www.cobaltstrike.com Open in urlscan Pro
2606:4700::6811:ecbe Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.cobaltstrike.com/help-externalc2
Submission Tags: falconsandbox
Submission: On September 11 via api (September 11th 2021, 11:50:59 pm UTC) from US — Scanned from DE

Summary HTTP 70 Redirects Links 19 Behaviour Indicators

Summary

This website contacted 14 IPs in 3 countries across 17 domains to perform 70 HTTP transactions. The main IP is 2606:4700::6811:ecbe, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.cobaltstrike.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on December 3rd 2019. Valid for: 2 years.

This is the only time www.cobaltstrike.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700::68... 2606:4700::6811:ecbe	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	13.225.25.95 13.225.25.95	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4007:81a::200a	15169 (GOOGLE) (GOOGLE)
9	99.86.89.112 99.86.89.112	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
7	2606:4700::68... 2606:4700::6812:1734	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4007:810::2008	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4007:80c::2003	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4007:811::200e	15169 (GOOGLE) (GOOGLE)
13	143.204.228.17 143.204.228.17	16509 (AMAZON-02) (AMAZON-02)
70	14

4 2606:4700::6811:ecbe (United States)

ASN13335 (CLOUDFLARENET, US)

www.cobaltstrike.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.225.25.95 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-25-95.cdg3.r.cloudfront.net

consent.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4007:81a::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 99.86.89.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-89-112.cdg50.r.cloudfront.net

static.helpsystems.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6812:1734 (United States)

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4007:810::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4007:80c::2003 (Ireland)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4007:811::200e (Ireland)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 143.204.228.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-228-17.cdg3.r.cloudfront.net

consent-pref.trustarc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	trustarc.com consent.trustarc.com consent-pref.trustarc.com consent-st.trustarc.com Failed	207 KB
9	helpsystems.com static.helpsystems.com	82 KB
8	youtube.com www.youtube.com Failed	679 KB
7	fontawesome.com kit.fontawesome.com ka-p.fontawesome.com	123 KB
4	gstatic.com fonts.gstatic.com www.gstatic.com Failed	84 KB
4	cobaltstrike.com www.cobaltstrike.com	36 KB
2	cloudflare.com cdnjs.cloudflare.com	22 KB
2	bootstrapcdn.com stackpath.bootstrapcdn.com	41 KB
1	googletagmanager.com www.googletagmanager.com	37 KB
1	jsdelivr.net cdn.jsdelivr.net	8 KB
1	jquery.com code.jquery.com	30 KB
1	googleapis.com fonts.googleapis.com	984 B
0	truste-svc.net Failed prefmgr-cookie.truste-svc.net Failed
0	ytimg.com Failed i.ytimg.com Failed
0	ggpht.com Failed yt3.ggpht.com Failed
0	google.com Failed www.google.com Failed
0	doubleclick.net Failed googleads.g.doubleclick.net Failed static.doubleclick.net Failed
70	17

	Domain	Requested by
13	consent-pref.trustarc.com	consent.trustarc.com consent-pref.trustarc.com
9	static.helpsystems.com	www.cobaltstrike.com
8	www.youtube.com	www.cobaltstrike.com cdnjs.cloudflare.com www.youtube.com
6	ka-p.fontawesome.com	kit.fontawesome.com
6	consent.trustarc.com	www.cobaltstrike.com consent.trustarc.com consent-pref.trustarc.com
4	fonts.gstatic.com	fonts.googleapis.com www.youtube.com
4	www.cobaltstrike.com	www.cobaltstrike.com
2	cdnjs.cloudflare.com	www.cobaltstrike.com
2	stackpath.bootstrapcdn.com	www.cobaltstrike.com
1	www.googletagmanager.com	www.cobaltstrike.com
1	kit.fontawesome.com	www.cobaltstrike.com
1	cdn.jsdelivr.net	www.cobaltstrike.com
1	code.jquery.com	www.cobaltstrike.com
1	fonts.googleapis.com	www.cobaltstrike.com
0	prefmgr-cookie.truste-svc.net Failed	www.cobaltstrike.com
0	www.gstatic.com Failed	www.youtube.com
0	i.ytimg.com Failed	www.youtube.com
0	yt3.ggpht.com Failed	www.youtube.com
0	www.google.com Failed	www.youtube.com
0	static.doubleclick.net Failed	www.youtube.com
0	googleads.g.doubleclick.net Failed	www.youtube.com
0	consent-st.trustarc.com Failed	consent-pref.trustarc.com
70	22

This site contains links to these domains. Also see Links.

Domain
cobalt-strike.github.io
www.helpsystems.com
opensource.org
labs.f-secure.com
github.com
www.insomniacsecurity.com
ryhanson.com
labs.mwrinfosecurity.com
www.outflank.nl
outflank.nl
www.coresecurity.com
blog.cobaltstrike.com

Subject Issuer	Validity	Valid
www.cobaltstrike.com DigiCert SHA2 Secure Server CA	`2019-12-03` - `2021-12-06`	2 years	crt.sh
*.trustarc.com Go Daddy Secure Certificate Authority - G2	`2020-05-21` - `2022-07-17`	2 years	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-03-01` - `2022-02-28`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.helpsystems.com Amazon	`2021-05-24` - `2022-06-22`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-13` - `2021-12-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh

This page contains 7 frames:

Primary Page: https://www.cobaltstrike.com/help-externalc2
Frame ID: 4F492EEEF70903BC6C05C6B7961CB5EA
Requests: 36 HTTP requests in this frame

Frame: https://www.youtube.com/embed/7FqCDWRMm4A
Frame ID: 4EE60526BBFE87790A28881B233EF4C7
Requests: 1 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=helpsystems.com
Frame ID: 249F442912E750BBFF56BF9227986365
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/7FqCDWRMm4A
Frame ID: 71CF3F4573E8116693625ECC56AE1F2F
Requests: 16 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Frame ID: ADB6B829D0FB0315B4F4E13067860541
Requests: 14 HTTP requests in this frame

Frame: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Frame ID: 8B35DE573CB22969AE30E349F07948CC
Requests: 1 HTTP requests in this frame

Frame: https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https://www.helpsystems.com/privacy-policy&cookieLink=https://www.helpsystems.com/cookie-policy&irm=undefined&from=https://consent.trustarc.com/
Frame ID: 088B8323C920614CB0EF3EA50C9A2D08
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Third-party Command and Control - Cobalt Strike

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js

TrustArc (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

consent\.trustarc\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

70
Requests

84 %
HTTPS

77 %
IPv6

17
Domains

22
Subdomains

14
IPs

3
Countries

1350 kB
Transfer

4536 kB
Size

4
Cookies

19 Outgoing links

These are links going to different origins than the main page.

