2.3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:56 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9c-98a"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modernizr.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 10 KB
5 KB 157ms
101ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modernizr.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-283b"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 shareaholic.js Show response
dsms0mj1bbhn4.cloudfront.net/assets/pub/ 9 KB
4 KB 61ms
7ms Script
application/javascript 2600:9000:2182:fc00:c:d51b:4400:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2182:fc00:c:d51b:4400:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 73952cc80c6ea36f277133e6aad1b4257fc9b4ac776643b70e7e882a2854b42d

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:23:47 GMT
content-encoding: gzip
age: 1023
x-cache: Hit from cloudfront
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
content-length: 3705
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 14:23:39 GMT
server: nginx
etag: "44d44ff0b824723e320fc0bd54bb7010"
content-type: application/javascript; charset=UTF-8
via: 1.1 91528fdf97ef415d04fa66a0fbb562d7.cloudfront.net (CloudFront)
cache-control: max-age=1200, public
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-amz-cf-id: rCRhw_mwx4WiY-jylpFJnDZR8q7Ov-bxuVJGPdVTxnm-NSqIs7FJhQ==

GET
H2 200 css
fonts.googleapis.com/ 3 KB
598 B 17ms
14ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Rubik:400,500

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 14:11:42 GMT
server: ESF
date: Mon, 12 Apr 2021 14:40:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 186 KB
61 KB 36ms
29ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2979a1c2422a41b4a3e44f260c8427a3ed266d11a3eb2f5cedf59736f9a76b79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62810
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 wp-emoji-release.min.js Show response
cofense.com/wp-includes/js/ 14 KB
5 KB 136ms
129ms Script
application/javascript 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://cofense.com/wp-includes/js/wp-emoji-release.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 180.168.188.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c

Request headers

Referer: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: nginx
etag: W/"6070bb0d-3795"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 lottie.min.js Show response
cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/ 256 KB
54 KB 20ms
19ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/bodymovin/5.7.4/lottie.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Origin: https://cofense.com
Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 311324
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54959
cf-request-id: 09682041b000004e507c157000000001
timing-allow-origin: *
last-modified: Mon, 02 Nov 2020 04:51:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f9f9048-3ff8d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bvsiIBxSO8h4qWaqzP5lgZzOpGh6LplRTwr3LJV3MZsSegp7l5t%2FynlFweXlGCeF3TvsvyR1KC2JFvUoDwyXTQAJCWNLk7RBoCjlgbsa%2F105mA%2BOAp7CBPoPH4tiWeqKbQ%3D%3D"}],"max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63ed36491b524e50-FRA
expires: Sat, 02 Apr 2022 14:40:50 GMT

GET
H2 200 iubenda_cons.js Show response
cdn.iubenda.com/cons/ 228 B
495 B 101ms
31ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Mon, 12 Apr 2021 08:33:47 GMT
server: nginx/1.19.1
etag: "607405eb-d6"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 214
expires: Mon, 12 Apr 2021 17:40:50 GMT

GET
H2 200 iubenda_cs.js Show response
cdn.iubenda.com/cs/ 451 B
617 B 103ms
32ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 1509adc344f186a37b68ab029c612031ca6ca17e0f3ec306b400315e33c23dcf

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Mon, 12 Apr 2021 08:33:53 GMT
server: nginx/1.19.1
etag: "607405f1-14f"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=10800
content-type: application/javascript
content-length: 335
expires: Mon, 12 Apr 2021 17:40:50 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 28ms
22ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

68fcd17644ecd5ee05d3903d090e32116e25a1f25b9593d817c8b9f8b8488614

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35812
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 cofense-logo.svg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
1 KB 45ms
39ms Image
image/svg+xml 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/cofense-logo.svg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-b20"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cofense-cbfree.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 45ms
39ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cbfree.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-c2a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3114

GET
H2 200 cofense-lms.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 45ms
40ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-lms.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-cd3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3283

GET
H2 200 cofense-reporter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 45ms
40ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-reporter.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-b2e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2862

GET
H2 200 cofense-pds.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 45ms
40ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-pds.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-ff4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4084

GET
H2 200 cofense-triage.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 46ms
41ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-triage.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-c04"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3076

GET
H2 200 cofense-vision.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 46ms
41ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-vision.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-ad5"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2773

GET
H2 200 cofense-intelligence.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 3 KB
3 KB 46ms
41ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-intelligence.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-c34"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3124

GET
H2 200 cofense-livefeed.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 5 KB
5 KB 46ms
41ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-livefeed.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-12ad"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4781

GET
H2 200 virus-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/ 6 KB
7 KB 46ms
42ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/03/virus-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:16 GMT
server: NetDNA-cache/2.2
etag: "6070bb38-198b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6539

GET
H2 200 wfh-01.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/ 4 KB
5 KB 46ms
42ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/04/wfh-01.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:08 GMT
server: NetDNA-cache/2.2
etag: "6070bb30-111d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4381

GET
H2 200 cofense-threat_education.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
4 KB 48ms
44ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-threat_education.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-e51"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3665

GET
H2 200 phishing-threats-db.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/ 5 KB
5 KB 49ms
45ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/06/phishing-threats-db.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:37:59 GMT
server: NetDNA-cache/2.2
etag: "6070bb27-1469"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5225

GET
H2 200 cofense-cloud_seeker.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/ 4 KB
5 KB 49ms
45ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/01/cofense-cloud_seeker.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:48 GMT
server: NetDNA-cache/2.2
etag: "6070bb58-1166"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4454

GET
H2 200 facebook.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 666 B
892 B 49ms
45ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/facebook.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:28 GMT
server: NetDNA-cache/2.2
etag: "6070bb80-29a"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 666

GET
H2 200 linkedin.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 723 B
949 B 49ms
46ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/linkedin.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:28 GMT
server: NetDNA-cache/2.2
etag: "6070bb80-2d3"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 723

GET
H2 200 twitter.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/ 809 B
1 KB 49ms
46ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2017/03/twitter.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:29 GMT
server: NetDNA-cache/2.2
etag: "6070bb81-329"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 809

GET
H2 200 free-access-blog.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/ 95 KB
96 KB 49ms
46ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2020/05/free-access-blog.png
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:06 GMT
server: NetDNA-cache/2.2
etag: "6070bb2e-17d95"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 97685

GET
H2 200 swiped-events.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 2 KB
1 KB 20ms
19ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/swiped-events.min.js?ver=1.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-6e8"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 imagesloaded.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 5 KB
2 KB 20ms
19ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb0d-15fd"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 effect.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 13 KB
5 KB 29ms
19ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/effect.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-33d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 ditty-news-ticker.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ 14 KB
3 KB 30ms
20ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/ditty-news-ticker/inc/static/js/ditty-news-ticker.min.js?ver=1618000805
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:05 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba5-3670"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.form.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 16 KB
6 KB 30ms
21ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery.form.min.js?ver=4.2.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb0d-3e97"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.t-countdown.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/ 9 KB
3 KB 31ms
21ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/jquery-t-countdown-widget/js/jquery.t-countdown.js?ver=2.4.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:03 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba3-23d2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 position.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/ 6 KB
3 KB 31ms
22ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-ui/position.min.js?ver=1.11.4-wp
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-1952"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 pum-site-scripts.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/pum/ 47 KB
14 KB 35ms
26ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/pum/pum-site-scripts.js?defer&generated=1617895099&ver=1.7.30
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 3f816745c8ba9795cec19723c0ea8ac11a711ba1af88acdcb0b4a68d8fb1cbfc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:39 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb13-bdb0"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wow.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 8 KB
3 KB 36ms
27ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/wow.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-1ff6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 modules.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/ 121 KB
35 KB 36ms
27ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/elite-addons-vc/assets/modules.min.js?ver=1.1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:40:04 GMT
server: NetDNA-cache/2.2
etag: W/"6070bba4-1e4e2"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 owl.carousel.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/ 38 KB
9 KB 39ms
31ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/libs/owl-carousel/owl.carousel.js?ver=1.0
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-99c8"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.sticky.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 10 KB
3 KB 40ms
31ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/jquery.sticky.js?ver=30
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-2765"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 14 KB
4 KB 40ms
31ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/custom.js?ver=1618000792
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-3802"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 theme-scripts.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/ 139 KB
39 KB 43ms
35ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/theme-scripts.js?ver=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-22de9"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 66 KB
19 KB 45ms
37ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/select2.min.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:53 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb99-10964"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.waypoints.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 9 KB
3 KB 45ms
37ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/jquery.waypoints.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-2344"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 sticky.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/ 1 KB
829 B 45ms
37ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/js/vendor/sticky.min.js?ver=3
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb98-4db"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 comment-reply.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 3 KB
2 KB 46ms
38ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/comment-reply.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb0d-ba6"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
1016 B 46ms
38ms Script
application/javascript 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-includes/js/wp-embed.min.js?ver=5.6.2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:37:33 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb0d-592"
vary: Accept-Encoding, Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.modal.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 5 KB
2 KB 25ms
17ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 1106926
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1399
cf-request-id: 096820427f0000536a1e391000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-1359"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lutuHuoy64updlnoAlmAHuRd2LVD1ZwdTN67K1qC0kxZ8vhMc17IYRqIq70FsxORppDEWbf8cjdz%2FltylTq2du2Z7D295D7iP6mOxUxVGJbNFOtXN%2Fw11XvpLR8u2bdgUg%3D%3D"}],"max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63ed364a6da4536a-FRA
expires: Sat, 02 Apr 2022 14:40:50 GMT

GET
H2 200 jquery.modal.min.css
cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/ 3 KB
2 KB 40ms
32ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-modal/0.9.1/jquery.modal.min.css

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 2795866
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1541
cf-request-id: 096820427f0000536a34bbf000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-c81"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XH8XLLHLOt7vDqgYcxnasgoWaOq%2FWHOScKAiHtoDw3R%2F1HZfITmciWIsfBhtwSD%2FwVQVQeW7D5Z49PN1XmeELyejIH%2BsgdWFNKOi3%2BHAQK191Nrzp5k8nzWrIJd%2FTM%2B3RQ%3D%3D"}],"max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 63ed364a6da5536a-FRA
expires: Sat, 02 Apr 2022 14:40:50 GMT

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ 204 KB
68 KB 256ms
49ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
age: 5686
etag: "2c40899-33187-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 63ed364ba9aa0857-CDG
cf-request-id: 096820434b0000085701051000000001
expires: Mon, 12 Apr 2021 18:40:50 GMT

GET
H2 200 1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v19/ 46 KB
46 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v19/1Ptug8zYS_SKggPNyC0ITw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway%3A300%2C400%2C700&ver=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 02:03:02 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Jan 2021 22:37:32 GMT
server: sffe
age: 391068
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47272
x-xss-protection: 0
expires: Fri, 08 Apr 2022 02:03:02 GMT

GET
H2 200 28krvx2uf9n3.js Show response
js.driftt.com/include/1618238700000/ 212 KB
60 KB 224ms
157ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1618238700000/28krvx2uf9n3.js

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

9db6b287d26113420992948384e1452ac263c8fbe1e0ce55d177b4fc5e05e301

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 09 Apr 2021 13:08:20 GMT
server: nginx
etag: W/"72a7d2d98706be10010ea2ffdf0d51c1"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sJeeK6WZx7vR8vurzuWyk0IDQNe6w2mq
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: YOULd5quAOfFIzHSQahebDvIqbjZ8Es4xzo9NEMGbDAQmy8CtoKcvg==

GET
H2 200 nav-arrow.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 3 KB
3 KB 50ms
50ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/nav-arrow.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: "6070bb98-b8d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2957

GET
H2 200 icn-nav-search@2x.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 51ms
50ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/icn-nav-search@2x.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: "6070bb98-514"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1300

GET
H2 200 b-g.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 840 KB
841 KB 48ms
47ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/b-g.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/custom-styles.css?ver=1618000793
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:59 GMT
server: NetDNA-cache/2.2
etag: "6070bb9f-d20af"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 860335

GET
H2 200 twitter_social_tile_A2_1200_628-510x240.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/ 31 KB
31 KB 51ms
51ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2021/01/twitter_social_tile_A2_1200_628-510x240.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:37:42 GMT
server: NetDNA-cache/2.2
etag: "6070bb16-7b63"
vary: Accept-Encoding
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 31587

GET
H2 200 footer-graphic.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 4 KB
4 KB 51ms
50ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:35 GMT
server: NetDNA-cache/2.2
etag: "6070bb87-e4e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3662

GET
H2 200 footer-graphic-b.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 212 B
438 B 51ms
50ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-b.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:35 GMT
server: NetDNA-cache/2.2
etag: "6070bb87-d4"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 212

GET
H2 200 footer-graphic-a.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/ 107 B
333 B 51ms
50ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2016/07/footer-graphic-a.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/style.css?ver=5.6.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:39:35 GMT
server: NetDNA-cache/2.2
etag: "6070bb87-6b"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 107

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 78 KB
78 KB 22ms
21ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Mon, 23 Mar 2020 16:08:17 GMT
server: NetDNA-cache/2.2
etag: "b15db15f746f29ffa02638cb455b8ec0"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 79444

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 16 KB
16 KB 46ms
24ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A100%2C300%2C400%2C500%2C700%2C900%2C100italic%2C300italic%2C400italic%2C500italic%2C700italic%2C900italic&ver=5.6.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 581102
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:48 GMT

GET
H2 200 fa-brands-400.woff2
use.fontawesome.com/releases/v5.13.0/webfonts/ 75 KB
75 KB 34ms
34ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.13.0/webfonts/fa-brands-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.13.0/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29

