Submitted URL: https://www3.corelight.com/e/420832/ar-how-to-hunt-with-zeek-sigma/pj9smr/914719132?h=GFhPn7NpvYj8hQDHBNjRdkfj7wzqexsVXkAnT...
Effective URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Submission: On February 24 via api from IE

Summary

This website contacted 35 IPs in 5 countries across 25 domains to perform 95 HTTP transactions. The main IP is 35.174.78.146, located in Pearland, United States and belongs to AMAZON-AES, US. The main domain is www3.corelight.com.
TLS certificate: Issued by R3 on January 25th 2021. Valid for: 3 months.
This is the only time www3.corelight.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 9 35.174.78.146 14618 (AMAZON-AES)
3 2606:4700::68... 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
10 2600:9000:215... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 151.101.12.157 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
9 13.224.195.8 16509 (AMAZON-02)
3 104.109.70.122 20940 (AKAMAI-ASN1)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 34.107.254.219 15169 (GOOGLE)
1 52.208.188.183 16509 (AMAZON-02)
7 2a00:1450:400... 15169 (GOOGLE)
1 2 2620:119:50e1... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 185.33.221.88 29990 (ASN-APPNEX)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.244.42.197 13414 (TWITTER)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 104.244.42.195 13414 (TWITTER)
1 205.185.216.10 20446 (HIGHWINDS3)
1 13.224.195.26 16509 (AMAZON-02)
9 54.147.21.139 14618 (AMAZON-AES)
2 18.205.49.143 14618 (AMAZON-AES)
4 100.24.186.63 14618 (AMAZON-AES)
2 107.23.243.169 14618 (AMAZON-AES)
2 35.174.210.7 14618 (AMAZON-AES)
95 35
Domain Requested by
10 storage.pardot.com www3.corelight.com
9 js.driftt.com www3.corelight.com
js.driftt.com
8 www.gstatic.com www.googletagmanager.com
www.google.com
www.gstatic.com
6 metrics.api.drift.com js.driftt.com
6 www.google.com www3.corelight.com
www.gstatic.com
www.google.com
6 fonts.googleapis.com www3.corelight.com
js.driftt.com
6 www3.corelight.com 4 redirects pi.pardot.com
5 fonts.gstatic.com fonts.googleapis.com
www.google.com
4 targeting.api.drift.com js.driftt.com
3 customer.api.drift.com js.driftt.com
3 cdnjs.cloudflare.com www3.corelight.com
js.driftt.com
2 presence.api.drift.com js.driftt.com
2 1239138-38.chat.api.drift.com js.driftt.com
2 event.api.drift.com js.driftt.com
2 pi.pardot.com www3.corelight.com
pi.pardot.com
2 www.facebook.com www3.corelight.com
2 t.influ2.com www.influ2.com
www3.corelight.com
2 px.ads.linkedin.com 1 redirects www3.corelight.com
2 connect.facebook.net www3.corelight.com
connect.facebook.net
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
1 embeds.driftcdn.com js.driftt.com
1 metadata-static-files.sfo2.cdn.digitaloceanspaces.com www3.corelight.com
1 analytics.twitter.com static.ads-twitter.com
1 www.google.de www3.corelight.com
1 t.co www3.corelight.com
1 b.6sc.co www3.corelight.com
1 stats.g.doubleclick.net www.google-analytics.com
1 secure.adnxs.com j.6sc.co
1 c.6sc.co j.6sc.co
1 www.linkedin.com 1 redirects
1 insight.adsrvr.org www3.corelight.com
1 www.influ2.com www.googletagmanager.com
1 j.6sc.co www3.corelight.com
1 static.ads-twitter.com www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 www.googletagmanager.com www3.corelight.com
1 go.pardot.com www3.corelight.com
95 37

This site contains links to these domains. Also see Links.