URL: https://cobalt-strike.github.io/community_kit/
Title: Community Kit

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/
Title: HelpSystems

Search URL Search Domain Scan URL

URL: https://opensource.org/licenses/BSD-3-Clause
Title: 3-clause BSD license

Search URL Search Domain Scan URL

URL: https://labs.f-secure.com/tools/c3/
Title: Custom Command and Control (C3)

Search URL Search Domain Scan URL

URL: https://labs.f-secure.com/
Title: F-Secure Labs

Search URL Search Domain Scan URL

URL: https://github.com/Und3rf10w/external_c2_framework
Title: external_c2_framework

Search URL Search Domain Scan URL

URL: http://www.insomniacsecurity.com/
Title: Jonathan Echavarria

Search URL Search Domain Scan URL

URL: https://github.com/ryhanson/ExternalC2
Title: ExternalC2 Library

Search URL Search Domain Scan URL

URL: https://ryhanson.com/
Title: Ryan Hanson

Search URL Search Domain Scan URL

URL: https://labs.mwrinfosecurity.com/blog/tasking-office-365-for-cobalt-strike-c2
Title: Tasking Office 365 for Cobalt Strike C2

Search URL Search Domain Scan URL

URL: https://labs.mwrinfosecurity.com/
Title: MWR Labs

Search URL Search Domain Scan URL

URL: https://github.com/outflanknl/external_c2
Title: Shared File C2

Search URL Search Domain Scan URL

URL: https://www.outflank.nl/
Title: Outflank BV

Search URL Search Domain Scan URL

URL: https://outflank.nl/blog/2017/09/17/blogpost-cobalt-strike-over-external-c2-beacon-home-in-the-most-obscure-ways/
Title: use a file/share for command and control

Search URL Search Domain Scan URL

URL: https://www.coresecurity.com/

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/impressum
Title: Impressum

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/privacy-policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.helpsystems.com/cookie-policy
Title: Cookie Policy

Search URL Search Domain Scan URL

URL: https://blog.cobaltstrike.com/
Title: Blog

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

70 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request help-externalc2 Show response
www.cobaltstrike.com/ 15 KB
5 KB 5437ms
345ms Document
text/html 2606:4700::6811:ecbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:ecbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11fd6997d46f2149a8f81470816db7bc7f3c3c08f40102cfb824599c129cd04c

Request headers

:method: GET
:authority: www.cobaltstrike.com
:scheme: https
:path: /help-externalc2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Sat, 11 Sep 2021 23:50:44 GMT
content-type: text/html; charset=UTF-8
set-cookie: session=0619e7d3-4818-4409-a38e-d365e941ca9f;EXPIRES=Sun, 11-Sep-2022 23:50:44 GMT; PATH=/
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 68d4cccd3a674e6e-FRA
content-encoding: gzip

GET
H2 200 notice Show response
consent.trustarc.com/ 9 KB
4 KB 5134ms
47ms Script
text/javascript 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent.trustarc.com/notice?domain=helpsystems.com&c=teconsent&js=nj&text=true&gtm=1&noticeType=bb&pn=1-0&cookieLink=https://www.helpsystems.com/cookie-policy&privacypolicylink=https://www.helpsystems.com/privacy-policy

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.25.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-25-95.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

d4282b6a246b48a3ab9761b6b0f5ba0770af093af6b13ac7c05db49a13f0401c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-amz-cf-pop: CDG3-C2
x-cache: Miss from cloudfront
cloudfront-viewer-country: DE
content-length: 3612
x-xss-protection: 1; mode=block
timing-allow-origin: *
access-control-allow-origin: *
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
via: 1.1 19fefe7d41cfedb99873c7b5cd95d411.cloudfront.net (CloudFront)
cache-control: max-age=3600
cloudfront-viewer-country-region: HE
x-amz-cf-id: dHSdwUjQJXtZMROEoKekUG-UfrbgMBypyR83jF3k1uuop__t6-LCrw==
expires: Sun, 12 Sep 2021 00:50:49 GMT

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/ 156 KB
24 KB 5089ms
32ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 12248485
cdn-cachedat: 2021-04-23 06:41:52
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: d83313a11150d411250abcf7f89e1774
cf-ray: 68d4ccef188e4eb6-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 mmenu.min.css
cdnjs.cloudflare.com/ajax/libs/jQuery.mmenu/8.5.21/ 46 KB
6 KB 5085ms
27ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jQuery.mmenu/8.5.21/mmenu.min.css

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6da922d109eacd88de031d9d8617967726cfd928dc21da535ed34a141c9e847b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12249132
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 5665
cf-request-id: 099ec37daf00004aa36c300000000001
timing-allow-origin: *
last-modified: Mon, 18 Jan 2021 00:06:40 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6004d110-b9d4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AmWxeu5WGdzC3HYq%2BZHJmxBTVYJDjfaIAqeGS%2FGQao0Lr%2F66RjG80iCtnYCYeMzOk4SSPv6G%2FCc9S0%2BYyuKjR0w7HLchvx46CvwhpshZyC603KcSIO4qhGb3030uThV4KIAo0d%2BKvuWvolnJwPgO9IXV"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 68d4ccef1ec1d6dd-FRA
expires: Thu, 01 Sep 2022 23:50:49 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
984 B 5119ms
33ms Stylesheet
text/css 2a00:1450:4007:81a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,300,300italic,400italic,700,700italic

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:81a::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

334e714a1c5ebefb28783d1c809dda2a01b916554121e92067a2e41417cd10a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 11 Sep 2021 22:01:35 GMT
server: ESF
date: Sat, 11 Sep 2021 23:50:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 11 Sep 2021 23:50:49 GMT

GET
H2 200 mburger.css
static.helpsystems.com/cobalt-strike/css/ 4 KB
5 KB 5406ms
315ms Stylesheet
text/css 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.helpsystems.com/cobalt-strike/css/mburger.css
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 21359290c8d6f07cbb9994df1e280370c86d8320641a6450333639b487bd5214

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: VOCnaCxiNM_MmOajcG15HhqJJxWuSNaX
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "d4de45927370ec94a9e9317e87549638"
age: 2387
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 4532
x-amz-id-2: j19eWA4Epk2JOUvs3VF5MFcSe6bYHsE9cCqazw/LHRl0l1uH7fQ0+cCmih08d8Vyy4abgMX7pfg=
last-modified: Thu, 18 Feb 2021 20:57:54 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:11:02 GMT
x-amz-request-id: K4VX65BNSQ6D100W
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: -zTrN1aWHKGPN5s1YNw_RzSfWhoJbRnLVXwngFtZemBOV9Q8JfnkHA==

GET
H2 200 mhead.css
static.helpsystems.com/cobalt-strike/css/ 616 B
1 KB 5387ms
296ms Stylesheet
text/css 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.helpsystems.com/cobalt-strike/css/mhead.css
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9d94dd0b66034c414f3762d56b1aed1353f9d2bb31b235869c31b3efdb47f5c9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: 8n6BNmQsBHO8FG9HEworxcZdVhboyx22
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "ef0f07d66dd779d2be3ac860c17b8095"
age: 2387
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 616
x-amz-id-2: UGJrNCyTU9djnoA8BNzbf0ReKkps7ZBliat0z9t3nTyV7ygO/Ou+69e0Kx03QWnkdEFfAH1KwFk=
last-modified: Thu, 18 Feb 2021 20:57:55 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:11:02 GMT
x-amz-request-id: 4GTEX15J0X8W8MRF
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: text/css
x-amz-cf-id: R9NCGG_yQ5VvfDuyPNKvPdO1rLYzhK-v-pD4VmY-69SMNz1IyGJaRA==

GET
H2 200 styles.css
www.cobaltstrike.com/css/ 12 KB
2 KB 320ms
318ms Stylesheet
text/css 2606:4700::6811:ecbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cobaltstrike.com/css/styles.css?d=210221
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:ecbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6c65cc64b2b5f1e5aaa1a07ff9fff81fcf74c77cbe526a2ea5be3f51c79e0fca

Request headers

:path: /css/styles.css?d=210221
pragma: no-cache
cookie: session=0619e7d3-4818-4409-a38e-d365e941ca9f
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.cobaltstrike.com
referer: https://www.cobaltstrike.com/help-externalc2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/help-externalc2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
etag: W/"177c6860968"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
content-range: 0-12423/12424
cache-control: public, max-age=14400
cf-ray: 68d4cccf8d244e6e-FRA
expires: Sun, 12 Sep 2021 03:50:44 GMT