Request headers

Origin: https://cofense.com
Referer: https://use.fontawesome.com/releases/v5.13.0/css/all.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Mon, 23 Mar 2020 16:10:04 GMT
server: NetDNA-cache/2.2
etag: "a06da7f0950f9dd366fc9db9d56d618a"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 76612

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 42ms
20ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
age: 581102
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:48 GMT

GET
H3-Q050 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 42ms
21ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:21:37 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:29 GMT
server: sffe
age: 580753
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15712
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:21:37 GMT

GET
H2 200 ssb-icon.ttf
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ 6 KB
4 KB 68ms
21ms Font
application/octet-stream 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/fonts/ssb-icon.ttf?eahqa2
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131

Request headers

Origin: https://cofense.com
Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/simple-social-buttons/assets/css/front.css?ver=3.2.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 20:39:58 GMT
server: NetDNA-cache/2.2
etag: W/"6070bb9e-17f8"
vary: Accept-Encoding
x-cache: HIT
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
age: 581102
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:48 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:15:48 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:39 GMT
server: sffe
age: 581102
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15732
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:15:48 GMT

GET
H3-Q050 200 KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2
fonts.gstatic.com/s/roboto/v27/ 17 KB
17 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOjCnqEu92Fr1Mu51TjASc6CsQ.woff2

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://cofense.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 05 Apr 2021 21:24:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 05 Apr 2021 21:10:42 GMT
server: sffe
age: 580578
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17484
x-xss-protection: 0
expires: Tue, 05 Apr 2022 21:24:32 GMT

GET
H2 200 Picture1-3-480x442.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/ 40 KB
40 KB 425ms
424ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Picture1-3-480x442.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 324bcb647088cb88310d71ad938ccce270343da3e2b64c0911cf0e34c0762d56

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:43 GMT
server: NetDNA-cache/2.2
etag: "6070bb53-9e4c"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 40524

GET
H2 200 Picture2-3-474x480.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/ 92 KB
93 KB 425ms
424ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Picture2-3-474x480.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c3e7a9f706ecd95754432a4eec3baeb1af3d50ea4e5e3720ba65039d924cd412

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:43 GMT
server: NetDNA-cache/2.2
etag: "6070bb53-171f9"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 94713

GET
H2 200 Picture3-2-480x325.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/ 90 KB
90 KB 425ms
424ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Picture3-2-480x325.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 24a2f9c618bd1d9c228d219d747c4068aa6b6aadbf284bd00803d138d27e4cb7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:44 GMT
server: NetDNA-cache/2.2
etag: "6070bb54-16709"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 91913

GET
H2 200 Picture4-2-600x360.jpg
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/ 56 KB
56 KB 424ms
424ms Image
image/jpeg 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/uploads/2019/03/Picture4-2-600x360.jpg
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ac6a17370a759dda773db77819faa8b1e8d828264ad7de8a8925b792fd5d23a7

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
last-modified: Fri, 09 Apr 2021 20:38:43 GMT
server: NetDNA-cache/2.2
etag: "6070bb53-de9c"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 56988

GET
H2 200 main.js Show response
m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/ 150 KB
44 KB 67ms
23ms Script
application/javascript 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 02ccdd095156565fe6098cef9a1918b92e86dc6023b22fdcb27a2eef3a330482

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Tue, 06 Apr 2021 14:23:38 GMT
server: nginx
x-amz-request-id: T7N4BD2Y6GNQ2Y89
etag: "511bd43262d9bbf1b6d8c71b70947f5c"
x-hw: 1618238450.cds043.pa1.hn,1618238450.cds037.pa1.c
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-hello-human: Join the fun! Apply at www.shareaholic.com/jobs
accept-ranges: bytes
content-length: 44435
x-amz-id-2: tQxgkFNi8Fm3RUaOujbzt9UD8x6anoEW+Ez869rNE3QQbkxKvefr05g5StuLi1gyaygh2OAW3xs=

GET
H2 200 core-d2a24f1d20d2043482758bef114eb219.js Show response
cdn.iubenda.com/cons/iubenda_cons/ 21 KB
7 KB 30ms
29ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cons/iubenda_cons/core-d2a24f1d20d2043482758bef114eb219.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cons/iubenda_cons.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: 523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 07:22:59 GMT
server: nginx/1.19.1
etag: "607000d3-1b74"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 7028
expires: Tue, 12 Apr 2022 14:40:50 GMT

GET
H2 200 core-en.js Show response
cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/ 287 KB
69 KB 33ms
32ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cs/iubenda_cs.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx/1.19.1 /
Resource Hash: faac6b9031d79a3f00c6f066e1123f99cc6c9db4de3c7f5606c7009fdce481fa

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
last-modified: Fri, 09 Apr 2021 07:23:10 GMT
server: nginx/1.19.1
etag: "607000de-1135f"
vary: Accept-Encoding
p3p: CP="DSP NOI COR", policyref="http://www.iubenda.com/w3c/p3p.xml"
access-control-allow-origin: *
cache-control: public, must-revalidate, proxy-revalidate, max-age=31536000
content-type: application/javascript
content-length: 70495
expires: Tue, 12 Apr 2022 14:40:50 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 35 KB
14 KB 40ms
39ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

a91f331e1b5196cdf777af51a6aec591932f282918ecaf815d3ae3ffd369a58e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13811
x-xss-protection: 0
server: cafe
etag: 10785024895408828692
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
49 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1061448384

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97eec55d59ce5571f0d86b34d69bf5a48ef38e239ee2795769801ca3f4522eab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50377
x-xss-protection: 0
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 19 Mar 2021 19:22:18 GMT
server: Golfe2
age: 2954
date: Mon, 12 Apr 2021 13:51:36 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19463
expires: Mon, 12 Apr 2021 15:51:36 GMT

GET
H2 200 hotjar-1312741.js Show response
static.hotjar.com/c/ 9 KB
2 KB 146ms
71ms Script
application/javascript 52.222.179.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.119 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-119.ham50.r.cloudfront.net

Software

Resource Hash

5314df92c9197b384f5b5439ef14dca6a749afe25359f9e5a6c0965e86380f33

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: HAM50-C1
etag: W/6bcdb7a2180e47b60dfadb522af7144e
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
x-amz-cf-id: 9oEc0g4oZ8kPsU-_javUeAnBg2GHsQYG4RrQfSxMYdO3MlJkZOjouQ==
via: 1.1 53767392640cf5282c1ce18d7cc7b0e1.cloudfront.net (CloudFront)

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 7ms
7ms Script
application/x-javascript 2a02:26f0:7100:191::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:7100:191::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:50 GMT
Content-Encoding: gzip
Last-Modified: Mon, 04 Jan 2021 22:14:03 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=31281
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1855

GET
H2 200 lt-v3.js Show response
lltrck.com/scripts/ 6 KB
6 KB 322ms
108ms Script
text/javascript 50.19.224.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://lltrck.com/scripts/lt-v3.js?llid=19612

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.19.224.133 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e5559d8bfd731d94f4fc8f3591a300d14018efd30f2954fc540f0712dbce1735

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
cache-control: public, max-age=172800
server: Kestrel
content-length: 5894
strict-transport-security: max-age=2592000
content-type: text/javascript

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 32ms
31ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
via: 1.1 varnish
last-modified: Fri, 04 Dec 2020 00:21:46 GMT
age: 49765
etag: "cbc512946c8abb461c6215ed5b454e5f+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding: gzip
cache-control: no-cache
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 1957
x-timer: S1618238451.594083,VS0,VE0
x-served-by: cache-hhn11573-HHN

GET
H2 200 2Uq3HoQoVZEHgHXXf288 Show response
ws.zoominfo.com/pixel/ 0
725 B 243ms
219ms Script
text/javascript 2606:4700::6810:650c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/2Uq3HoQoVZEHgHXXf288

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 63ed364c4bf005dc-FRA
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for
content-length: 0
cf-request-id: 09682043af000005dcc18b7000000001

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 122ms
51ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:50 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 62df9f201cc7c19a56912daae814efca.json Show response
www.shareaholic.net/config/ 11 KB
2 KB 295ms
98ms XHR
application/json 54.197.98.98
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://www.shareaholic.net/config/62df9f201cc7c19a56912daae814efca.json
Requested by: Host: dsms0mj1bbhn4.cloudfront.net
URL: https://dsms0mj1bbhn4.cloudfront.net/assets/pub/shareaholic.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 54.197.98.98 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-197-98-98.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-client-geo-country: FR,France
date: Mon, 12 Apr 2021 00:10:49 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-origin: *
access-control-allow-methods: GET, HEAD
content-length: 1672
server: nginx
x-client-geo-region: 75,Paris
x-client-geo-metrocode
etag: W/"b64e92c54cf8815d6fff0a70489dc30b"
access-control-max-age: 2000
x-client-geo-city: Paris
x-varnish: 840556929 828332705
via: 1.1 varnish (Varnish/6.0)
access-control-expose-headers: Etag, Access-Control-Allow-Origin, x-client-geo-latlong, x-client-geo-country, x-client-geo-city, x-client-geo-zip, x-client-geo-region, x-client-geo-metrocode
cache-control: max-age=3, public, must-revalidate
x-client-geo-zip: 93200
accept-ranges: bytes
content-type: application/json
access-control-allow-headers: *
x-client-geo-latlong: 48.933500,2.366100

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 105 KB
39 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=OPT-K29SPQM&t=gtm5&cid=1306929973.1618238451&aip=true

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2bc93b3acc1ab580d9303b06ea350432891d69c8a633a618db6287c4a76f77ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39497
x-xss-protection: 0
expires: Mon, 12 Apr 2021 14:40:50 GMT

GET
H2 200 getForm Show response
app-ab46.marketo.com/index.php/form/ 24 KB
6 KB 429ms
428ms Script
application/javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://app-ab46.marketo.com/index.php/form/getForm?munchkinId=404-JHU-612&form=1378&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&callback=jQuery112406759566037846709_1618238450617&_=1618238450618
Requested by: Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8cc6048229170e6e9d2c96efba5894f085c9be4fcd96a0b6ec30287a595c4797

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

cf-request-id: 09682043cc000008575e241000000001
content-encoding: gzip
server: cloudflare
date: Mon, 12 Apr 2021 14:40:51 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 63ed364c7bd00857-CDG
cached: true

POST
H2 200 admin-ajax.php Show response
cofense.com/wp-admin/ 77 B
493 B 3898ms
3897ms XHR
text/html 35.188.168.180
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cofense.com/wp-admin/admin-ajax.php

Requested by

Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery/jquery-1.12.4-wp.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.188.168.180 Council Bluffs, United States, ASN15169 (GOOGLE, US),

Reverse DNS

180.168.188.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

c45cc031ebc4bd7cfc95286a542b4af08f05f998cd07829e888545f976b33b46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 12 Apr 2021 14:40:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-powered-by: WP Engine
p3p: CP="NOI"
content-length: 59
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://cofense.com
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2

429

li_sync
www.linkedin.com/px/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=300721&time=1618238450658&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1618238450658%26url%3Dhttps%253A%252F%252Fcofense.com%252Femotet-...

0
169 B

104ms
104ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1618238450658%26url%3Dhttps%253A%252F%252Fcofense.com%252Femotet-update-new-c2-communication-followed-new-infection-chain%252F%26liSync%3Dtrue
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
x-li-pop: afd-prod-lva1
x-msedge-ref: Ref A: 70F6571084804BE5ACCD6249D1ABB79F Ref B: FRAEDGE0913 Ref C: 2021-04-12T14:40:50Z
x-li-fabric: prod-lva1
cache-control: no-cache, no-store
x-li-proto: http/2
content-length: 0
x-li-uuid: fjbAIkwjdRbg1C+VFSsAAA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date: Mon, 12 Apr 2021 14:40:50 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
location: https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D300721%26time%3D1618238450658%26url%3Dhttps%253A%252F%252Fcofense.com%252Femotet-update-new-c2-communication-followed-new-infection-chain%252F%26liSync%3Dtrue
x-li-proto: http/2
x-li-pop: prod-edc2
content-length: 0
x-li-uuid: qnIbHEwjdRYwQVp8hSsAAA==

GET
H/1.1 200
OK roundtrip.js Show response
s.adroll.com/j/ 41 KB
13 KB 88ms
30ms Script
text/javascript 184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/roundtrip.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5RQ37KH
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: ecfec6edd361b81190425a403385fb537c339984464c26413437ef7dc551a0a3

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: nkHCm_xeWIjraGkeLYKhlD5Mi9FxU1pe
Content-Encoding: gzip
ETag: "64986b995b49e1feeccb58c9c06afef7"
x-amz-request-id: M8JT0DRWSNHQWNF2
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 12936
x-amz-id-2: UaJgkqahhvnmY+EprGUVU7rj5UlsD+G3+MfQdOHzuTlVw1GAtQCvkxib4Sev/d0/doHcrvTIDEQ=
Last-Modified: Mon, 05 Apr 2021 16:54:49 GMT
Server: AmazonS3
Date: Mon, 12 Apr 2021 14:40:50 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