Domain
www.corelight.com
www.linkedin.com
www.youtube.com
twitter.com
www.facebook.com
Subject Issuer Validity Valid
www3.corelight.com
R3
2021-01-25 -
2021-04-25
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-10-21 -
2021-10-20
a year crt.sh
upload.video.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
go.pardot.com
DigiCert SHA2 Secure Server CA
2020-12-05 -
2021-12-04
a year crt.sh
storage.pardot.com
DigiCert SHA2 Secure Server CA
2020-12-09 -
2021-12-08
a year crt.sh
www.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.gstatic.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.google.com
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2019-04-01 -
2021-05-07
2 years crt.sh
ads-twitter.com
DigiCert SHA2 High Assurance Server CA
2020-08-14 -
2021-08-19
a year crt.sh
drift.com
Amazon
2020-09-21 -
2021-10-23
a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA
2020-01-07 -
2021-04-07
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-02-10 -
2021-05-10
3 months crt.sh
influ2.com
GTS CA 1D2
2021-02-19 -
2021-05-20
3 months crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2021-01-06 -
2021-07-05
6 months crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2019-01-23 -
2021-03-08
2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
t.co
DigiCert TLS RSA SHA256 2020 CA1
2021-01-12 -
2022-01-11
a year crt.sh
t.influ2.com
GTS CA 1D2
2021-02-13 -
2021-05-14
3 months crt.sh
www.google.de
GTS CA 1O1
2021-01-26 -
2021-04-20
3 months crt.sh
pi.pardot.com
DigiCert SHA2 Secure Server CA
2020-12-05 -
2021-12-04
a year crt.sh
*.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-30 -
2021-11-29
a year crt.sh
*.sfo2.cdn.digitaloceanspaces.com
DigiCert SHA2 Secure Server CA
2020-03-11 -
2021-04-14
a year crt.sh
*.driftcdn.com
Amazon
2020-04-10 -
2021-05-10
a year crt.sh
wschat.api.drift.com
Amazon
2020-04-13 -
2021-05-13
a year crt.sh

This page contains 4 frames:

Primary Page: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Frame ID: 26874D8EBC65891E7687FD7792902121
Requests: 50 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Frame ID: FF4E0612F96515A57655A67FF8664017
Requests: 9 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
Frame ID: BF6F17C91AA5DE0E44A0E89D8F7D38FD
Requests: 3 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: 2E09E7392F2CEA93682163DEDD9B4F1F
Requests: 26 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www3.corelight.com/e/420832/ar-how-to-hunt-with-zeek-sigma/pj9smr/914719132?h=GFhPn7NpvYj8hQDHB... HTTP 301
    https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma Page URL

Page Statistics

95
Requests

100 %
HTTPS

54 %
IPv6

25
Domains

37
Subdomains

35
IPs

5
Countries

1471 kB
Transfer

4087 kB
Size

10
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www3.corelight.com/e/420832/ar-how-to-hunt-with-zeek-sigma/pj9smr/914719132?h=GFhPn7NpvYj8hQDHBNjRdkfj7wzqexsVXkAnT5Cdhp4 HTTP 301
    https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://www3.corelight.com/l/420832/2021-02-18/ph3f4q/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png HTTP 301
  • https://storage.pardot.com/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png
Request Chain 7
  • https://www3.corelight.com/l/420832/2021-02-02/pc6r1b/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png HTTP 301
  • https://storage.pardot.com/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png
Request Chain 8
  • https://www3.corelight.com/l/420832/2021-02-09/pfhf5n/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png HTTP 301
  • https://storage.pardot.com/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png
Request Chain 29
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D292564%26time%3D1614183631768%26url%3Dhttps%253A%252F%252Fwww3.corelight.com%252Fwebinar%252Fhow-to-hunt-with-zeek-sigma%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&liSync=true

95 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set how-to-hunt-with-zeek-sigma
www3.corelight.com/webinar/
Redirect Chain
  • https://www3.corelight.com/e/420832/ar-how-to-hunt-with-zeek-sigma/pj9smr/914719132?h=GFhPn7NpvYj8hQDHBNjRdkfj7wzqexsVXkAnT5Cdhp4
  • https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
32 KB
10 KB
Document
General
Full URL
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.78.146 Pearland, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
pi0-lba1-5-ue1.aws.pardot.com
Software
PardotServer /
Resource Hash
2d82b4d87784cbd006cf395bcbcba172b100ed84d7058c6805ff7eaef45840a8

Request headers

Host
www3.corelight.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
visitor_id420832=670708134; visitor_id420832-hash=213b635afb5df120872e920fbd3c87d5377b98651b527f204ad635dcbac7c0eb716cc41ba68b5681aa1d1f424e658008ad9c6d1f
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:30 GMT
Set-Cookie
pardot=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0 visitor_id420832=670708134; expires=Sat, 22-Feb-2031 16:20:30 GMT; Max-Age=315360000; path=/; secure; SameSite=None visitor_id420832-hash=213b635afb5df120872e920fbd3c87d5377b98651b527f204ad635dcbac7c0eb716cc41ba68b5681aa1d1f424e658008ad9c6d1f; expires=Sat, 22-Feb-2031 16:20:30 GMT; Max-Age=315360000; path=/; secure; SameSite=None
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Status
404 Not Found
X-Pardot-Rsp
16/30/149
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
8847
Content-Type
text/html; charset=utf-8
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
Server
PardotServer
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Connection
keep-alive