GET
H2 200 local.css
www.cobaltstrike.com/css/ 2 KB
587 B 322ms
320ms Stylesheet
text/css 2606:4700::6811:ecbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.cobaltstrike.com/css/local.css
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:ecbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8f4d9de155c93379f1b334fa00fa17335b54b294183828629822fe9c5417246e

Request headers

:path: /css/local.css
pragma: no-cache
cookie: session=0619e7d3-4818-4409-a38e-d365e941ca9f
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.cobaltstrike.com
referer: https://www.cobaltstrike.com/help-externalc2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/help-externalc2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:44 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
etag: W/"177c6629b18"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
content-range: 0-1614/1615
cache-control: public, max-age=14400
cf-ray: 68d4cccf8d274e6e-FRA
expires: Sun, 12 Sep 2021 03:50:44 GMT

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 5110ms
26ms Script
application/javascript 2001:4de0:ac18::1:a:3b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: gzip
last-modified: Mon, 04 May 2020 23:02:39 GMT
server: nginx
etag: W/"5eb09f0f-15d84"
vary: Accept-Encoding
x-hw: 1631404249.dop019.ml1.t,1631404249.cds203.ml1.hn,1631404249.cds001.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 200 popper.min.js Show response
cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/ 21 KB
8 KB 5101ms
22ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 1782198
x-jsd-version: 1.16.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 7510
etag: W/"5309-YvI45zNIx3656GVCan0bfeI8uy0"
x-served-by: cache-fra19152-FRA, cache-mxp6955-MXP
x-jsd-version-type: version
date: Sat, 11 Sep 2021 23:50:49 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/ 59 KB
17 KB 5077ms
21ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 601, 617, 617
age: 12248484
cdn-cachedat: 2021-04-23 07:14:53
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:09 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: d64c8cc52df4831b5b56c024fcc7c600
cf-ray: 68d4ccef188f4eb6-FRA
cdn-requestcountrycode: DE
cdn-requestpullsuccess: True

GET
H2 200 mmenu.js Show response
cdnjs.cloudflare.com/ajax/libs/jQuery.mmenu/8.5.21/ 69 KB
16 KB 5087ms
30ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jQuery.mmenu/8.5.21/mmenu.js

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0916b04a6bd6a9c5a9c9721e8749a0d952b39ba9303399faeacba8a65dd9a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 10007705
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 15629
cf-request-id: 0a245cf1c00000c26db93f5000000001
timing-allow-origin: *
last-modified: Mon, 18 Jan 2021 00:06:21 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "6004d0fd-1122b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AhSURbsTE84KcZ3Y8C9t2ph8czEwTmGKgrdN5loGSVgOO2N%2BfLQFfxxUTySOu33uqdPy1ZAvegKSa83yVS99p4ZB%2FjaB4m%2Fdh8MGZMYFQQNZXLEFKfri3Dabos8%2Bzs7rK0c%2FL%2FkE7IGa9p%2FCepMtSPVw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 68d4ccef1ec4d6dd-FRA
expires: Thu, 01 Sep 2022 23:50:49 GMT

GET
H2 200 e80d7cd121.js Show response
kit.fontawesome.com/ 11 KB
4 KB 5100ms
38ms Script
text/javascript 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/e80d7cd121.js

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6ca0060dc22528a6de6381a194c25e69190a8bd113178dbeaf86a81697b7d314

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 68d4ccef2bbd42db-FRA
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: Fn4aWz9ewD3GX9DlJNyB

GET mburger.js
static.helpsystems.com/cobalt-strike/js/ 0
0

GET
H2 200 mhead.js Show response
static.helpsystems.com/cobalt-strike/js/ 2 KB
3 KB 5383ms
294ms Script
application/javascript 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.helpsystems.com/cobalt-strike/js/mhead.js
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a48ceb4ae058162d65945e2408db936ce617a5b8b18f65d58c2ae7f9657b53a1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: H3yTfLqYl4pdVwvA02dxA72Z6XD7Y1EU
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "d2cca6d027131de12ea6844d4ed23674"
age: 2387
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 2415
x-amz-id-2: sV4RlXpi7UvSijK2vuPNbkAogQxv6m64xYagbTclkSj2piI0ALow0gagQjm+tfcX9hpbbqmNn/U=
last-modified: Thu, 18 Feb 2021 21:08:33 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:11:02 GMT
x-amz-request-id: XXZ3TCV1RHZNVMXZ
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: -ay7Y4Blk5r6i5BUQR0gNSvv_7Wsar3LAfLiSFfKesPbbcGk6kYHYw==

GET
H2 200 scripts.js Show response
static.helpsystems.com/cobalt-strike/js/ 783 B
1 KB 5387ms
299ms Script
application/javascript 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.helpsystems.com/cobalt-strike/js/scripts.js
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9ce02fe239d1a5d16f9efbb8542929ea0d23c74cc732f8e9cf0729f7891b51e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: xFXImJyX.PvGJbgmAx9G4aCW6KhS5BV5
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "a54c87d286e8347a8d5ae004959c3f7d"
age: 2388
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 783
x-amz-id-2: 8+NNSo66d+28EBddZ66TDGJG9TrSnfJIdE8kyhXObh6iWayCtLlhCGO/ZD+DFlz4lrKGBdsA1jI=
last-modified: Thu, 18 Feb 2021 21:08:34 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:11:02 GMT
x-amz-request-id: 4GTAR6QKPHMZENYG
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: xDZUgcSB34iYqIjzXM8tCbslci0m19Y-6R6ekG9aOmkYjWYW21YYqg==

GET
H2 200 cobaltstrike-logo-header.png
static.helpsystems.com/cobalt-strike/img/ 6 KB
7 KB 56ms
56ms Image
image/png 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.helpsystems.com/cobalt-strike/img/cobaltstrike-logo-header.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b6b7ce30cf22058a97e7de157a28b503501245c425b9e7b8aa9cd743358101c3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: Oeqk7ibCP.UzrSLk1eKreytc..OmCXTY
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "34cba286ba3ca486fdedb782bc405228"
age: 2102
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 6429
x-amz-id-2: faC8AshYnb9ZnlZuesJNpxUPCBUTjP7AwxrBxSeUO3kMKZJCmpzcmKFSe/X7wuqEpFmCloQ10hs=
last-modified: Thu, 18 Feb 2021 20:48:48 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:15:48 GMT
x-amz-request-id: 5J9DKB0HCW7CH5DX
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 7NCLHBBcdFZfsYnSEp8UtrJRfjD9Ia9-973pJMoBdo51gPwUOOTZ2w==

GET
H2 200 helpsystems-icon-blue-grey.png
static.helpsystems.com/cobalt-strike/img/ 690 B
1 KB 64ms
63ms Image
image/png 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.helpsystems.com/cobalt-strike/img/helpsystems-icon-blue-grey.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 11f4dfa542875c036cf07a3925dc7224e6ede5b62a14de4dc42db8da39abb05e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: 2rtacfV9IlekahQWtrxZNr0LI6qHvvci
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "512c3f848533c4795c1b43921aac3c33"
age: 2101
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 690
x-amz-id-2: UwMZHsYpDwbUhGwnISddCf8/QSsoWC7pJMd/c45WQPW+ytlG+SAisuy1x5AAvw4cyMK+65p0XQQ=
last-modified: Thu, 18 Feb 2021 20:48:55 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:15:48 GMT
x-amz-request-id: 19B09QN0X4SDQFNH
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: 9bCOxXtXsZtn7w76As8tYbeic_i39RKhUPXxqc2_wNJq8pz5QLK_rg==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 93 KB
37 KB 5148ms
51ms Script
application/javascript 2a00:1450:4007:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NN4FLFJ