POST
H3-Q050 204 collect
www.google-analytics.com/g/ 0
38 B 14ms
14ms Other
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-0HTW6C6HJS&gtm=2oe3v0&_p=410013643&sr=1600x1200&ul=en-us&cid=1306929973.1618238451&_s=1&dl=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&dt=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&sid=1618238450&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0HTW6C6HJS&l=dataLayer&cx=c
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/ 2 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1061448384/?random=1618238450687&cv=9&fst=1618238450687&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&tiba=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df4c0856369aff0b375414868ea0faa0c4b18a8b0834dcef04450f06b5e22ff5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1097
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 76856514.js Show response
www.iubenda.com/cookie-solution/confs/js/ 63 B
435 B 32ms
31ms Script
application/javascript 104.111.214.240
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.iubenda.com/cookie-solution/confs/js/76856514.js
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.214.240 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-214-240.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
access-control-request-method: *
content-encoding: gzip
content-length: 69
last-modified: Fri, 26 Mar 2021 11:56:36 GMT
server: nginx
etag: "605dcbf4-3f"
vary: Accept-Encoding
access-control-allow-methods: POST, PUT, DELETE, GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
expires: Tue, 13 Apr 2021 14:40:50 GMT

POST
H2 200 e
analytics.shareaholic.com/ 43 B
377 B 295ms
99ms Other
image/gif 3.90.171.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.shareaholic.com/e

Requested by

Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.90.171.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-90-171-169.compute-1.amazonaws.com

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Content-Security-Policy	referrer always

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
vary: Origin
p3p: CP="OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC"
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
referer-policy: unsafe-url
content-security-policy: referrer always
content-type: image/gif
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
166 B 144ms
144ms Image
image/gif 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Mon, 12 Apr 2021 14:40:50 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d493576ecd838aa17c07e55ca3f7a4dc
x-transaction: 0032a7e800ffda09
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
85 B 13ms
13ms XHR
text/plain 2a00:1450:400c:c1b::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-114787942-1&cid=1306929973.1618238451&jid=327557055&gjid=381601779&_gid=807582760.1618238451&_u=aGDAgUADQAAAAE~&z=186385436

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 12 Apr 2021 14:40:50 GMT
content-type: text/plain
access-control-allow-origin: https://cofense.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
63 B 6ms
6ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j89&aip=1&a=410013643&t=pageview&_s=1&dl=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&ul=en-us&de=UTF-8&dt=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&exp=Y916st7_TUq9exzEKHDaPA.1&_u=aGDAgUADQ~&jid=327557055&gjid=381601779&cid=1306929973.1618238451&tid=UA-114787942-1&_gid=807582760.1618238451&gtm=2wg3v05RQ37KH&z=1681962301

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 16632
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 29ms
29ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Wed, 21 Jul 2021 14:40:50 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1061448384/ 42 B
182 B 19ms
19ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1061448384/?random=1618238450687&cv=9&fst=1618236000000&num=1&bg=ffffff&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&tiba=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3307863533&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/1061448384/ 42 B
108 B 20ms
20ms Image
image/gif 2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/1061448384/?random=1618238450687&cv=9&fst=1618236000000&num=1&bg=ffffff&guid=ON&eid=2505059651&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa3v0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&tiba=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&async=1&fmt=3&is_vtc=1&random=3307863533&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 modules.3dd906c82e8608f74e44.js Show response
script.hotjar.com/ 218 KB
58 KB 104ms
39ms Script
application/javascript 13.226.155.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.3dd906c82e8608f74e44.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.55 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-55.dus51.r.cloudfront.net

Software

Resource Hash

376cd23f777e0f8e67d32471c2c3f5463b597ae49ed6d4e17dbd4eacc9ada67d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:30:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 642
x-cache: Hit from cloudfront
content-length: 58876
access-control-allow-origin: *
last-modified: Mon, 12 Apr 2021 14:29:42 GMT
etag: "ae6c3b64bb409ad3604d6a1a2b17820b"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 bfd667b9fb826986b85315f856bf5885.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: zZGMt2OP7n_7eL5IPNTBNrtpxbsy6bltiQ6k_smWFVmfahtJkkpgJg==

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
276 B 31ms
31ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1306929973.1618238451&jid=327557055&_u=aGDAgUADQAAAAE~&z=1656731901

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
483 B 57ms
43ms Image
image/gif 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j89&tid=UA-114787942-1&cid=1306929973.1618238451&jid=327557055&_u=aGDAgUADQAAAAE~&z=1656731901

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

index.js Show response
s.adroll.com/j/exp/
Redirect Chain

https://s.adroll.com/j/exp/TFV7KNIV3VHWLJ6GAQ3KFT/index.js
https://s.adroll.com/j/exp/index.js

28 B
747 B

29ms
29ms

Script
application/javascript

184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/exp/index.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 8C_4p5S6NLuKOM2fXKpm7asomxwPn3IL
Content-Encoding: gzip
ETag: "5816cced8568d223aa09d889f300692b"
x-amz-request-id: A6E4D842C4F3666B
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 48
x-amz-id-2: 1Pslf+Y9QwUHIZmwUo95w2CKA8MTrgZpbGBRFLUwAevxRDJ3euWTGuAJ2AJ78njOjdUd48ZsKSg=
Last-Modified: Tue, 19 Jan 2021 16:25:36 GMT
Server: AmazonS3
Date: Mon, 12 Apr 2021 14:40:50 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

Date: Mon, 12 Apr 2021 14:40:50 GMT
Server: AkamaiGHost
Location: https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 0

GET
H/1.1 200
OK index.js Show response
s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/ 0
773 B 91ms
35ms Script
text/javascript 184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/j/pre/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/index.js
Requested by: Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: T1o7nlCzifvhr3pU3v.hZLQOJ7hY1PD8
Content-Encoding: gzip
ETag: "d41d8cd98f00b204e9800998ecf8427e"
x-amz-request-id: F2RXSQFG1KHDYGPE
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 20
x-amz-id-2: A6iArU4GEW+tCgTvxn1odInP0g3K46zD2c+tSkExmQuM6RbF/klNVn1IAc7Dhm6o2g4aPtniCVI=
Last-Modified: Mon, 12 Apr 2021 01:09:07 GMT
Server: AmazonS3
Date: Mon, 12 Apr 2021 14:40:50 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

GET
H2

200

/ Show response
d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/
Redirect Chain

https://d.adroll.mgr.consensu.org/consent/iabcheck/TFV7KNIV3VHWLJ6GAQ3KFT?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2
https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2

394 B
862 B

39ms
38ms

Script
application/javascript

34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 11f9231485301294d4d5dfd2105b790e3f1466713c108f26c2fc382721108c53

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:50 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: application/javascript
content-length: 394
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Redirect headers

location: https://d.adroll.com/consent/check/TFV7KNIV3VHWLJ6GAQ3KFT/?_s=1cb494a13bc7ba1d14e5794137b6c931&_b=2
date: Mon, 12 Apr 2021 14:40:50 GMT
server: nginx/1.18.0
content-length: 105

GET
H2 200 box-5e3cec51ed8e99df6977c199d27812d7.html Show response
vars.hotjar.com/ Frame 1D43 1 KB
1 KB 102ms
30ms Document
text/html 13.226.155.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-5e3cec51ed8e99df6977c199d27812d7.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1312741.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.86 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-86.dus51.r.cloudfront.net
Software: /
Resource Hash: 486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33

Request headers

:method: GET
:authority: vars.hotjar.com
:scheme: https
:path: /box-5e3cec51ed8e99df6977c199d27812d7.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html
content-length: 684
date: Tue, 30 Mar 2021 16:10:32 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
etag: "4e332edbbc3b46800c87f197cc7d3bb6"
last-modified: Tue, 30 Mar 2021 14:48:51 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 88bc7a9e54e3765a2fd64d3e80cc8217.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 4VwGa5xsQvPdY1eBSEslFrB9u53Sl1JsukyGxmXK6EYyTvCmVgodxg==
age: 1117818

POST
H2 204 write Show response
hits-i.iubenda.com/ 0
397 B 73ms
73ms XHR
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Requested by: Host: cdn.iubenda.com
URL: https://cdn.iubenda.com/cookie_solution/iubenda_cs/1.29.0/core-en.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/
Authorization: Basic aGl0czFfdTpoaXRzMV91cHdk
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
server: nginx
x-influxdb-build: OSS
access-control-allow-methods: DELETE, GET, OPTIONS, POST, PUT
access-control-allow-origin: https://cofense.com
access-control-expose-headers: Date, X-InfluxDB-Version, X-InfluxDB-Build
request-id: 13d6cd52-9b9d-11eb-88a5-0242ac110002
access-control-allow-headers: Accept, Accept-Encoding, Authorization, Content-Length, Content-Type, X-CSRF-Token, X-HTTP-Method-Override
x-influxdb-version: 1.8.2
x-request-id: 13d6cd52-9b9d-11eb-88a5-0242ac110002

OPTIONS
H2 204 write
hits-i.iubenda.com/ Frame 0
0 102ms
31ms Preflight
text/plain 178.62.192.243
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://hits-i.iubenda.com/write?db=hits1
Protocol: H2
Server: 178.62.192.243 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization
Origin: https://cofense.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx
date: Mon, 12 Apr 2021 14:40:50 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: *, authorization
access-control-max-age: 1728000
access-control-allow-credentials: true
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 partners.js Show response
partner.shareaholic.com/ 0
265 B 390ms
181ms Script
application/javascript 107.20.147.136
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://partner.shareaholic.com/partners.js?location=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&cl=en-US&id_sync=cf697cea-3dce-4a3d-bbf4-802e2281bdf3&minify=1&site=62df9f201cc7c19a56912daae814efca
Requested by: Host: m9m6e2w5.stackpathcdn.com
URL: https://m9m6e2w5.stackpathcdn.com/v2/2d6bea9f/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 107.20.147.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
vary: Accept-Encoding, User-Agent
p3p: CP='OTI DSP COR DEVo ADMa OUR CONo IND COM INT ONL PUR STA OTC'
cache-control: no-cache, no-store, must-revalidate
content-type: application/javascript;charset=utf-8
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

LZCH7AGKEBFGLOFOIHTG7Q.js Show response
s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/
Redirect Chain

https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communicat...
https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js

4 KB
2 KB

32ms
32ms

Script
text/javascript

184.30.24.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.121 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-121.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: pV63wssUTNuzKRiEhPCUY6UWHFWb2FIJ
Content-Encoding: gzip
ETag: "a7a27b8b818085dc9afcceff9102471d"
x-amz-request-id: 523FCB5FF6C9673C
x-amz-server-side-encryption: AES256
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 1499
x-amz-id-2: d3lp8T1EhKOv2J2yjpHRATwqFF1cB2r2DkAB+qWhJPBJVw01qouvXQT/iDmu+1aHQ9KKxAOEiyQ=
Last-Modified: Tue, 26 Jan 2021 22:18:13 GMT
Server: AmazonS3
Date: Mon, 12 Apr 2021 14:40:51 GMT
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, must-revalidate
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Access-Control-Allow-Headers: *

Redirect headers

pragma: no-cache
x-conversion-value: 0.00
server: nginx/1.18.0
x-rule: *
date: Mon, 12 Apr 2021 14:40:50 GMT
x-segment-eid: LZCH7AGKEBFGLOFOIHTG7Q
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://s.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD/LZCH7AGKEBFGLOFOIHTG7Q.js
cache-control: no-store, no-cache, must-revalidate
x-segment-display-name: Visitors to Unsegmented Pages
x-pixel-eid: JLU6TD3D6FA2JAELGSQWLD
x-segment-name: *
x-advertisable-eid: TFV7KNIV3VHWLJ6GAQ3KFT
content-length: 0
x-conversion-currency

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 91 KB
23 KB 88ms
87ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d.adroll.com
URL: https://d.adroll.com/pixel/TFV7KNIV3VHWLJ6GAQ3KFT/JLU6TD3D6FA2JAELGSQWLD?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&pv=16738116444.035444&cookie=&adroll_s_ref=&keyw=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

86cc35989be655e6cbe68540cf835dec34388862a948fbd05850100797c32319

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23784
x-fb-rlafr: 0
pragma: public
x-fb-debug: Ots0Yw5LBJ/MBRwXmk0zJY37Xj8ltpEzxXSIwG26j1CxX3zhfy0Wv7jtvWEDpiFnPHrKQvmRwA6D0okwE1LYCQ==
x-fb-trip-id: 2050670934
x-frame-options: DENY
date: Mon, 12 Apr 2021 14:40:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55980/
Redirect Chain

https://d.adroll.com/cm/aol/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_c...
https://pixel.advertising.com/ups/55980/sync?uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

0
125 B

113ms
36ms

Image
text/plain

35.156.106.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55980/sync?uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.106.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/55980/sync?uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 167
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://d.adroll.com/cm/index/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid...
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451&C=1

43 B
1 KB

38ms
38ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451&C=1
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 12 Apr 2021 14:40:51 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 12 Apr 2021 14:40:51 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 12 Apr 2021 14:40:51 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expiration=1649774451&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 333
Expires: Mon, 12 Apr 2021 14:40:51 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://d.adroll.com/cm/n/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=...
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expires=365

0
239 B

129ms
32ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expires=365
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&expires=365
pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 124
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/
Redirect Chain

https://d.adroll.com/cm/outbrain/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&...
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M
https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&rdrctExp=true

0
477 B

100ms
99ms

Image
text/plain

70.42.32.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&rdrctExp=true
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.95 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:51 GMT
Cache-Control: no-cache
X-TraceId: 904316e73450cf1b4d9274c9396b2f4a
Content-Length: 0

Redirect headers

Location: https://sync.outbrain.com/cookie-sync?p=adroll&uid=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&rdrctExp=true
Date: Mon, 12 Apr 2021 14:40:51 GMT
X-TraceId: c6c2c2424b0b9977495d2f3ea9c27f10
Content-Length: 0

GET
H/1.1

200
OK

Pug
simage2.pubmatic.com/AdServer/
Redirect Chain

https://d.adroll.com/cm/pubmatic/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...

1 B
806 B

89ms
31ms

Image
text/html

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:51 GMT
X-lat: lhrpug001:0:530
Server: nginx
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 1

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 220
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2

204

rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain

https://d.adroll.com/cm/taboola/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&x...
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M

0
218 B

115ms
36ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

tbl-x-upstream: 10.40.0.134:10213
date: Mon, 12 Apr 2021 14:40:51 GMT
server: nginx
x-fastly-to-nlb-rtt: 16162

Redirect headers

location: https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=MTE3ZWZmZTQxOGRmYWY1NzM3NTdkNzcxZWIyYWVkN2M
pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-length: 111
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 out
d.adroll.com/cm/triplelift/ 42 B
500 B 38ms
37ms Image
image/gif 34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/triplelift/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: image/gif
content-length: 42
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 out
d.adroll.com/cm/r/ 42 B
499 B 38ms
37ms Image
image/gif 34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/r/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: image/gif
content-length: 42
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 out
d.adroll.com/cm/b/ 42 B
499 B 38ms
37ms Image
image/gif 34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/b/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: image/gif
content-length: 42
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 out
d.adroll.com/cm/x/ 42 B
501 B 38ms
38ms Image
image/gif 34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/x/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-store, no-cache, must-revalidate
server: nginx/1.18.0
content-type: image/gif
content-length: 42
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

GET
H2 200 out
d.adroll.com/cm/l/ 42 B
180 B 38ms
37ms Image
image/gif 34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/l/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=f&advertisable=TFV7KNIV3VHWLJ6GAQ3KFT
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-transform,public,max-age=300,s-maxage=900
server: nginx/1.18.0
content-length: 42
vary: Cookie
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://d.adroll.com/cm/o/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=...
https://us-u.openx.net/w/1.0/sd?id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266
https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266

43 B
180 B

27ms
27ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: OXGW/16.205.2 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
via: 1.1 google
server: OXGW/16.205.2
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=7d2b2109bba67b9c4efdf1cd9b7d1266
date: Mon, 12 Apr 2021 14:40:51 GMT
via: 1.1 google
server: OXGW/16.205.2
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

in
d.adroll.com/cm/g/
Redirect Chain

https://d.adroll.com/cm/g/out?adroll_fpc=c4178838732295dc285ad5bee3ca42e7-1618238450956&arrfrr=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&xid_ch=...
https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=B_3vxl5aoEF2q84UUcUoMw
https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=B_3vxl5aoEF2q84UUcUoMw&google_tc=
https://d.adroll.com/cm/g/in

42 B
536 B

43ms
43ms

Image
image/gif

34.253.95.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adroll.com/cm/g/in
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.95.95 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
server: nginx/1.18.0
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-store, no-cache, must-revalidate
content-type: image/gif
content-length: 42
x-result: g.-1.-1.-1

Redirect headers

pragma: no-cache
date: Mon, 12 Apr 2021 14:40:51 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://d.adroll.com/cm/g/in
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 forms2.css
app-ab46.marketo.com/js/forms2/css/ 13 KB
3 KB 45ms
45ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4975
vary: Accept-Encoding
content-length: 2623
cf-request-id: 096820458400000857e83b0000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "2c408d2-3437-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 63ed364f3ba40857-CDG
expires: Mon, 12 Apr 2021 18:40:51 GMT

GET
H2 200 forms2-theme-plain.css
app-ab46.marketo.com/js/forms2/css/ 828 B
364 B 50ms
50ms Stylesheet
text/css 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 488
vary: Accept-Encoding
content-length: 246
cf-request-id: 096820458000000857378a9000000001
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
etag: "28e07cb-33c-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 63ed364f3ba90857-CDG
expires: Mon, 12 Apr 2021 18:40:51 GMT

GET
H2 200 select_ui.png
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/ 1 KB
1 KB 20ms
19ms Image
image/png 108.161.188.228
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/images/select_ui.png
Requested by: Host: qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.161.188.228 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd

Request headers

Referer: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/themes/copro/css/theme-styles.css?ver=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
last-modified: Fri, 09 Apr 2021 20:39:52 GMT
server: NetDNA-cache/2.2
etag: "6070bb98-43d"
vary: Accept-Encoding
x-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1085

GET
H2 200 XDFrame Show response
app-ab46.marketo.com/index.php/form/ Frame 625C 2 KB
895 B 242ms
241ms Document
text/html 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/index.php/form/XDFrame

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-ab46.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cf_bm=d1db8f4e6025abc446cebaad65820f10ba7d0335-1618238450-1800-ATejSNyD1bs2fT8ZcBK0Vf4b79foQwoztka96j7Fl8OU96CaeVdEf6l0vHA9ntwNU1XhqlYTmht2zY4TN5VwqFE=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
content-type: text/html; charset=utf-8
content-length: 653
set-cookie: __cfduid=d6ddcfa597793ac03f748de04384861421618238451; expires=Wed, 12-May-21 14:40:51 GMT; path=/; domain=.app-ab46.marketo.com; HttpOnly; SameSite=Lax BIGipServerab46web-nginx-app_https=!6p5JRChWWhNhzMXaIvODocHezid2PWpC02Tdr2IJnfBiT4eE/dgYhwcBq0rJX2b5zTAwFO+qMWg7pg==;Path=/;Version=1;Secure;Httponly
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-request-id: 09682045f1000008571b0b8000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 63ed364fedd90857-CDG

GET
H2 200 356920024481298 Show response
connect.facebook.net/signals/config/ 240 KB
69 KB 131ms
130ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/356920024481298?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: public
x-fb-debug: GlFLyiGRI0lvI6nNW6m4Nz2rEchUFnDhMwDqFprNOO+bWQAeGN54x8OTiNR2EmWqalV263EtcY9+u0z/iwU3RA==
x-fb-trip-id: 2050670934
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 12 Apr 2021 14:40:51 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
147 B 87ms
86ms Image
image/gif 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=356920024481298&ev=PageView&dl=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&rl=&if=false&ts=1618238451373&cd[segment_eid]=LZCH7AGKEBFGLOFOIHTG7Q&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=29&fbp=fb.1.1618238451371.1113586532&it=1618238451184&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET

Requested by

Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 12 Apr 2021 14:40:51 GMT

GET
H2 200 forms2.min.js Show response
app-ab46.marketo.com/js/forms2/js/ Frame 625C 204 KB
68 KB 43ms
42ms Script
application/x-javascript 104.16.94.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-ab46.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: app-ab46.marketo.com
URL: https://app-ab46.marketo.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.94.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://app-ab46.marketo.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Wed, 10 Mar 2021 20:12:10 GMT
server: cloudflare
age: 5687
etag: "2c40899-33187-5bd344826ba80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 63ed36517ab00857-CDG
cf-request-id: 09682046e900000857488dd000000001
expires: Mon, 12 Apr 2021 18:40:51 GMT

GET
H2 200 core Show response
js.driftt.com/ Frame 0C90 3 KB
1 KB 142ms
141ms Document
text/html 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1618238700000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ab027534ceb362f1414e210763531bbe768a19c9533a117c0d0f5f41878511d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Fri, 09 Apr 2021 13:08:10 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: F0OH1mLPc9wwP5WFD_Yg9xK6FcsUA.zD
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-cache
etag: W/"5c05456bb189de08d99b690288b83029"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: nKaora8cjLlrPocEkQDUmwjYj9covzMzu4_vFlq_MQCHh150XGcTzg==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 3F0B 3 KB
1 KB 141ms
141ms Document
text/html 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1618238700000/28krvx2uf9n3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ab027534ceb362f1414e210763531bbe768a19c9533a117c0d0f5f41878511d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core/chat
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://cofense.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://cofense.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Fri, 09 Apr 2021 13:08:10 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: F0OH1mLPc9wwP5WFD_Yg9xK6FcsUA.zD
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 12 Apr 2021 14:40:51 GMT
cache-control: no-cache
etag: W/"5c05456bb189de08d99b690288b83029"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: QwDHyBRrVD2SetX8oLncKSfteY4Qt_hWImt2Geg0K_RKm85tlg16BQ==

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 431ms
105ms Script
application/javascript 35.174.78.146
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: cofense.com
URL: https://cofense.com/emotet-update-new-c2-communication-followed-new-infection-chain/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.78.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: PardotServer /
Resource Hash: 925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:51 GMT
Content-Encoding: gzip
X-Pardot-Route: ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB: d3d7f55bb0643f40d338b3c1e133d5c5
Last-Modified: Fri, 13 Mar 2020 17:29:01 GMT
Server: PardotServer
ETag: "1442-gzip"
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=63072000
Accept-Ranges: bytes
Content-Length: 1842
Expires: Wed, 12 Apr 2023 14:40:51 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
281 B 148ms
147ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nv828&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 115
pragma: no-cache
last-modified: Mon, 12 Apr 2021 14:40:51 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: dd6048286b03e9bd7ecd3837bbdf899e
x-transaction: 00c48745009fdf9d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 runtime~main.60e4a1d0.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 5 KB
3 KB 38ms
35ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

b289dad9bc85f77885699d2e459240f314ecefb32d6f0dd5ae13afcabb03ca74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334744
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:16 GMT
server: nginx
etag: W/"a27aabd54918dea8ef029f5918d4c82b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: tdl5_7G_oMdo08dmfeeDUAm_t3SJugaO
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ziFoXZtgjGTcHMHiiQm3aMG6nIisAHdd0DDC4mS51uzO9KRrsb62fg==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 40 KB
12 KB 38ms
35ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 6346399
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SfJ9XcJa_gz3QIsTK6tePdAZkWBFiIJUmjxQ6mTaEkWF6DKRcQ0jkA==

GET
H2 200 24.51b9fb55.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 42 KB
12 KB 38ms
35ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.51b9fb55.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"cef2e36f386b30af63a3565f56cb570c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2YkFlG1sZ1uGuw9fRJhr_rduXEPaItbU
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7axnHKIeuh3u3RzjYHizdlDp-QscI9p_IYde8wLNQf9U8bP1_ht_pA==

GET
H2 200 18.df9af1cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 70 KB
21 KB 38ms
35ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.df9af1cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"4dd1a4c39ef032a7370127a7a049792b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: h.C2zbsx58v1pJxunn7Ah5lgmrvqa1du
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: qrTIozqEyPoLtS9Sg37Fxd3820hhnQXvNSeykx3hRihg33-Trkn0Tg==

GET
H2 200 30.d7884983.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 48 KB
15 KB 47ms
44ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.d7884983.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 3363410
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"4e1b145be04e5bc76ea6d15f491a0174"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RQGg9Lzfff.JlTlK.NLmBXc6K0oL5gia
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: W5EiROvbo2cPU8u8526_xO4OMRaehmbNbpaHtFLDuHgO1Gal6DKbig==

GET
H2 200 17.01346f26.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 29 KB
8 KB 47ms
44ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.01346f26.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"d881c1078c1983fec915bc6b6aa0deb9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DZAqQV.UJvsXxwZF6YiaFl2qyaLgaBjX
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lEAVMW64C-iespIml6DHX0UY8dHAqzI8CspR4565hcEpyq6vZBS15w==

GET
H2 200 19.96441b8b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 39 KB
10 KB 47ms
45ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"854e298ba40cc0c37109059dacdab629"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kwztBgKt0lPDbNGCedO1WX5zOCf-MIac7jGPZrg9-6cwV5GxDtJ2_w==

GET
H2 200 35.a8afab31.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 52 KB
18 KB 47ms
45ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:47:00 GMT
content-encoding: gzip
age: 2746430
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Mar 2021 19:15:02 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .G4l5M3zdEr.H9Ym7Vn1RjNno_gNBdpu
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pPX9CUaj5KAS-mTti-JJ4kB6quQU0p31Wu-Frx5m80-tIt9a2Q6ahA==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 24 KB
10 KB 47ms
45ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:28:48 GMT
content-encoding: gzip
age: 3352323
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 16:50:21 GMT
server: nginx
etag: W/"185cc47f69cf9cfd71f532b15a0b6e8e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Sa1cQ5AXCSfvmijtq3l0XPcobRiPq9R0
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RxZ_HOmgz2ms-AMSgEB-wl-3OCNaAsWXLYGM9CVAhmqdFC7fhor5RA==

GET
H2 200 13.dce07d58.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 60 KB
21 KB 47ms
45ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.dce07d58.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"53cb1bc6a93f37cb23bd87c0969623e9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: B9qKAkZ_gCQFUK9XQjx8Tol3YM6NhFM1
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0sU01eLo7x0ipJM8uS039anvKxHCLnD3fyi20m7RGXRmb7dPr-t6cg==

GET
H2 200 main~493df0b3.40a201b4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 21 KB
7 KB 63ms
61ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.40a201b4.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"69fb0eac23d360e99d09dc8ff2d9f962"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bSwH_75xAiofeTvLmJWwyVFlVbSGw1A9
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rVmxSxdLjwcUEi7ryeb2F0KhWtKqTyAtqKYAaApKWNPX9sIequmhpw==

GET
H2 200 main~970f9218.fe9024ab.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 63 KB
16 KB 63ms
61ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.fe9024ab.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"e5ee197ba311176a274dc6e7fee6e7f6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7P0jL99.Os6SrCjfRNCPbidx0BZ2SnmU
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: aaa6BsJYFKsMN2zU3EhQvroDIcWRKcW84HfEslyRFgX8RA6c7jGNoA==