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:810::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

894e9d68ff5f47d5d53d74f82920cbb32a90cd7545205d2b5905f242a66f8094

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37537
x-xss-protection: 0
last-modified: Sat, 11 Sep 2021 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 11 Sep 2021 23:50:54 GMT

GET
H2 200 40externalc2.png
www.cobaltstrike.com/images/ 28 KB
28 KB 416ms
416ms Image
image/png 2606:4700::6811:ecbe
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.cobaltstrike.com/images/40externalc2.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:ecbe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f704460674d59ffe0434f7383fc5698219bd6cb5bd67a16d60c05c15a5d7e70

Request headers

:path: /images/40externalc2.png
pragma: no-cache
cookie: session=0619e7d3-4818-4409-a38e-d365e941ca9f; notice_behavior=expressed,eu
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.cobaltstrike.com
referer: https://www.cobaltstrike.com/help-externalc2
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/help-externalc2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:50 GMT
cf-cache-status: MISS
server: cloudflare
etag: "177608e0480"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
content-range: 0-28260/28261
cache-control: public, max-age=86400
accept-ranges: bytes
cf-ray: 68d4ccf16e9e4e6e-FRA
content-length: 28261
expires: Sun, 12 Sep 2021 23:50:50 GMT

GET
H2 200 coresecurity.png
static.helpsystems.com/cobalt-strike/img/ 3 KB
4 KB 63ms
62ms Image
image/png 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.helpsystems.com/cobalt-strike/img/coresecurity.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 020b0eb6827b23f077b5fe97861cb8f35536d948352a475ce1e407cb00d83c95

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: P9aVBg.Enx4GzMAbWCUxv1M1Y5bHoTlA
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "27c69a4214efaccaa4fcd4669b872a32"
age: 2101
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3531
x-amz-id-2: B1RPjSHAc7g0N3cwUgHjb3juitO8rw3WNz/KjOYpMh35GQbmf1oE2ppTaLxgchMyvIj1ZnNTQDo=
last-modified: Thu, 18 Feb 2021 20:48:51 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:15:48 GMT
x-amz-request-id: 19B2XMWBZGB6Y63R
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: FcYsI_1vEVYybR_vfn3GpX9y_Cx2SRmEg2op0FnPSh2Oj-eYoCXFyQ==

GET
H2 200 cobaltstrike.png
static.helpsystems.com/cobalt-strike/img/ 4 KB
4 KB 61ms
61ms Image
image/png 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.helpsystems.com/cobalt-strike/img/cobaltstrike.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 44e960ff99f096e17f544b2abfa3fa07cd5b877750ec230fd367bd875bc72d26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: tMaNF2MqjXEdWxuZtTE1YtP3IvDl1mEL
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
etag: "0101386a899421ad37fc4e1209f26adf"
age: 2102
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 3630
x-amz-id-2: wPggwd52Xn98zEd3i8ryWAZXNdP3KD7PsBGvGUwZa3LzMkFwHhII84ggYSDy4B8oXzTAmHDiIlU=
last-modified: Thu, 18 Feb 2021 20:48:47 GMT
server: AmazonS3
date: Sat, 11 Sep 2021 23:15:48 GMT
x-amz-request-id: 5YV048QT7X2GGGBQ
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-type: image/png
x-amz-cf-id: zx3fXsQQ5HtYLeLOtOyB6-zbmRkrLLJ5ZaALuXzy1nmXd4EWjQJbbA==

GET
H2 200 v1.7-1747 Show response
consent.trustarc.com/asset/notice.js/v/ 72 KB
23 KB 32ms
32ms Script
text/javascript 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-1747
Requested by: Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=helpsystems.com&c=teconsent&js=nj&text=true&gtm=1&noticeType=bb&pn=1-0&cookieLink=https://www.helpsystems.com/cookie-policy&privacypolicylink=https://www.helpsystems.com/privacy-policy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.25.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-25-95.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: c4357236faa88551ac127de4b3fd1deab8c9463cfe3b127bc8836d3b55863469

Request headers

Referer: https://www.cobaltstrike.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 22:50:54 GMT
content-encoding: gzip
age: 3595
x-cache: Hit from cloudfront
pragma: public
access-control-allow-origin: *
last-modified: Tue, 31 Aug 2021 03:46:15 GMT
server: nginx
vary: Accept-Encoding
content-type: text/javascript
via: 1.1 19fefe7d41cfedb99873c7b5cd95d411.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: CDG3-C2
timing-allow-origin: *
x-amz-cf-id: xi1E0WfDxrtNrUnpHCo4Oo8HgICdRmygwj2Gd0OG6yQUSW5Q9XKaAw==
expires: Mon, 11 Oct 2021 22:50:54 GMT

GET
H2 200 log
consent.trustarc.com/ 43 B
382 B 105ms
48ms Image
image/gif 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://consent.trustarc.com/log?domain=helpsystems.com&country=de&state=&behavior=expressed&c=f2de
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.25.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-25-95.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 11 Sep 2021 23:50:49 GMT
via: 1.1 3e49d1b7d94458397e7bc6421c922a19.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: CDG3-C2
x-cache: Miss from cloudfront
content-type: image/gif
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length: 43
x-amz-cf-id: Rk5L0bZVxwSCKGWASsRmIMy1vCqvXmKiZgsUn0KcV7SMo1atEgiPeQ==
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 312 KB
53 KB 5083ms
51ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f734d8ecda48e6d98faab2e1e9b91d6c5f72b86408ea6e2126d4b1681b92ef4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:58 GMT
server: cloudflare
age: 12248487
etag: "6051683e-d23c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9ff42db-FRA
content-length: 53820

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 26 KB
4 KB 5082ms
50ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro-v4-shims.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce885aa8b86fb7d85992aae4435fb45b444f8d3919dca083c83a36d7600f96d7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:57 GMT
server: cloudflare
age: 12248487
etag: "6051683d-106a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9fd42db-FRA
content-length: 4202

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 27 KB
3 KB 5089ms
56ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro-v4-font-face.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22e2037b36515615d60ab5bb486646219d9a2509df36f31a11c9b94ec6f4bd5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:57 GMT
server: cloudflare
age: 12248487
etag: "6051683d-a08"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9f942db-FRA
content-length: 2568

GET 7FqCDWRMm4A
www.youtube.com/embed/ Frame 4EE6 0
0

GET
H2 200 footer.png
static.helpsystems.com/cobalt-strike/img/ 56 KB
56 KB 363ms
362ms Image
image/png 99.86.89.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.helpsystems.com/cobalt-strike/img/footer.png
Requested by: Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/css/styles.css?d=210221
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.89.112 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-89-112.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 55d9a441e501caed3edae915c8e322e1a5e04f7ec89861c4bda11657f2dd92b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: DItkxiM9Z2qDhEK3TbKAne9kp58fu2NX
via: 1.1 14d7b62a2939d8cc7dc4d65d3de7b693.cloudfront.net (CloudFront)
last-modified: Thu, 18 Feb 2021 20:48:54 GMT
server: AmazonS3
x-amz-request-id: 19BDWGSR6C958AKE
etag: "fe38e7300ce0f10acce934ff315ee01d"
x-cache: RefreshHit from cloudfront
content-type: image/png
date: Sat, 11 Sep 2021 23:50:51 GMT
x-amz-cf-pop: CDG50-C1
accept-ranges: bytes
content-length: 56911
x-amz-id-2: 6CFKsU7f/2srgLwCDWZooIrV4obiVrRUpujKbl6WqGOdOyE68/u9FzdiUArQOo45cuSpKapfH8g=
x-amz-cf-id: qOPUrJGZGlI3krISFJg572I9lvHomdB1pi-hfajKETtxE2wCog0kpw==