GET
H2 200 main~89e24786.afbb2c59.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 62 KB
17 KB 63ms
61ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.afbb2c59.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"664d363329fb00cc74d058503814a7ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JcerQY68_yXSuUYCWk2Pjyd9PnG2n_nr
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IY5uuf-x-RF69UuH7SuULEjlXicaJZsUgE7KMJq3RGq85UrAEx1n3A==

GET
H2 200 main~53ca99a6.730a0fa2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 28 KB
9 KB 63ms
62ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.730a0fa2.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

fc9e879da81f1bfe42bfefa7bd82064132ba23b00992a870eb9021d725cdbe6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 13:08:10 GMT
content-encoding: gzip
age: 264761
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 09 Apr 2021 12:58:49 GMT
server: nginx
etag: W/"939aa5527b9e69b10a548f6eb2dd184e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SFaqRE7behZdAzatI7_gAXV4GtdCQeKS
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UxbFlwbBQnpNSExwrNVXAqnrPavjg6dhjd2Et02xFsfPWxockT0afQ==

GET
H2 200 runtime~main.60e4a1d0.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 5 KB
3 KB 62ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

b289dad9bc85f77885699d2e459240f314ecefb32d6f0dd5ae13afcabb03ca74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334744
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:16 GMT
server: nginx
etag: W/"a27aabd54918dea8ef029f5918d4c82b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: tdl5_7G_oMdo08dmfeeDUAm_t3SJugaO
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -iqsY8cVHO0s9YhHRo5ot_gQMWxzYEEt6WCKlfuPSI0djDEKypz8jQ==

GET
H2 200 38.feef3c6b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 40 KB
12 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 29 Jan 2021 03:47:32 GMT
content-encoding: gzip
age: 6346399
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 28 Jan 2021 22:54:33 GMT
server: nginx
etag: W/"8a244bcbbb9c80ac041e954050101a6d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y2xtiqOhyUagLaCd4JUdQFq9_qeHBQGq
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8IxEkylSejBEhOtZI2y9h60Evt8Cj8UT4HMizo6SKtlftilDn7Qzig==

GET
H2 200 24.51b9fb55.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 42 KB
12 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.51b9fb55.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"cef2e36f386b30af63a3565f56cb570c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2YkFlG1sZ1uGuw9fRJhr_rduXEPaItbU
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: _TXOwFMqFMYqTA5yw4GI--L5TpVVQ2G21qlATbcojL1mfiZJFFO1xQ==

GET
H2 200 18.df9af1cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 70 KB
21 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.df9af1cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"4dd1a4c39ef032a7370127a7a049792b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: h.C2zbsx58v1pJxunn7Ah5lgmrvqa1du
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: S1xabQeLFVNEcizufPUTK6G6Dx2kW4otbHP64F1Rt8K3R-DU7sNwLg==

GET
H2 200 30.d7884983.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 48 KB
15 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.d7884983.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 3363410
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"4e1b145be04e5bc76ea6d15f491a0174"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RQGg9Lzfff.JlTlK.NLmBXc6K0oL5gia
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 0Cy1w7C-dipVUZuw93JHw2wsrsSnuK0gVATcdYJhoDaAn6p9r8qVrA==

GET
H2 200 17.01346f26.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 29 KB
8 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.01346f26.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"d881c1078c1983fec915bc6b6aa0deb9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DZAqQV.UJvsXxwZF6YiaFl2qyaLgaBjX
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4cyvy6cIfuynHltWWDPIRHOKfd9Q4R3IeAJGYZDXS2WcW7613BSJWQ==

GET
H2 200 19.96441b8b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 39 KB
10 KB 61ms
58ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.96441b8b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"854e298ba40cc0c37109059dacdab629"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: MzIZE0mgaY7m.fGb.LX9IlVUAL8cjvev
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: peq2kS_55c9wZlDpho-O-K1fmYhtlncEwq47t81CRyMvg7mjy1F4-w==

GET
H2 200 35.a8afab31.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 52 KB
18 KB 61ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.a8afab31.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 19:47:00 GMT
content-encoding: gzip
age: 2746430
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Mar 2021 19:15:02 GMT
server: nginx
etag: W/"e000fed6be2bb9d6650a3d6298820c00"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .G4l5M3zdEr.H9Ym7Vn1RjNno_gNBdpu
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2jBK1s7cjvZzRqPWS880lhUBZL1j_O9DtlilFZ8dYxIdrSlI66JuUw==

GET
H2 200 33.6dcbce8f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 24 KB
10 KB 61ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.6dcbce8f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 19:28:48 GMT
content-encoding: gzip
age: 3352323
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 16:50:21 GMT
server: nginx
etag: W/"185cc47f69cf9cfd71f532b15a0b6e8e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Sa1cQ5AXCSfvmijtq3l0XPcobRiPq9R0
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: E8ifcjYd8ELC3RdGnHyuQT9OVnST4R2Ht9TgCB56NFxyWPdwQGuFMQ==

GET
H2 200 13.dce07d58.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 60 KB
21 KB 61ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.dce07d58.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:02 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:09 GMT
server: nginx
etag: W/"53cb1bc6a93f37cb23bd87c0969623e9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: B9qKAkZ_gCQFUK9XQjx8Tol3YM6NhFM1
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: C3Q20GPLl9nWoD4ceBbjEdvinpyAKMm0L1dXgTpt1xI-6518qLh-lg==

GET
H2 200 main~493df0b3.40a201b4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 21 KB
7 KB 61ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.40a201b4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"69fb0eac23d360e99d09dc8ff2d9f962"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bSwH_75xAiofeTvLmJWwyVFlVbSGw1A9
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: THEgSfrbRZmyd99BTsWDbxhBORhv8cQY4VZtdOlGf57rjE8YS27yUQ==

GET
H2 200 main~970f9218.fe9024ab.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 63 KB
16 KB 61ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~970f9218.fe9024ab.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"e5ee197ba311176a274dc6e7fee6e7f6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7P0jL99.Os6SrCjfRNCPbidx0BZ2SnmU
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AqgF3wCt4Pv6KW0FtODZ4mPAtrCVgTLKrLC1eYIq-HyDNRobBpXEFQ==

GET
H2 200 main~89e24786.afbb2c59.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 62 KB
17 KB 60ms
59ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~89e24786.afbb2c59.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:02 GMT
content-encoding: gzip
age: 508068
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:15 GMT
server: nginx
etag: W/"664d363329fb00cc74d058503814a7ab"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: JcerQY68_yXSuUYCWk2Pjyd9PnG2n_nr
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8IiF8TM0s2_6L9hWXBYWduH-OIZhRy9sEyryJopJIPlj3i88Yq8NMA==

GET
H2 200 main~53ca99a6.730a0fa2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 28 KB
9 KB 60ms
60ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~53ca99a6.730a0fa2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

fc9e879da81f1bfe42bfefa7bd82064132ba23b00992a870eb9021d725cdbe6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Origin: https://js.driftt.com
Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 09 Apr 2021 13:08:10 GMT
content-encoding: gzip
age: 264761
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 09 Apr 2021 12:58:49 GMT
server: nginx
etag: W/"939aa5527b9e69b10a548f6eb2dd184e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SFaqRE7behZdAzatI7_gAXV4GtdCQeKS
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: e3FksDEPFIKzTHIRfMPTB-Wh1QuBQTcyXbhQIPMspm4Qj4IS6JPRcw==

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 6 KB
3 KB 35ms
33ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 5662242
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xv9CarjDh_xLPkLWMaPLrPrcuv3x3D-R3MDflJ1EADQmW_PDKzM-vQ==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 107 KB
34 KB 35ms
34ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 6073901
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gGNDHKKHT4La0_5zrEgdDTdYu5YzpNRcAf6c3-pZjuDJNwfhr9nsWw==

GET
H2 200 27.fca79052.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 27 KB
9 KB 38ms
37ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.fca79052.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 3363410
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"778effaa1518bcdcddb080ef14f98e02"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FaSQOMF905756twg_WaxPLtYkgG28uFg
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zMc71Pk0tKWxFMXWle-u2SYxNRVeDmTdbmZFS4fZ0PjKvaTWqp9IlQ==

GET
H2 200 31.3f86bbb6.chunk.css
js.driftt.com/core/assets/css/ Frame 0C90 2 KB
1 KB 38ms
37ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/31.3f86bbb6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532748
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"2c4cc154316ee9ade3012f13a2c1b2f5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: D08ovFtBYED.yu6DiCG0PnrMH4qOS5.j
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IxIoEJ9xfUBocJTvST4vf7ZTgsiY3dlI1NIbjTngy1tkEoZIe21-iA==

GET
H2 200 31.cda78910.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 5 KB
2 KB 38ms
37ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/31.cda78910.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

a30bbe277414c9c710df300faa5b44d99e72377cd55476ad6562ac124d678536

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:08 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:51 GMT
server: nginx
etag: W/"7690db8d3da5a36d4ec80ef6a706e05d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7bboTpbjQRpiHWT0LcDBWwb0QXYDCRty
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lk0ckuPyKHEfZtuUys6ss5Kj5gYmUbpdvzmB2m0D7aYhZtd87q1-5w==

GET
H2 200 36.56cefaf3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 6 KB
3 KB 39ms
38ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/36.56cefaf3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:50:09 GMT
content-encoding: gzip
age: 5662242
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"199a90762d66f2a85b69771e3ad0d5d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QapLgE7Hrz7BOH3CyhE2UBgsF1vU.UM6
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: KCMtD9k7g_gwraH9ah5aV5W9jQYKojK-7MtbdCi7XmGZjB5AQtpMnA==

GET
H2 200 34.fe729046.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 107 KB
34 KB 40ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.fe729046.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 07:29:10 GMT
content-encoding: gzip
age: 6073901
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 18:47:31 GMT
server: nginx
etag: W/"b75bf38c8eee61f620998bf4e506f0a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sSsGb8qv3FA_x9pHEEYoEYgTo0k7yLWg
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wWlWJzEoRTa2l5dcT6XeuTPNr4vdqcjHxoTiM00q-hoj0uGKo7QYGA==

GET
H2 200 27.fca79052.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 27 KB
9 KB 40ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/27.fca79052.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 04 Mar 2021 16:24:01 GMT
content-encoding: gzip
age: 3363410
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 04 Mar 2021 14:52:17 GMT
server: nginx
etag: W/"778effaa1518bcdcddb080ef14f98e02"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: FaSQOMF905756twg_WaxPLtYkgG28uFg
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lO-FJBpu81XDpwhra4j_PNvECpP23u0Fn4SVPhvdIWJhZYWd1WEhcQ==

GET
H2 200 31.3f86bbb6.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 2 KB
1 KB 40ms
39ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/31.3f86bbb6.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532748
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"2c4cc154316ee9ade3012f13a2c1b2f5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: D08ovFtBYED.yu6DiCG0PnrMH4qOS5.j
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IlhvX0us3jKgXyBF6Ld-ss9DlXw0C94oJNlFksHgdqhUs39p67gq8g==

GET
H2 200 31.cda78910.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 5 KB
2 KB 40ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/31.cda78910.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

a30bbe277414c9c710df300faa5b44d99e72377cd55476ad6562ac124d678536

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:08 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:51 GMT
server: nginx
etag: W/"7690db8d3da5a36d4ec80ef6a706e05d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 7bboTpbjQRpiHWT0LcDBWwb0QXYDCRty
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: m3iTDEwdwqyHByn2UsBeSreti9Kly-7srZrhdUMn2BXrKlsGN5vWug==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 17 KB
6 KB 39ms
34ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 5141170
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -UTqF7yxsgFNsDt17MLlh2R1WPB7A33rBUuBvzBV-CNBEQl2UNsT7w==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 68 KB
20 KB 37ms
34ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 5662703
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rqYmHKprxC50a_Dig464zAY1lGWh9pmItvQg0IWWYS4K0cN9yGfFCQ==

GET
H2 200 28.973133ca.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 41 KB
12 KB 38ms
35ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/28.973133ca.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 05 Mar 2021 20:53:07 GMT
content-encoding: gzip
age: 3260863
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Mar 2021 20:23:41 GMT
server: nginx
etag: W/"ecf99724b02f7b23e01b9717ae480786"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: TA00J8zYqpnkOZxchdfs_j6Px0w36iW5
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sJauEYfsnO4XHCAALjAew_wZ7XHZq5K4zU9SvFI73CxorNJvMTb7Ag==

GET
H2 200 2.c8663009.chunk.css
js.driftt.com/core/assets/css/ Frame 0C90 2 KB
1 KB 35ms
33ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.c8663009.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

62b33c7813e7ad094f92e3917fa81aff0546a584602763b43ce4bcd4ea7b46c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334744
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:12 GMT
server: nginx
etag: W/"49bde0a5fadb142d912e44161f3d4f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PUOdZrRBCyY7g_ZKuhwv_ZCIA4BMEqEK
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ptDuBmeP7BzEQ_2IYra1UI1CNjkWlU68PUGI5BsFzAzvbpfQ0A2gZg==

GET
H2 200 2.76142f45.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 27 KB
10 KB 38ms
36ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 15:57:00 GMT
content-encoding: gzip
age: 1118631
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 30 Mar 2021 15:09:56 GMT
server: nginx
etag: W/"e418db8de1c2a6e2f3ff10bd84e11107"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: zbmshXq66aPkSIx6jZ4E08JKXtO0ykBo
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IKQ7h49GkHG_sYsN4azkKF4v07ivODmbmMwLa9i1wVmFdm0hG8mNwQ==