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v20/ 23 KB
23 KB 5119ms
28ms Font
font/woff2 2a00:1450:4007:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300,300italic,400italic,700,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 00:46:51 GMT
x-content-type-options: nosniff
age: 428643
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23484
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:19:01 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 00:46:51 GMT

GET
H2 200 S6u9w4BMUTPHh7USSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 23 KB
23 KB 5148ms
56ms Font
font/woff2 2a00:1450:4007:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh7USSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300,300italic,400italic,700,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 07 Sep 2021 03:28:18 GMT
x-content-type-options: nosniff
age: 418956
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23248
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:18:53 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 07 Sep 2022 03:28:18 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v20/ 22 KB
23 KB 5136ms
45ms Font
font/woff2 2a00:1450:4007:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,300,300italic,400italic,700,700italic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.cobaltstrike.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 18:52:00 GMT
x-content-type-options: nosniff
age: 104334
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22992
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:18:57 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Sep 2022 18:52:00 GMT

GET
H2 200 pro.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 312 KB
53 KB 5020ms
26ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f734d8ecda48e6d98faab2e1e9b91d6c5f72b86408ea6e2126d4b1681b92ef4c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:58 GMT
server: cloudflare
age: 12248487
etag: "6051683e-d23c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9fb42db-FRA
content-length: 53820

GET
H2 200 pro-v4-shims.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 26 KB
4 KB 5049ms
56ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro-v4-shims.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce885aa8b86fb7d85992aae4435fb45b444f8d3919dca083c83a36d7600f96d7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:57 GMT
server: cloudflare
age: 12248487
etag: "6051683d-106a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9fc42db-FRA
content-length: 4202

GET
H2 200 pro-v4-font-face.min.css Show response
ka-p.fontawesome.com/releases/v5.15.3/css/ 27 KB
3 KB 5054ms
61ms Fetch
text/css 2606:4700::6812:1734
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v5.15.3/css/pro-v4-font-face.min.css?token=e80d7cd121
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/e80d7cd121.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22e2037b36515615d60ab5bb486646219d9a2509df36f31a11c9b94ec6f4bd5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:54 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 17 Mar 2021 02:23:57 GMT
server: cloudflare
age: 12248487
etag: "6051683d-a08"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 68d4cd10d9fe42db-FRA
content-length: 2568

GET
H2 200 get Show response
consent.trustarc.com/ Frame 249F 2 KB
1 KB 43ms
27ms Document
text/html 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent.trustarc.com/get?name=crossdomain.html&domain=helpsystems.com
Requested by: Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=helpsystems.com&c=teconsent&js=nj&text=true&gtm=1&noticeType=bb&pn=1-0&cookieLink=https://www.helpsystems.com/cookie-policy&privacypolicylink=https://www.helpsystems.com/privacy-policy
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.25.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-25-95.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: bd478d1e075f071ca0f0e7f3e27e4c22d27831b23df86dd6d0f7a37c38263b0e

Request headers

:method: GET
:authority: consent.trustarc.com
:scheme: https
:path: /get?name=crossdomain.html&domain=helpsystems.com
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.cobaltstrike.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/

Response headers

content-type: text/html;charset=UTF-8
date: Sat, 11 Sep 2021 23:04:01 GMT
server: nginx
access-control-allow-origin: *
pragma: public
expires: Mon, 11 Oct 2021 23:04:01 GMT
cache-control: max-age=2592000
timing-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 3e49d1b7d94458397e7bc6421c922a19.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG3-C2
x-amz-cf-id: oFqWeuLg0mqsOXbZVkhgxYH3nXYX3FjyT14zY25FdbrFbjPu89Lm7A==
age: 2808

GET
H2 200 7FqCDWRMm4A Show response
www.youtube.com/embed/ Frame 71CF 55 KB
24 KB 5144ms
96ms Document
text/html 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/7FqCDWRMm4A

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jQuery.mmenu/8.5.21/mmenu.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fce6ae953c03cc3792f2c791e1be27ab4b4eeddb1923e49c138874dc107a6a25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/7FqCDWRMm4A
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.cobaltstrike.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sat, 11 Sep 2021 23:50:54 GMT
strict-transport-security: max-age=31536000
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: YSC=x87FQLIkdXM; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none VISITOR_INFO1_LIVE=bAIfLGMHkAw; Domain=.youtube.com; Expires=Thu, 10-Mar-2022 23:50:54 GMT; Path=/; Secure; HttpOnly; SameSite=none CONSENT=PENDING+025; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 / Show response
consent-pref.trustarc.com/ Frame ADB6 5 KB
2 KB 5124ms
37ms Document
text/html 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/

Requested by

Host: consent.trustarc.com
URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-1747

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

5d59d71fa30604e26c815b2bcfea777bef1564467e2ff9b1b4dc45ca2ee0f6fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: consent-pref.trustarc.com
:scheme: https
:path: /?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.cobaltstrike.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/

Response headers

content-type: text/html; charset=UTF-8
date: Sat, 11 Sep 2021 21:18:14 GMT
server: nginx
etag: W/"5147-1629347982000"
last-modified: Thu, 19 Aug 2021 04:39:42 GMT
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG3-C1
x-amz-cf-id: n_IDgJy84641nUCiMv1rovU6WJYJyaUHwX1HSYh9CgrpjJ2z4YBedA==
age: 9161

GET
H2 200 noticemsg
consent.trustarc.com/ 43 B
503 B 48ms
47ms Image
image/gif 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent.trustarc.com/noticemsg?action=consent&domain=helpsystems.com&behavior=expressed&country=de&language=de&rand=0.6991994345965424

Requested by

Host: www.cobaltstrike.com
URL: https://www.cobaltstrike.com/help-externalc2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.225.25.95 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-25-95.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.cobaltstrike.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:49 GMT
via: 1.1 3e49d1b7d94458397e7bc6421c922a19.cloudfront.net (CloudFront)
x-content-type-options: nosniff
timing-allow-origin: *
x-amz-cf-pop: CDG3-C2
x-cache: Miss from cloudfront
cloudfront-viewer-country: DE
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
server: nginx
x-frame-options: SAMEORIGIN
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
cloudfront-viewer-country-region: HE
x-amz-cf-id: 27YcLr0IRNmo9UlaQg2t13WsvcnyhJP2vyg-3Hqku3bQzw4wjMQnBw==
expires: Sun, 12 Sep 2021 00:50:49 GMT

GET
H2 200 www-player-webp.css
www.youtube.com/s/player/1cc7c82c/ Frame 71CF 329 KB
45 KB 31ms
30ms Stylesheet
text/css 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46717c032f82e2316c694c6cb20d63d109954cc77e1aeee251dd5b1591915716

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 16:09:00 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
age: 200515
vary: Accept-Encoding, Origin
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46331
x-xss-protection: 0
expires: Fri, 09 Sep 2022 16:09:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 71CF 15 KB
15 KB 27ms
27ms Font
font/woff2 2a00:1450:4007:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:80c::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 19:14:20 GMT
x-content-type-options: nosniff
age: 102995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Sep 2022 19:14:20 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/1cc7c82c/www-embed-player.vflset/ Frame 71CF 201 KB
66 KB 39ms
38ms Script
text/javascript 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

73489d9071ef40a1fdce399ee4faee08addd584314f4eb9a82d2f65d2af541a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 16:09:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
age: 200504
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67231
x-xss-protection: 0
expires: Fri, 09 Sep 2022 16:09:11 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/ Frame 71CF 2 MB
504 KB 56ms
56ms Script
text/javascript 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55b39bdfbc1845ff7f8dec7f508ceaced7115c594b4454fcbd17d5ff4cfd32bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 16:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 200227
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/youtube
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 515566
x-xss-protection: 0
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 09 Sep 2022 16:13:48 GMT

GET
H2 200 fetch-polyfill.js Show response
www.youtube.com/s/player/1cc7c82c/fetch-polyfill.vflset/ Frame 71CF 8 KB
3 KB 55ms
55ms Script
text/javascript 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 16:09:11 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
age: 200504
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
expires: Fri, 09 Sep 2022 16:09:11 GMT

GET
H2 200 defaultpreferencemanager.nocache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame ADB6 5 KB
2 KB 48ms
48ms Script
application/javascript 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 6f74888de1f7e175e7a8d9f4a482f1eb678d3a1f960113ba27d1a259264256cf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
content-encoding: gzip
last-modified: Thu, 19 Aug 2021 04:40:00 GMT
server: nginx
x-amz-cf-pop: CDG3-C1
etag: W/"4867-1629348000000"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: SShTfxe1cfqTofKRwXxpBFZ77wuHueLbLjSI9xfmHJm6b_xE-BYb0w==
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
expires: Sat, 11 Sep 2021 23:50:54 GMT

GET get
consent-st.trustarc.com/ Frame ADB6 0
0

GET
H2 200 loading.gif
consent-pref.trustarc.com/images/ Frame ADB6 3 KB
3 KB 26ms
26ms Image
image/gif 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/loading.gif

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 18:50:47 GMT
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Thu, 19 Aug 2021 04:39:42 GMT
server: nginx
age: 18008
etag: W/"2608-1629347982000"
x-cache: Hit from cloudfront
content-type: image/gif
access-control-allow-origin: *
x-amz-cf-pop: CDG3-C1
accept-ranges: bytes
content-length: 2608
x-xss-protection: 1; mode=block
x-amz-cf-id: 1LRI-6aeB72uEDPki17BM5ps5OnNZwBJRpHprQl2tBAzXrqxT5It7A==

GET
H2 200 3D1DCD2BF0C50EAF0926E06B9412811A.cache.html Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame 8B35 140 KB
46 KB 31ms
31ms Document
text/html 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/defaultpreferencemanager.nocache.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 8e0276bb55f38a0946337c6d5ce1f88e1cd3bb8cc9560a35e5b061bb27fb1f16

Request headers

:method: GET
:authority: consent-pref.trustarc.com
:scheme: https
:path: /defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 31 Aug 2021 04:12:51 GMT
server: nginx
etag: W/"143087-1629348000000"
last-modified: Thu, 19 Aug 2021 04:40:00 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG3-C1
x-amz-cf-id: jie4mvhjb5zt-DpRBVeC44467VWjWxbJ9fLE7h5nnsvzQVX87pCS1w==
age: 1021084

GET id
googleads.g.doubleclick.net/pagead/ Frame 71CF 0
0

GET ad_status.js
static.doubleclick.net/instream/ Frame 71CF 0
0

GET
H2 200 remote.js Show response
www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/ Frame 71CF 95 KB
29 KB 30ms
30ms Script
text/javascript 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

526ecaf8fbd157b776733e40cd4e3af19fb4185e081f72d27284026138cc30e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 17:07:35 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
age: 197000
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29899
x-xss-protection: 0
expires: Fri, 09 Sep 2022 17:07:35 GMT

GET TUGxdKGgSBnbvYhbgWJGNExZIxwNTenabxxqeDU0yyc.js
www.google.com/js/th/ Frame 71CF 0
0

GET
H2 200 embed.js Show response
www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/ Frame 71CF 24 KB
7 KB 30ms
30ms Script
text/javascript 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1cc7c82c/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21bf415bff7452c3ca9d2fd6b7afa9156844757a7802193acfb5a6c0d2621a81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 09 Sep 2021 16:13:49 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 09 Sep 2021 00:22:16 GMT
server: sffe
age: 200226
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7358
x-xss-protection: 0
expires: Fri, 09 Sep 2022 16:13:49 GMT

GET
DATA 200
OK truncated
/ Frame 71CF 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/png

GET AKedOLTSzF0KUyyS3qkdx4HSKSJPuTGY3oMYq1xwhNdM=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame 71CF 0
0

GET sddefault.webp
i.ytimg.com/vi_webp/7FqCDWRMm4A/ Frame 71CF 0
0

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame ADB6 969 B
824 B 45ms
45ms XHR
application/json 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

d4bef2d91bd01eaeba3c9d62545eb98cec13e41bfacdbf28cf1c17bc7f1a35e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: 3D1DCD2BF0C50EAF0926E06B9412811A
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: CDG3-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
content-disposition: attachment
access-control-allow-origin: *
content-length: 465
x-xss-protection: 1; mode=block
x-amz-cf-id: uyBobW_g-qnQ1C_S4Lj5TF-CwcL48YDp32s1igU30TpIMwTXC0pFyA==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame ADB6 48 B
389 B 46ms
46ms XHR
application/json 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

925a7c247b707be85e803f6f366dd4dce3f13a0b96f93ba6ba0030a23493ec23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: 3D1DCD2BF0C50EAF0926E06B9412811A
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: CDG3-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
access-control-allow-origin: *
content-disposition: attachment
content-length: 48
x-xss-protection: 1; mode=block
x-amz-cf-id: OCOIycyNQdG7o7Vt1mFPnCRw6DG3OIFL4lKWubz_tFpyXaXcm0-zow==

GET cast_sender.js
www.gstatic.com/cv/js/sender/v1/ Frame 71CF 0
0

GET
H2 200 EuPreferenceManager.css
consent-pref.trustarc.com/ Frame ADB6 27 KB
7 KB 64ms
64ms Stylesheet
text/css 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/EuPreferenceManager.css
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 1ea22ef5cc12712e650ac15269e8e7b75904f47246ce6eb04bf0fcd42f8bed77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
content-encoding: gzip
last-modified: Thu, 19 Aug 2021 04:39:42 GMT
server: nginx
x-amz-cf-pop: CDG3-C1
etag: W/"27745-1629347982000"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/css
access-control-allow-origin: *
cache-control: no-cache
x-amz-cf-id: rx7FYIR7623yoeN4A7qXbJ8Uju1cjML0ANJMgdBICJxyyKWhF6HD5w==
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
expires: Sat, 11 Sep 2021 23:50:54 GMT

GET
H2 200 10.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/ Frame ADB6 243 KB
84 KB 28ms
28ms XHR
application/javascript 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/10.cache.js
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 49b1107c4782c8cd60dce7dadd701116777a8097936dc6fa3e1b526a5f7bf4b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 31 Aug 2021 04:13:13 GMT
content-encoding: gzip
last-modified: Thu, 19 Aug 2021 04:40:00 GMT
server: nginx
age: 1021062
etag: W/"248817-1629348000000"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=315360000
x-amz-cf-pop: CDG3-C1
x-amz-cf-id: MwdFLmd539fiG71JlsPp6SY8Tdt3a81WJWiMjZaPD2eDC6nu9wUnrw==
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/ Frame ADB6 19 KB
8 KB 27ms
27ms XHR
application/javascript 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/1.cache.js
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: d86306cfb344762984b47aff717491662e6c9de66d26b7513fd99b6e450a6384