GET
H2 200 26.02e62d23.chunk.css
js.driftt.com/core/assets/css/ Frame 0C90 8 KB
2 KB 35ms
33ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/26.02e62d23.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 24 Mar 2021 16:09:55 GMT
content-encoding: gzip
age: 1636256
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 24 Mar 2021 15:54:56 GMT
server: nginx
etag: W/"4a7ea3158114815c3ce4a439e64bb20f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: grRYYHSSp1mU3ptY3c1ADwZbODEJ.GD2
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -kHeZM8rMPfeTS6iAq1UGLcDIM0NTlDIknIL1W5V6SHRD55jjsyNvA==

GET
H2 200 26.b28fcc1f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 68 KB
19 KB 41ms
36ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.b28fcc1f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

45c6471f9b8d9a882dc0997d5f2582e6be47dce98d963383521ab6b480b46a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 06 Apr 2021 17:33:03 GMT
content-encoding: gzip
age: 508069
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 06 Apr 2021 17:14:14 GMT
server: nginx
etag: W/"a965df5333777d7d38412493ddeb27f7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Et3fWJqlSsaH1UfzviBYLJKUWDVmkgJr
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AM2g6pjJizo-yz3vGVb5Mbu0s7SflWeD5gImItG9WPYycPbSPjLB1Q==

GET
H2 200 0.45eb4005.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 17 KB
6 KB 33ms
33ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.45eb4005.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 02:34:41 GMT
content-encoding: gzip
age: 5141170
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 11 Feb 2021 15:02:23 GMT
server: nginx
etag: W/"7e689afacd5eb298702f393c9c2f70f8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: meASu2JEFoyVpwOxkLJiMpQwEpCiiXJl
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: grwehwihpu0DnSJ5vb1d00_IDH83sdEi_jRzazGYalDKLViy01MGfw==

GET
H2 200 32.e776e5b0.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 6 KB
1 KB 33ms
33ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.e776e5b0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532748
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"9f36443a9402e1e03bf8070ddc88b8db"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: N9pz_uaOqz_LcCJXwq2fP8udkLRQP9sW
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bqY-kHP1v_nJXTKM10cpyU2lWR7NbiEGsxAdLdcM_eDWoGslEbry6g==

GET
H2 200 32.576563f1.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 2 KB
2 KB 34ms
34ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.576563f1.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

6990cc2a218b1513211f41a22ca6966159774ab8724207389715a03eeb39076f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:08 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:51 GMT
server: nginx
etag: W/"9ad9bc7352d800be4e08503cd2672cb3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PJ.lLcHJr0vuZldsJZV.idbMt_1SYrkI
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WZB-K4QFOELPJzcU6qBmrJRTkafzJC_FIm4k9uDQdQE5jI5rb_L7PA==

GET
H2 200 1.0af467a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 68 KB
20 KB 35ms
34ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.0af467a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 06 Feb 2021 01:42:28 GMT
content-encoding: gzip
age: 5662704
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:44 GMT
server: nginx
etag: W/"aedd244e100709f43b70a84bb3945ca6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: kErXw93froxamEp2BnqkXpG57uNk3Qr1
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QkhFO5S-TtSIsiO0pqoGdJCk_AOmfLFrRf36Bgua-63uwhHBsZjUsA==

GET
H2 200 6.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 7 KB
2 KB 41ms
40ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/6.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:08 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 4W7j47FaGFn6zfjP8WI3XQH_pHab5cA8
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: TiTqpuJjM3FTgEBcT_KevtNWVtg7A2DUimxCQIBd5KGNIFLxQieong==

GET
H2 200 6.8a170c54.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 38 KB
13 KB 40ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/6.8a170c54.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

49768b3da5cf97cb82a6f3db73097011454b7cce09529bff08c9decb23b80254

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"ef7ecb5ffb6e97b627cffdd96eb98848"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LUrYItfzRfdEwKDAEgZAQj1eonofAAo7
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FeqxfnzSYWOmwaAsWL56tOwWewKJRbXy2fuDv7AvJxVe9NlJTcXxcw==

GET
H2 200 5.39718cbd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 50 KB
14 KB 40ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.39718cbd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

b05c21426d9a2999f3f7b48d494bc6dba7b4fba240d3eae1047c99116c075232

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 25 Mar 2021 20:55:03 GMT
content-encoding: gzip
age: 1532749
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 25 Mar 2021 20:27:10 GMT
server: nginx
etag: W/"22b4f20089aad6d0ac685e754c01e20c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: I8vDvAQu.ULzgfdeCA0aGGvdnMiGhc1j
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3TVNauSXO48dNNHOTXE7EOlQcP4nqFTimsv9kA02okoaLK8VSPsRIA==

GET
H2 200 2.c8663009.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 2 KB
1 KB 40ms
39ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.c8663009.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

62b33c7813e7ad094f92e3917fa81aff0546a584602763b43ce4bcd4ea7b46c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334745
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:12 GMT
server: nginx
etag: W/"49bde0a5fadb142d912e44161f3d4f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PUOdZrRBCyY7g_ZKuhwv_ZCIA4BMEqEK
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: u8QrPoOG4ZGvTqQ5VupuEOdn_nRUlelcR-Qg0-RLNkVZEbRlEz82xQ==

GET
H2 200 2.76142f45.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 27 KB
10 KB 41ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 30 Mar 2021 15:57:00 GMT
content-encoding: gzip
age: 1118632
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 30 Mar 2021 15:09:56 GMT
server: nginx
etag: W/"e418db8de1c2a6e2f3ff10bd84e11107"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: zbmshXq66aPkSIx6jZ4E08JKXtO0ykBo
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: J1eSPTDowxRddIopzzPEUG366jS9Fj8p9Vn8UgpOk7-HtQHyeec08g==

GET
H2 200 7.e10c6f40.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 14 KB
3 KB 40ms
39ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/7.e10c6f40.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

4ab346b1d21f307629c9836a9f640965a400ab887fa4963417b6f301255267be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 13:58:42 GMT
content-encoding: gzip
age: 434530
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 13:02:15 GMT
server: nginx
etag: W/"b3b5cd1d956e79a0f86d75a757a6c5f9"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: RiBkwgpYu336J2HKpCThKsrWlCT.X0Et
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: P3H07x2zPWs8nOrgoe1EJAtHRlupa4bT6J8QU_JSjMxCMiqs4FMEZQ==

GET
H2 200 7.b54558ae.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 15 KB
6 KB 35ms
32ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/7.b54558ae.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

84032290c735b0bebec42122484159b74abec3a11258b172e88c243addfe69b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:09 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:52 GMT
server: nginx
etag: W/"27ccfb2f6c1025b38227f347aa717434"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bKBTokhg7k4rdr1e41OPzMky9DcaCY4c
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: A_hTlJnw6FVQr7Gj1FVqgRvP5rKBTcnlgqNRY-nTyZYoY9W1gv85FQ==

GET
H2 200 3.1a6b5c62.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 37 KB
7 KB 40ms
39ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/3.1a6b5c62.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

c78289995801c3d4ec2f1f7b456df9fe89414c385e344b4426b32ec3fcd842ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334745
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:12 GMT
server: nginx
etag: W/"a8936d88d904902cfc29879a1a0814a0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LKmcchAnRGwPaoDsbsgDZQknXhMiv9RJ
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DYZsrxb_7DXxepIpB2PiIzIaDYQ7aj6lfgFZERz1qQfCdbJCTXisqw==

GET
H2 200 3.756d886c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 73 KB
22 KB 34ms
32ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/3.756d886c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

e4c4c36d32676fdcda91de06b26d7dc8d66b03e198c0391a80ac8bd8df2b3431

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 13:58:22 GMT
content-encoding: gzip
age: 348150
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 13:25:10 GMT
server: nginx
etag: W/"84b44a8a951c8d195db0c1f790007680"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: qtMjnuNCWIkCdCk0ykLs0f7X9FLvn.yM
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 1s1TW7u_vK_YAJr-TXSdCTu1W2j_tuqjnNGevsCJ-vR6-XlIC8MhZA==

GET
H2 200 4.ca6c5e68.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 18 KB
8 KB 34ms
32ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.ca6c5e68.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

93b821d22cb2ce70cd11d8303fb7b2bd1ae0823baec282a8ae08e21550632594

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:09 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:51 GMT
server: nginx
etag: W/"f448d88dcc7c7dd65397549847dc2a20"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .soYkTZ.HYIl4G.z3AZqKCwiiqyDBfQX
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5mi716JHCv4NazZ8ucKkuGK6wAJ6mRxSpyE-ts1LqSgNV32YHZ1O1w==

GET
H2 200 22.b3874862.chunk.css
js.driftt.com/core/assets/css/ Frame 3F0B 17 KB
4 KB 40ms
39ms Stylesheet
text/css 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/22.b3874862.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

435bb425f7b99cbf0879f5c79bf7c85fe186831f9b7cd59ce912f80796e30e89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 08 Apr 2021 17:41:47 GMT
content-encoding: gzip
age: 334745
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 08 Apr 2021 16:21:12 GMT
server: nginx
etag: W/"7ae226526a32a08c881ba42cbd4dfe33"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: yTnXaxY_bT6p46ad6rXrxMgLR_n9LMU9
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wgAe6_kAlQUE3fYAgEgeaf942ht7HPKC2WaQeVHBRjP3QXSHM3g9UQ==

GET
H2 200 22.fc7ad613.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 26 KB
9 KB 34ms
33ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.fc7ad613.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

00af24c0de7d1e5ffb36bf61a96abea287506d21771ddaa7de1c1ec723a55009

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 07 Apr 2021 20:36:09 GMT
content-encoding: gzip
age: 410683
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 20:03:51 GMT
server: nginx
etag: W/"6638f04006b3c647c1ed0ae543d2f7d7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LDMKWLt7aZGvyN60UUhnkwMUHNbw6nfY
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6oZEl7MrFwCsv74QHCMZXFCx7v8UCRCVWB8PITAJfAvRp58leMzWJQ==

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 72 B
533 B 117ms
116ms Script
text/html 35.174.78.146
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=1564&account_id=47382&title=Emotet%20Update%3A%20New%20C2%20Communication%20Followed%20by%20New%20Infection%20Chain%20-%20Cofense&url=https%3A%2F%2Fcofense.com%2Femotet-update-new-c2-communication-followed-new-infection-chain%2F&referrer=
Requested by: Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.174.78.146 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: PardotServer /
Resource Hash: d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1

Request headers

Referer: https://cofense.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Mon, 12 Apr 2021 14:40:52 GMT
Content-Encoding: gzip
X-Pardot-Route: d5a18e4517a9c8ba62b77de366a4cdb5
X-Pardot-LB: d3d7f55bb0643f40d338b3c1e133d5c5
Server: PardotServer
Vary: Accept-Encoding,User-Agent
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=63072000
Content-Length: 89
Expires: Wed, 12 Apr 2023 14:40:52 GMT

GET
H2 200 28krvx2uf9n3.json Show response
embeds.driftcdn.com/embeds/ Frame 0C90 128 KB
23 KB 499ms
433ms XHR
application/json 13.226.155.93
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://embeds.driftcdn.com/embeds/28krvx2uf9n3.json
Requested by: Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.155.93 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-155-93.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ec0654ba9eaf36ed77d4154393565cca7cd00a4e7421f9a971ad04b606f3fc73

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
content-encoding: gzip
x-amz-cf-pop: DUS51-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Wed, 07 Apr 2021 12:54:02 GMT
server: AmazonS3
etag: W/"0a635797490b470c5aedca575ad14b67"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=UTF-8
via: 1.1 51054083366f59cdc509361d23d873eb.cloudfront.net (CloudFront)
cache-control: public, max-age=30
x-amz-cf-id: vPZ8DiwKbEUEofHSdvisD9wYCOAh9OyxGAjOTWJqoyGVwgUvO_Sb_A==

POST
H/1.1 200
OK v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0C90 25 B
697 B 112ms
112ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Apr 2021 14:40:52 GMT
server: istio-envoy
requestid: 58d78e4f3ac81655
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 312ms
106ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 12 Apr 2021 14:40:52 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift230e501439c8344d85646b8a22c
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0C90 17 KB
6 KB 39ms
39ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=28krvx2uf9n3&forceShow=false&skipCampaigns=false&sessionId=bf8684aa-f241-4d39-a2dd-a0b0309d5794&sessionStarted=1618238451&campaignRefreshToken=a1d28e15-4328-49c8-ad2b-2c1c2728270f&hideController=false&pageLoadStartTime=1618238450167
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 5493558
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RccBler_YKHhuv9_X1_uHhomf9mB9JsvAYErkCrMiKlCFoVvuyFGVw==

POST
H2 200 widget_bootstrap Show response
bootstrap.api.drift.com/ Frame 0C90 4 KB
2 KB 841ms
584ms XHR
application/json 3.224.7.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.7.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-7-114.compute-1.amazonaws.com

Software

Resource Hash

3e45af33497e2144f8951dd3e4c39cfcef4a5bb2710b15eb0c60aff09f071e1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
content-encoding: gzip
requestid: 85953c47c365e79d
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 2070
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 28krvx2uf9n3
targeting.api.drift.com/hours/availability/combined/ Frame 0
0 306ms
103ms Preflight
text/plain 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Protocol

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-204-215-213.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
content-type: text/plain
content-length: 18
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: HEAD,GET,OPTIONS
requestid: drift66923274298a8ce9166fb3b7908

OPTIONS
H2 200 track
event.api.drift.com/ Frame 0
0 298ms
97ms Preflight
text/plain 54.145.60.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Protocol

Server

54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-145-60-34.compute-1.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
content-type: text/plain
content-length: 13
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
allow: POST,OPTIONS
requestid: driftac72c9c4e5da23476052ab38780