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 31 Aug 2021 04:14:04 GMT
content-encoding: gzip
last-modified: Thu, 19 Aug 2021 04:40:00 GMT
server: nginx
age: 1021011
etag: W/"19432-1629348000000"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=315360000
x-amz-cf-pop: CDG3-C1
x-amz-cf-id: RvXSzUQTRRUuMWgAm5yo5uH4ipnjdWkH1RZdPd98o4d3BVAfm0qsWQ==
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET cookie_iframe.html
prefmgr-cookie.truste-svc.net/cookie_js/ Frame 088B 0
0

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame ADB6 718 B
658 B 45ms
45ms XHR
application/json 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

94899d8c0b4377abe765a34012c015437200f684f96360ea798ed6a8b48e9c8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: 3D1DCD2BF0C50EAF0926E06B9412811A
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: CDG3-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
content-disposition: attachment
access-control-allow-origin: *
content-length: 300
x-xss-protection: 1; mode=block
x-amz-cf-id: ea_7PTdCZ_dZ5xTJ2o7h2kJEk3eSAxn1c8LVHzp0wdUj22bZJAF5sg==

POST
H2 200 truste Show response
consent-pref.trustarc.com/defaultpreferencemanager/ Frame ADB6 24 KB
7 KB 46ms
46ms XHR
application/json 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://consent-pref.trustarc.com/defaultpreferencemanager/truste

Requested by

Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

81ddd86005934f8391dbe682a44f228b7a5df552d61719e5c5cfca1a27c4b3f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

X-GWT-Module-Base: https://consent-pref.trustarc.com/defaultpreferencemanager/
X-GWT-Permutation: 3D1DCD2BF0C50EAF0926E06B9412811A
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/x-gwt-rpc; charset=UTF-8

Response headers

date: Sat, 11 Sep 2021 23:50:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
x-amz-cf-pop: CDG3-C1
x-cache: Miss from cloudfront
content-type: application/json;charset=utf-8
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
content-disposition: attachment
access-control-allow-origin: *
content-length: 6478
x-xss-protection: 1; mode=block
x-amz-cf-id: obTjztLbDNEW_c4j9JST_aTh2s9ArnohrvTwc9vHXdIBV4TzAvvtxQ==

GET
H2 200 trustarc-logo-small.png
consent-pref.trustarc.com/images/ Frame ADB6 4 KB
4 KB 27ms
27ms Image
image/png 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://consent-pref.trustarc.com/images/trustarc-logo-small.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.228.17 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-228-17.cdg3.r.cloudfront.net

Software

nginx /

Resource Hash

91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 15:23:34 GMT
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Thu, 19 Aug 2021 04:39:42 GMT
server: nginx
age: 30441
etag: W/"4197-1629347982000"
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
x-amz-cf-pop: CDG3-C1
accept-ranges: bytes
content-length: 4197
x-xss-protection: 1; mode=block
x-amz-cf-id: ghhpn_2_A_A-pNCVXDTlPYG2A70NtoXAJlhDRFGY4-0boNItKklPBw==

GET
H2 200 6.cache.js Show response
consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/ Frame ADB6 7 KB
3 KB 27ms
27ms XHR
application/javascript 143.204.228.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://consent-pref.trustarc.com/defaultpreferencemanager/deferredjs/3D1DCD2BF0C50EAF0926E06B9412811A/6.cache.js
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/defaultpreferencemanager/3D1DCD2BF0C50EAF0926E06B9412811A.cache.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.228.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-228-17.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 8173c9c7e6621a53dcfc67d287a719a4bde1fc826f77adf7f0d1e0b6f4126833

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 31 Aug 2021 04:13:30 GMT
content-encoding: gzip
last-modified: Thu, 19 Aug 2021 04:40:00 GMT
server: nginx
age: 1021046
etag: W/"6773-1629348000000"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=315360000
x-amz-cf-pop: CDG3-C1
x-amz-cf-id: wxx4EfuAuP_vkSWvkTbkZWgxCCR1meTJ1X338EScf6Zbf-EqQvDxtg==
via: 1.1 c7f3a97b2152b620b7783adf69f93909.cloudfront.net (CloudFront)
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 get
consent.trustarc.com/ Frame ADB6 9 KB
9 KB 49ms
49ms Image
image/svg+xml 13.225.25.95
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://consent.trustarc.com/get?name=hslogo.svg
Requested by: Host: consent-pref.trustarc.com
URL: https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https%3A%2F%2Fwww.helpsystems.com%2Fprivacy-policy&cookieLink=https%3A%2F%2Fwww.helpsystems.com%2Fcookie-policy&irm=undefined&from=https://consent.trustarc.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.25.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-25-95.cdg3.r.cloudfront.net
Software: nginx /
Resource Hash: 81837bb647b79c1e159b440fd593ab3f081fda2e018ca5b7b3a537b28fc3bd3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://consent-pref.trustarc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: public
date: Sat, 11 Sep 2021 23:50:56 GMT
via: 1.1 3e49d1b7d94458397e7bc6421c922a19.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: CDG3-C2
x-cache: Miss from cloudfront
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
content-length: 9071
x-amz-cf-id: 8qnM2z6nwxRn8SRkuON20CAdYebfcyUTW3EUyCbaZT8qhnzALfXQQg==
expires: Mon, 11 Oct 2021 23:50:56 GMT

POST
H2 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame 71CF 28 B
342 B 47ms
47ms XHR
application/json 2a00:1450:4007:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/1cc7c82c/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4007:811::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/7FqCDWRMm4A
X-YouTube-Client-Version: 1.20210908.1.0
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtiQUlmTEdNSGtBdyjegfWJBg%3D%3D
X-YouTube-Ad-Signals: dt=1631404255098&flash=0&frm=2&u_tz&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C560%2C315&vis=1&wgl=true&ca_type=image

Response headers

date: Sat, 11 Sep 2021 23:50:57 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Sat, 11 Sep 2021 23:50:57 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.helpsystems.com
URL: https://static.helpsystems.com/cobalt-strike/js/mburger.js

Domain: www.youtube.com
URL: https://www.youtube.com/embed/7FqCDWRMm4A

Domain: consent-st.trustarc.com
URL: https://consent-st.trustarc.com/get?name=combined_static_cm_minified.js

Domain: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/id

Domain: static.doubleclick.net
URL: https://static.doubleclick.net/instream/ad_status.js

Domain: www.google.com
URL: https://www.google.com/js/th/TUGxdKGgSBnbvYhbgWJGNExZIxwNTenabxxqeDU0yyc.js

Domain: yt3.ggpht.com
URL: https://yt3.ggpht.com/ytc/AKedOLTSzF0KUyyS3qkdx4HSKSJPuTGY3oMYq1xwhNdM=s68-c-k-c0x00ffffff-no-rj

Domain: i.ytimg.com
URL: https://i.ytimg.com/vi_webp/7FqCDWRMm4A/sddefault.webp

Domain: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Domain: prefmgr-cookie.truste-svc.net
URL: https://prefmgr-cookie.truste-svc.net/cookie_js/cookie_iframe.html?parent=https://consent-pref.trustarc.com/?type=helpsystemstest&site=helpsystems.com&action=notice&country=de&locale=de&behavior=expressed&gtm=1&layout=default_eu&privacypolicylink=https://www.helpsystems.com/privacy-policy&cookieLink=https://www.helpsystems.com/cookie-policy&irm=undefined&from=https://consent.trustarc.com/