GET
H2 200 28krvx2uf9n3 Show response
targeting.api.drift.com/hours/availability/combined/ Frame 0C90 46 B
490 B 123ms
123ms XHR
application/json 34.204.215.213
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting.api.drift.com/hours/availability/combined/28krvx2uf9n3

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.204.215.213 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-204-215-213.compute-1.amazonaws.com

Software

Resource Hash

d0f78359816f160593648991009f3b2799922d1199b82232b8b73911b221650a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjgzODcwMzkwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTc3NDQ1MywiaWF0IjoxNjE4MjM4NDUzfQ.K1l9JB0JVQFBzLzfhXNonHTI29LldFM9e1DE8qIPEKovPRrx9zyTbSSMEzs1ZGSqaB-vVfAPif_UZ-EFwP5vUg

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
requestid: c6e0994841ea2637
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 46
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

GET
H2 200 css
fonts.googleapis.com/ Frame 0C90 4 KB
752 B 18ms
18ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 14:17:51 GMT
server: ESF
date: Mon, 12 Apr 2021 14:40:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Apr 2021 14:40:53 GMT

POST
H2 200 track Show response
event.api.drift.com/ Frame 0C90 661 B
1 KB 100ms
99ms XHR
application/json 54.145.60.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://event.api.drift.com/track

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.145.60.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-145-60-34.compute-1.amazonaws.com

Software

Resource Hash

bd36c2166c63667fa52baf241c4cfd03c962ed6d3ff7cd0def8c6b894ba28611

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjgzODcwMzkwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTc3NDQ1MywiaWF0IjoxNjE4MjM4NDUzfQ.K1l9JB0JVQFBzLzfhXNonHTI29LldFM9e1DE8qIPEKovPRrx9zyTbSSMEzs1ZGSqaB-vVfAPif_UZ-EFwP5vUg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Apr 2021 14:40:53 GMT
requestid: 7296f280ce9d7b3a
access-control-max-age: 1209600
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 661

GET
H2 200 43.0bd3f7fc.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 3F0B 17 KB
6 KB 32ms
31ms Script
application/javascript 13.226.155.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.0bd3f7fc.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.60e4a1d0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.155.117 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-155-117.dus51.r.cloudfront.net

Software

nginx /

Resource Hash

f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 00:41:34 GMT
content-encoding: gzip
age: 5493559
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Feb 2021 20:58:45 GMT
server: nginx
etag: W/"533cfc95735c653dd37e8e6b8d17383d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ERTUxDMtR8wGkYOicn7jsyBINk5Gat3C
via: 1.1 3b811cf25a4fdc818f7cfcb16b38d622.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: DUS51-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wrAFHLjFK4PlO7SSgWBDcreSiUnGFzyxEuk8MCgaz8M_kszdKQOiFg==

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame 3F0B 4 KB
1 KB 44ms
29ms Stylesheet
text/css 2a00:1450:4001:800::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/2.76142f45.chunk.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://js.driftt.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 12 Apr 2021 13:20:00 GMT
server: ESF
date: Mon, 12 Apr 2021 14:40:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 12 Apr 2021 14:40:53 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0b.woff2
fonts.gstatic.com/s/opensans/v18/ Frame 3F0B 14 KB
14 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0b.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:09:22 GMT
server: sffe
age: 103035
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14380
x-xss-protection: 0
expires: Mon, 11 Apr 2022 10:03:38 GMT

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOUuhp.woff2
fonts.gstatic.com/s/opensans/v18/ Frame 3F0B 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhp.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans|Open%20Sans:bold&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://js.driftt.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:11:00 GMT
server: sffe
age: 103035
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15056
x-xss-protection: 0
expires: Mon, 11 Apr 2022 10:03:38 GMT

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0C90 25 B
697 B 116ms
115ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjgzODcwMzkwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTc3NDQ1MywiaWF0IjoxNjE4MjM4NDUzfQ.K1l9JB0JVQFBzLzfhXNonHTI29LldFM9e1DE8qIPEKovPRrx9zyTbSSMEzs1ZGSqaB-vVfAPif_UZ-EFwP5vUg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Apr 2021 14:40:54 GMT
server: istio-envoy
requestid: 562b6cbc35e86293
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 16
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 0
0 100ms
100ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/event2/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 12 Apr 2021 14:40:54 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: drift7151fcf4a00993be77b81c03a27
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

POST
H/1.1 200
OK bulk Show response
metrics.api.drift.com/monitoring/metrics/add/ Frame 0C90 25 B
696 B 101ms
100ms XHR
application/json 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/38.feef3c6b.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI5MjgzODcwMzkwIiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTQ1Mjg2OCIsImV4cCI6MTY0OTc3NDQ1MywiaWF0IjoxNjE4MjM4NDUzfQ.K1l9JB0JVQFBzLzfhXNonHTI29LldFM9e1DE8qIPEKovPRrx9zyTbSSMEzs1ZGSqaB-vVfAPif_UZ-EFwP5vUg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 12 Apr 2021 14:40:57 GMT
server: istio-envoy
requestid: 39f1d53e5685ffff
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H/1.1 200
OK bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 0
0 113ms
113ms Preflight
text/plain 50.16.7.188
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/add/bulk

Protocol

HTTP/1.1

Server

50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-50-16-7-188.compute-1.amazonaws.com

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 12 Apr 2021 14:40:57 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftd9882a04b38ad958a7aa33e5859
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

Verdicts & Comments Add Verdict or Comment

239 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.app-ab46.marketo.com/	1970-01-19 17:30:40	Name: __cf_bm Value: 2d41bff615b53d4ea0a34d108fe5a9ef2da82454-1618238451-1800-AXz+eo8+U6CA7fEGXN4WUqqTmYR+sa5b9Hkg9VFmNh6CCdziKoJAG+oh5EkhYJeP46HduwZCvjE5XmJ5YzsRv7k=
cofense.com/	1970-01-19 17:30:40	Name: drift_campaign_refresh Value: a1d28e15-4328-49c8-ad2b-2c1c2728270f
.cofense.com/	1970-01-19 19:40:14	Name: _fbp Value: fb.1.1618238451371.1113586532

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 23) Message: JQMIGRATE: Migrate is installed with logging active, version 1.4.1
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: jQuery.fn.load() is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace
console-api	warning	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 56) Message: JQMIGRATE: 'ready' event is deprecated
console-api	log	URL: https://qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp(Line 58) Message: console.trace