Verdicts & Comments Add Verdict or Comment

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.cobaltstrike.com/	1970-01-20 05:55:40	Name: session Value: 0619e7d3-4818-4409-a38e-d365e941ca9f
.cobaltstrike.com/	1969-12-31 23:59:59	Name: notice_behavior Value: expressed,eu
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: x87FQLIkdXM
.youtube.com/	1970-01-20 01:29:16	Name: VISITOR_INFO1_LIVE Value: bAIfLGMHkAw

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.cobaltstrike.com/help-externalc2 Message: Access to script at 'https://static.helpsystems.com/cobalt-strike/js/mburger.js' from origin 'https://www.cobaltstrike.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://static.helpsystems.com/cobalt-strike/js/mburger.js Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
consent-pref.trustarc.com
consent-st.trustarc.com
consent.trustarc.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
ka-p.fontawesome.com
kit.fontawesome.com
prefmgr-cookie.truste-svc.net
stackpath.bootstrapcdn.com
static.doubleclick.net
static.helpsystems.com
www.cobaltstrike.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
consent-st.trustarc.com
googleads.g.doubleclick.net
i.ytimg.com
prefmgr-cookie.truste-svc.net
static.doubleclick.net
static.helpsystems.com
www.google.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
13.225.25.95
143.204.228.17
2001:4de0:ac18::1:a:3b
2606:4700::6810:125e
2606:4700::6811:ecbe
2606:4700::6812:1734
2606:4700::6812:bcf
2a00:1450:4007:80c::2003
2a00:1450:4007:810::2008
2a00:1450:4007:811::200e
2a00:1450:4007:81a::200a
2a04:4e42:200::485
99.86.89.112
020b0eb6827b23f077b5fe97861cb8f35536d948352a475ce1e407cb00d83c95
11f4dfa542875c036cf07a3925dc7224e6ede5b62a14de4dc42db8da39abb05e
11fd6997d46f2149a8f81470816db7bc7f3c3c08f40102cfb824599c129cd04c
1ea22ef5cc12712e650ac15269e8e7b75904f47246ce6eb04bf0fcd42f8bed77
21359290c8d6f07cbb9994df1e280370c86d8320641a6450333639b487bd5214
21bf415bff7452c3ca9d2fd6b7afa9156844757a7802193acfb5a6c0d2621a81
22e2037b36515615d60ab5bb486646219d9a2509df36f31a11c9b94ec6f4bd5c
2ff5b959fa9f6b4b1d04d20a37d706e90039176ab1e2a202994d9580baeebfd6
334e714a1c5ebefb28783d1c809dda2a01b916554121e92067a2e41417cd10a2
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
44e960ff99f096e17f544b2abfa3fa07cd5b877750ec230fd367bd875bc72d26
46717c032f82e2316c694c6cb20d63d109954cc77e1aeee251dd5b1591915716
49b1107c4782c8cd60dce7dadd701116777a8097936dc6fa3e1b526a5f7bf4b3
526ecaf8fbd157b776733e40cd4e3af19fb4185e081f72d27284026138cc30e8
55b39bdfbc1845ff7f8dec7f508ceaced7115c594b4454fcbd17d5ff4cfd32bd
55d9a441e501caed3edae915c8e322e1a5e04f7ec89861c4bda11657f2dd92b7
5aa53525abc5c5200c70b3f6588388f86076cd699284c23cda64e92c372a1548
5d59d71fa30604e26c815b2bcfea777bef1564467e2ff9b1b4dc45ca2ee0f6fe
5f704460674d59ffe0434f7383fc5698219bd6cb5bd67a16d60c05c15a5d7e70
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6c65cc64b2b5f1e5aaa1a07ff9fff81fcf74c77cbe526a2ea5be3f51c79e0fca
6ca0060dc22528a6de6381a194c25e69190a8bd113178dbeaf86a81697b7d314
6da922d109eacd88de031d9d8617967726cfd928dc21da535ed34a141c9e847b
6f74888de1f7e175e7a8d9f4a482f1eb678d3a1f960113ba27d1a259264256cf
73489d9071ef40a1fdce399ee4faee08addd584314f4eb9a82d2f65d2af541a2
8173c9c7e6621a53dcfc67d287a719a4bde1fc826f77adf7f0d1e0b6f4126833
81837bb647b79c1e159b440fd593ab3f081fda2e018ca5b7b3a537b28fc3bd3e
81ddd86005934f8391dbe682a44f228b7a5df552d61719e5c5cfca1a27c4b3f2
894e9d68ff5f47d5d53d74f82920cbb32a90cd7545205d2b5905f242a66f8094
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
8e0276bb55f38a0946337c6d5ce1f88e1cd3bb8cc9560a35e5b061bb27fb1f16
8f4d9de155c93379f1b334fa00fa17335b54b294183828629822fe9c5417246e
9194059997d722ec01e41980dffbff03ebe00808b1cdd164a7fd18a561bc312a
91c4a6c4295f8889e8b04339a4a2c2e86d5eef71ba808164e641d0d8a6435004
925a7c247b707be85e803f6f366dd4dce3f13a0b96f93ba6ba0030a23493ec23
94899d8c0b4377abe765a34012c015437200f684f96360ea798ed6a8b48e9c8d
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9ce02fe239d1a5d16f9efbb8542929ea0d23c74cc732f8e9cf0729f7891b51e5
9d94dd0b66034c414f3762d56b1aed1353f9d2bb31b235869c31b3efdb47f5c9
a48ceb4ae058162d65945e2408db936ce617a5b8b18f65d58c2ae7f9657b53a1
b6b7ce30cf22058a97e7de157a28b503501245c425b9e7b8aa9cd743358101c3
bd478d1e075f071ca0f0e7f3e27e4c22d27831b23df86dd6d0f7a37c38263b0e
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
c4357236faa88551ac127de4b3fd1deab8c9463cfe3b127bc8836d3b55863469
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
ce885aa8b86fb7d85992aae4435fb45b444f8d3919dca083c83a36d7600f96d7
d4282b6a246b48a3ab9761b6b0f5ba0770af093af6b13ac7c05db49a13f0401c
d4bef2d91bd01eaeba3c9d62545eb98cec13e41bfacdbf28cf1c17bc7f1a35e4
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d86306cfb344762984b47aff717491662e6c9de66d26b7513fd99b6e450a6384
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb7cfd3d959b2e09c170f532e29f8b825f9bc770b2279fde58e595617753e244
f0916b04a6bd6a9c5a9c9721e8749a0d952b39ba9303399faeacba8a65dd9a92
f734d8ecda48e6d98faab2e1e9b91d6c5f72b86408ea6e2126d4b1681b92ef4c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fce6ae953c03cc3792f2c791e1be27ab4b4eeddb1923e49c138874dc107a6a25

www.cobaltstrike.com Open in urlscan Pro 2606:4700::6811:ecbe Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

70 Requests

84 %HTTPS

77 %IPv6

17 Domains

22 Subdomains

14 IPs

3 Countries

1350 kBTransfer

4536 kBSize

4 Cookies

19 Outgoing links

Redirected requests

70 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cobaltstrike.com Open in urlscan Pro
2606:4700::6811:ecbe Public Scan

Screenshot
Live screenshot

Full Image

70
Requests

84 %
HTTPS

77 %
IPv6

17
Domains

22
Subdomains

14
IPs

3
Countries

1350 kB
Transfer

4536 kB
Size

4
Cookies

70 HTTP transactions
0 data transactions