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.shareaholic.com
analytics.twitter.com
app-ab46.marketo.com
bootstrap.api.drift.com
cdn.iubenda.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cofense.com
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dsms0mj1bbhn4.cloudfront.net
dsum-sec.casalemedia.com
embeds.driftcdn.com
event.api.drift.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
hits-i.iubenda.com
js.driftt.com
lltrck.com
m9m6e2w5.stackpathcdn.com
metrics.api.drift.com
munchkin.marketo.net
partner.shareaholic.com
pi.pardot.com
pixel.advertising.com
pixel.rubiconproject.com
px.ads.linkedin.com
qhf0l1i8l8u25b2354fr8h39-wpengine.netdna-ssl.com
s.adroll.com
script.hotjar.com
simage2.pubmatic.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
targeting.api.drift.com
us-u.openx.net
use.fontawesome.com
vars.hotjar.com
ws.zoominfo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.iubenda.com
www.linkedin.com
www.shareaholic.net
104.111.214.240
104.111.234.67
104.16.94.80
104.244.42.197
104.244.42.67
107.20.147.136
108.161.188.228
13.226.155.117
13.226.155.55
13.226.155.86
13.226.155.93
141.226.228.48
142.250.185.194
142.250.185.66
142.250.186.34
151.139.128.11
178.62.192.243
184.30.24.121
184.30.24.241
185.64.190.80
199.232.136.157
23.111.9.35
2600:9000:2182:fc00:c:d51b:4400:21
2606:4700::6810:125e
2606:4700::6810:650c
2620:119:50e4:101::6cae:b55
2620:1ec:21::14
2a00:1450:4001:800::2002
2a00:1450:4001:800::200a
2a00:1450:4001:801::2003
2a00:1450:4001:802::2003
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:828::2004
2a00:1450:4001:82a::2008
2a00:1450:400c:c1b::9c
2a02:26f0:7100:191::25ea
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
3.224.7.114
3.90.171.169
34.204.215.213
34.253.95.95
34.98.64.218
35.156.106.231
35.174.78.146
35.188.168.180
50.16.7.188
50.19.224.133
52.222.179.119
54.145.60.34
54.197.98.98
69.173.144.138
70.42.32.95
00af24c0de7d1e5ffb36bf61a96abea287506d21771ddaa7de1c1ec723a55009
00fd33e63ade8958eebf3cd4eabfb016a072021883eb73e15707c27c7467326e
014de295141a456ceda8e3c4762085e53dca50f91ddf65906d227f70cf0b1a55
02ccdd095156565fe6098cef9a1918b92e86dc6023b22fdcb27a2eef3a330482
03be51173737fdb5d979dfd9736dbf9bca895c9c9b30f4d4b64e7e54975948ff
0b0200866fae3fcc0c3f1acf6d8dc18fb93ce8b7a55cc7fbc31b231b01764ddb
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
0f0a82edad8aa60a62ae9ee4816366b69c8212b1068f6ecbf7da97f6796a8056
0f3ffa7f0b928b893a75953b1b233b2bf8dc84f94851a6d24225a59d862c270b
102f598e077a43ea681594e0750b0e835960f288bada922fff4107785b3c7e31
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11f9231485301294d4d5dfd2105b790e3f1466713c108f26c2fc382721108c53
122b9247812038af54dbf68184c2ac8012cf4574a7529af09117131c09652d2a
12a5ec5674ef088f8c198091b7eb6d0478cf5aae6465c09634abae505332d149
1476c101cda6283fbd6a7b4381767b7ecde6d8e1bd871dd43bfba89f1b950a87
14c52b4f1daa1aa3a92d960a311d4518da07e80b7b1a443d3f1a55c0968c99a0
1509adc344f186a37b68ab029c612031ca6ca17e0f3ec306b400315e33c23dcf
1824e38c8fe9b23fb54ed5deafd63f31fcceed673d89111bebc8f05d1aa7b126
19b00d994015088ded16ddd49891ade9c288232431be63c161f5c411e4666121
1a71c8fe9799162a1bbb1faf1f7e60c7db8e90eb15779a9b6b1bf4e0812890f3
1b889b5222373b8a0485f3fb325564e3b2b017a6cbb518d12a045a407d1eca83
1e3bd23f892a7823c8419303360e545aa10d63f307d8117abf1fb1b1f756f58a
201ac106aa78dbaf7062e570803b878ae8d4e909608bc19dc77bdfdc39fe85d0
21110fa48987dc5804b08b84e1008e7c922f7b028c6291c64a6845fbb868014f
22482584aeaa7b1d74de072793246c65e38b402ac231f38bb0d9102802543230
24a2f9c618bd1d9c228d219d747c4068aa6b6aadbf284bd00803d138d27e4cb7
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2979a1c2422a41b4a3e44f260c8427a3ed266d11a3eb2f5cedf59736f9a76b79
2a141ce8eb4c5191e2b0a3af6e81189bc118436ad1b0c0bf12b0d52e6f8edd87
2bc93b3acc1ab580d9303b06ea350432891d69c8a633a618db6287c4a76f77ae
2cf13ef8a0e548d45203297ecc6e21ad5f82fe24e759acbf9a9600996aa4528c
2e27b9cf011c3d5b006906bed6b2b64fbf0b82b2d4821f21dfdf00291c8c07be
2f5cdaaa7889492b45c17f3fd0d79f8a7f72fccb1bb40ad956b37bf11d8c0175
2fb8bbf7561a7cb3f3e25d6cbd650e311544c2f6dad6cf7d805a0ef51e1c5ade
324bcb647088cb88310d71ad938ccce270343da3e2b64c0911cf0e34c0762d56
33530b007071281a97e79baab13ddf7cc4b9de942ebd3e212224857335f7cb97
347cd2766d64da2e2d3ba740c9b07659352d583fd5e42a3d6b794acd43748129
368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
370906bac81874da17c967e44e9da639b9350fd22e910b2711fbe946a7e1f978
3735f094cc3dea915dbe2d90905f1efa19deacabacb80c7aabf0ad8f4a8475e0
376cd23f777e0f8e67d32471c2c3f5463b597ae49ed6d4e17dbd4eacc9ada67d
3bb2621a4c0c710f6e78404473aebff8e115a28f8d53f44339b867c63ad93b26
3e45af33497e2144f8951dd3e4c39cfcef4a5bb2710b15eb0c60aff09f071e1b
3f816745c8ba9795cec19723c0ea8ac11a711ba1af88acdcb0b4a68d8fb1cbfc
435bb425f7b99cbf0879f5c79bf7c85fe186831f9b7cd59ce912f80796e30e89
43661692d21cddb1129b99f9138bfe095a1494a236c4d8b58d0c764f57815d3b
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
45c6471f9b8d9a882dc0997d5f2582e6be47dce98d963383521ab6b480b46a31
46e6f42a22054a793841935920cbbc723856e339fead50fa33c1f1bb3ec5a251
475dbccf84ca50f8d13df95ef5a85c58198fd65fefa481850453de7feb2d4bb2
477de7f62c5e4f36a105fbf424445ffde0c8a7e2263cc8a2d657d221d8a5898d
486762d56893f9b12fdfad41c3a76f11fc745b5436e97e596a63c22ee13d2e33
49768b3da5cf97cb82a6f3db73097011454b7cce09529bff08c9decb23b80254
4ab346b1d21f307629c9836a9f640965a400ab887fa4963417b6f301255267be
4c7856c0d39606a745670d4c03525f3644fe65304191be208516def923cc3762
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
4d371899aba195b1f0cba3a70de300fb5b327a322cfbe3a30d77af8456d8494e
4dc068edecd14f25d56b1f3093a42c9162e0f66a937827f0f1392359094e1208
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e1216a3c268146f3c0f7de270620acee8acaf2ab775759d01c2793519351545
50765708bd9430e89e962b38ef89dc39c6cb8ca35856c7e82c3a0a74998e39f7
523b4316eb8e2bcdd2df9f714e53bae45c0e13fe9cd1e6d7de09ee1f2f5ddf37
5314df92c9197b384f5b5439ef14dca6a749afe25359f9e5a6c0965e86380f33
539420f5aec3cbe2d186a82f224e80c2628dd05f1c7f2815cb8bee3e270a45a1
53fe7d6860d0d3d09f82e41a1d1db6d7bc302b662a7e0bdb096f27b5cbda40ea
55f8adec4b29514b52eb85f0f39875bb441683fa05aeae00f82b9d79ab8d27dd
578332cd14c1c8f1c9ea7cc966ca50ae73945b7de3055e07f06dc099d4feeee0
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a548f4f0fe598ab0e32909884865c4b244d8e8f1caf01a2678a7aa2f032dccf
5a6b2f0487eee2503a9443992282db18bd97997f71570e34fb5b07a79c9cfccd
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5c722519d5b20bb22f0453889d36e0ba6ce9bd967d93fbbe7a9682d31cf31be5
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
5d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
60fc31875f78865acddb5c715176e982b12e8532097184b38a59f793f1691b43
62b33c7813e7ad094f92e3917fa81aff0546a584602763b43ce4bcd4ea7b46c8
6366af5c74ef316dabfd8c4f5257700c4d456104d25487e0c8f40fafa9cfd7ff
643ced756fe32f82d14c178ac0002a181a12d128402bd63b9b74c3cbdd85e66a
65d29e040c59a5e843952c3f0da27028455dc63372440602d129681883891276
65effed019c96df30638340081f21c1fe64e87f1230ddb0d48e2e8b763dbd131
68fcd17644ecd5ee05d3903d090e32116e25a1f25b9593d817c8b9f8b8488614
6990cc2a218b1513211f41a22ca6966159774ab8724207389715a03eeb39076f
708883a21754b3f7e1653d1d358663d65309e97d673a5934990c73f46df22d4c
70fabc58ca55af5ac394614cce6a2288a3eeba4cd5f429eea53eaa443f6ca52e
71209f63fc1592e55fcff12d74e9f6108505190c6e70df5cc7d5748af32b9365
7308d99d803aabd85cf517b896e002e45e573b79c70b652e2552a14ef68162e0
7373ca9ed2c272959213699ab6c34d53f342a2d01d996ebc543743312911a6dc
737dadb23f48c0823c3d5f597c2f9d34d81a8e964f013109fb366d7d84dffdc1
73952cc80c6ea36f277133e6aad1b4257fc9b4ac776643b70e7e882a2854b42d
74201a4b97ec1d5e86252dd0180eafd8c5378a9235864dbcd682f3575b41c85b
7742176d36a9ea889f4db0a843e62f522ba690a8d514e91dd5aa09eccf7340ce
7971bffa44c1c86543b6747b7ac333564decf57d2696acb1f939e521bb49f766
7f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
7fd52abcc46a46e1d1f39cf3677e2a581b4365872258b5fbc5e28eb183fb6410
817c7a8de5f73b3bd9358babbbd8f904fa639279f18bc86d320fcfb7fcfa8485
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83f6604f4c4ca11246131304ec9a76d75e3b2db2ece8a477c4f0bf580b26a093
84032290c735b0bebec42122484159b74abec3a11258b172e88c243addfe69b8
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
86cc35989be655e6cbe68540cf835dec34388862a948fbd05850100797c32319
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
88b758789019407fc4c2461c0d188aa776cb4b72d759e3c670b73d68fabf383a
88bb8f201b753bea7a809832098ed1062a54d74d26aff22742d34b9e18f8b059
8b695f56517b6e927c365dfc1f09b6cedfafb869183074b0040399c4960a77c8
8b950c87c8fcca9e5a47bbe6143f7a2df9a783faf9a11b07559d35a7adddb504
8c3f327cab31c3d02e5bf8d08bac753e210f1f12588a1197226bccff955a0df9
8cc6048229170e6e9d2c96efba5894f085c9be4fcd96a0b6ec30287a595c4797
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
93854156369ac26c93cb9cb6d7b78cb087e4c0727c27c18086ec516212c65822
93b821d22cb2ce70cd11d8303fb7b2bd1ae0823baec282a8ae08e21550632594
9638c4b3ed25883972a0d3e5ef064f74e39fe248a07f62fdcb329abdcc9ad0bf
969d46e33813c8220b273c0404fed5658d41638f863800ed8fb2fca99d8920cd
97eec55d59ce5571f0d86b34d69bf5a48ef38e239ee2795769801ca3f4522eab
9a680b90260b5106d79f4075491ab31daafa7429eff686453c40b58357309649
9c50a96c859b9beea47b71740bd14e7f69a4df586d015f47434037f8def53b52
9db6b287d26113420992948384e1452ac263c8fbe1e0ce55d177b4fc5e05e301
a05ce29b1660d2755713106d272474ec04a2524269517b23603f325230d2d4c9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a30bbe277414c9c710df300faa5b44d99e72377cd55476ad6562ac124d678536
a6dcb2582661566fdc1517014d9eea855588c2a8409067eca719b8bb1da475dc
a7e8ed2d7bbdbcaeeee81c3433f057d64a32c000112bbd09b5969fc658d0a655
a91f331e1b5196cdf777af51a6aec591932f282918ecaf815d3ae3ffd369a58e
ab027534ceb362f1414e210763531bbe768a19c9533a117c0d0f5f41878511d4
ab21fef3ac4ee12ebb305942f85de99b290b8a24654c69060e54673d5f3a11f2
ab3f245ea1ff84ac1a4ee97d2bf88b1e56ec56f5dad70c1b73a105f2101c45a4
abee3b66f6dd218919cfb15e9be9c474bc2797a331ff3d27659bb857468efda5
ac6a17370a759dda773db77819faa8b1e8d828264ad7de8a8925b792fd5d23a7
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
af8a20e6bd6c6de708d7aeffdd3afab1a47a00f91b53618d246cdb73410f147c
b05c21426d9a2999f3f7b48d494bc6dba7b4fba240d3eae1047c99116c075232
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b289dad9bc85f77885699d2e459240f314ecefb32d6f0dd5ae13afcabb03ca74
b3fd2bd251945091f3e856b2d244d662e7980d715b6d7f1722fde67e6dd321ef
b485b0babd7fec066e4763f2cfd2beee9fa94df2358fa9b46da7f6d47281178e
b4c873f99c6d9811d0b8663a59007825e1dd511a54336f08bac1df3a80a3fe29
b64e92c54cf8815d6fff0a70489dc30b8e5dae68c639c28b79df2ce8f2af9229
bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f
bc35dc82205b91e84ff7eb9d74d8fc04412b4246d9edcbe7e8c4b43a954be541
bcf6b9b28cec8958f9d3f3ee39070e85ffd46d670f1f0baa7cd21aa24c188a00
bd36c2166c63667fa52baf241c4cfd03c962ed6d3ff7cd0def8c6b894ba28611
be59eeb43ce977328d414c543d60c07cd284788a76f617cd433e1a484bfa33ff
bfe8ebbb9a154092de88c4c438e3721fe9622818aaa98a8852bb02550cd8342f
c066d830135d79d0b9aa4500ec1ba098dc25e08f606bcd9505fa94cb420c616b
c0ded025aa80c10d37920521c8de04536a6145d0e42eb4186c57b412fa50eb45
c34294b171494a6c68a4eee25765b44496a737ca32b098a0f902e1edc5fe65e7
c3e7a9f706ecd95754432a4eec3baeb1af3d50ea4e5e3720ba65039d924cd412
c45cc031ebc4bd7cfc95286a542b4af08f05f998cd07829e888545f976b33b46
c4af296b65d25387b38e738018ce430397082b09449a7ce8da08baaa53c4c77d
c78289995801c3d4ec2f1f7b456df9fe89414c385e344b4426b32ec3fcd842ab
c95b879561e19ae45fa002f19fab5a8d1b0ca8c9f975409eb3abd829cf83031d
ca57cc407c7eefa8e3901cc501b0988fdefbea8a5c2043cf9178dacbd4c197f9
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cfa1739ee346d63a3d3cfdff8c18cbe8fdedbcb32d4b0895028c193ce828e7a5
d0f78359816f160593648991009f3b2799922d1199b82232b8b73911b221650a
d288049bf9a317db1fbbdfdde0dc4cb599d1abf49546be6a57c8d8fa1b9488b5
d2caf4e20c60ec1b01fb2b59d947b111d50d667850f9ef13af194183f0574bed
d2dcdaca89cc8422fd1d1ab405630bd6a5e6dd4adebe8723a11ed050a60461c4
d411775260d8563a58272ca5581260d0594ff8377e4820e885eac1ffcba4d858
d5ed0d3bb98ae16ad90be29db3becf6153a1390b922506a19cccf2400bbdb1c1
d7dd05bfc68901dbb2c883a7bd65698c29b3917d61f0e12d1966dca14d5056c0
db0fe819895d07af230d0f21f183ae4c9ecdec27664f004c6ac8844deaf55adc
dc83f496595b1d3b55fd6aeae76471a9d89284e1026849b5ab805bc3e8116739
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
df4c0856369aff0b375414868ea0faa0c4b18a8b0834dcef04450f06b5e22ff5
df531f4d859b68297e2b1d3d0b989147f90b31a30559d137a2e634514da7e961
dfedea6b2e0237cfc559e282854a9ec1afe30dfb45e492447b134d6be359f275
e0447c33437b68ce8263e7ce898c532cb1676e1dfc94662aea3300263e425265
e066e27304a41a9bd1eba18c512de3e7bc743488f4002fe21b97b222a822a9c4
e13c8733b82140ef6edef5f6ce96c0387419b93dd9b73fab8807a43a09d1fd73
e19a0e64789068d756a1b250084e54bb0ef77da66685e3dd9eafdc9a71ea1406
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4c4c36d32676fdcda91de06b26d7dc8d66b03e198c0391a80ac8bd8df2b3431
e53f793a5b8ac48587ffa08d392fddc565ccecc537528b94eb4c73eecad02e60
e5559d8bfd731d94f4fc8f3591a300d14018efd30f2954fc540f0712dbce1735
e89fa95988dcf7bf63bc92866b4ebd12c7ededfda65f8040105b51cb41f0414e
e9f1723d153401796dcde6f2d1fbf9a6e2181ac7e94049fc88126fbff1abd38d
eaa593bcfe485f4b5a8ac997cf9936604f9fbef91652db94a8e22b75d612bfc1
ec0654ba9eaf36ed77d4154393565cca7cd00a4e7421f9a971ad04b606f3fc73
ecfec6edd361b81190425a403385fb537c339984464c26413437ef7dc551a0a3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f498997e7a39cb345fb129f9158745de59167f8aee78cc573554bd2f5dbc92c7
f4f38c2e3b869558658a4303d42a3a0fc5f81ad2e72517be88f22da35c617b6f
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f5bda9607a2d871842fd3ff6807d30f35b336a9cebdea43f5a9820851b66c4a3
f6fa548f3755570ef254a6b934091fcd2634717a57060511fd414a704e7dc95c
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
f79a8aa00d3bd94f428463ac9c44896172d23e0f0f6d6fe4f05f1c9b593e702c
f86e08b2390d477db93fb1f6549ef75530790c121d24a531a6acb0c0b811fceb
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f8e3f110b75b3f1951f50fb7795c6eaf5bee4f07b787a1b535b39e734c7f1723
faac6b9031d79a3f00c6f066e1123f99cc6c9db4de3c7f5606c7009fdce481fa
fb192c1648b3f3f1d33c7cb0dc247f98d32e9995731598adb483fd34e25a5083
fc9e879da81f1bfe42bfefa7bd82064132ba23b00992a870eb9021d725cdbe6c
fde4dd0ab5add3a76f91f880c510718310cdf21d8fed6e65b5bd0a624a02ea69
fdf1d02d0e923da1e187476e11f688c61482e25abba482b857674fbb3d79ef45
fe9ad9796d39e706fe661ddf90151c0ebc03251164354d55f1ee95ca06878b40
ff04dd81bb93731c0d1f8e7d384b370f26b93f4352980404fcdc4518e386bedd
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869

cofense.com Open in urlscan Pro 35.188.168.180 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

256 Requests

100 %HTTPS

34 %IPv6

42 Domains

54 Subdomains

53 IPs

6 Countries

3766 kBTransfer

9660 kBSize

3 Cookies

18 Outgoing links

Redirected requests

256 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cofense.com Open in urlscan Pro
35.188.168.180 Public Scan

Screenshot
Live screenshot

Full Image

256
Requests

100 %
HTTPS

34 %
IPv6

42
Domains

54
Subdomains

53
IPs

6
Countries

3766 kB
Transfer

9660 kB
Size

3
Cookies

256 HTTP transactions
0 data transactions