Redirect headers

Date
Wed, 24 Feb 2021 16:20:30 GMT
Set-Cookie
pardot=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0 visitor_id420832=670708134; expires=Sat, 22-Feb-2031 16:20:30 GMT; Max-Age=315360000; path=/; secure; SameSite=None visitor_id420832-hash=213b635afb5df120872e920fbd3c87d5377b98651b527f204ad635dcbac7c0eb716cc41ba68b5681aa1d1f424e658008ad9c6d1f; expires=Sat, 22-Feb-2031 16:20:30 GMT; Max-Age=315360000; path=/; secure; SameSite=None
Location
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control
max-age=63072000
Expires
Fri, 24 Feb 2023 16:20:30 GMT
Vary
Accept-Encoding,User-Agent
Content-Encoding
gzip
Content-Length
128
Content-Type
text/html; charset=UTF-8
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
Server
PardotServer
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Connection
keep-alive
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
30 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1792134
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5631
cf-request-id
087670a0280000dfe3f53a6000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-7918"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TA2purcX4YbXnJ9JoNn1ivJ5u0CGtS9ei4wUWNeu47WnMdiAF7QSQLq%2B1%2FKKgcGQFseeONYIvZ4FTSd3l8zcAyn85BFk%2BqfFZ7Jgx775wk6%2BjY9jg9gW8eTz0rgawGD8iw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
626a83ad0e82dfe3-FRA
expires
Mon, 14 Feb 2022 16:20:30 GMT
css2
fonts.googleapis.com/
11 KB
893 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c068ddcef990fe6faea20fa3861d5c5265c4b493bbd5f0244b74775057895850
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 15:03:07 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:30 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:30 GMT
piUtils.js
go.pardot.com/js/
341 KB
99 KB
Script
General
Full URL
https://go.pardot.com/js/piUtils.js?ver=2020-10-19
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.78.146 Pearland, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
pi0-lba1-5-ue1.aws.pardot.com
Software
PardotServer /
Resource Hash
744d368a676dabf6be331840fdf74176a9ad7a784bf3920e3f640c9ed89fc43c

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Last-Modified
Thu, 29 Oct 2020 20:58:06 GMT
Server
PardotServer
ETag
"55586-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
max-age=63072000
Transfer-Encoding
chunked
Accept-Ranges
bytes
Expires
Fri, 24 Feb 2023 16:20:31 GMT
u1600192325246_logo.png
storage.pardot.com/420832/1602051634msVWVv5I/
5 KB
5 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051634msVWVv5I/u1600192325246_logo.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aa473c660041cc5b4db9d799fd35b2821d791569c2c5b431e1800d7e581a98c2

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:20:35 GMT
server
AmazonS3
age
19971
etag
"47a055a75692b5af02884bb87bfc66af"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
4737
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
c_wGfToxdzAiKoGXLjjAOMlAvd5Usn3z
x-amz-cf-id
UoDbiDHm9MzlnhAFzhqCYZj7wKHLUZVfZ8UV1me13tOqFrQ1_eZLgg==
2021_02_wb_zeek_sigma_hunting_2200x489.png
storage.pardot.com/420832/16136896509EztJBLU/
Redirect Chain
  • https://www3.corelight.com/l/420832/2021-02-18/ph3f4q/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png
  • https://storage.pardot.com/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png
44 KB
44 KB
Image
General
Full URL
https://storage.pardot.com/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8811374d4980d5de710666ca92062cccd4fb14f12139bee714cc659ac8fb42fc

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 14:30:05 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Thu, 18 Feb 2021 23:07:31 GMT
server
AmazonS3
age
6627
etag
"fd3c25086b36b44704b8470302c51589"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
44681
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
hWXgSi_9PKcb98NZ9xxp5XKFGptX2jjO
x-amz-cf-id
dT_1kZHJ8ClRGj8AxuSJER_k6JILYcoMdkbEsWtUtUTyb8KMFbeK1Q==

Redirect headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Server
PardotServer
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Vary
Accept-Encoding,User-Agent
Content-Type
text/html; charset=UTF-8
Location
https://storage.pardot.com/420832/16136896509EztJBLU/2021_02_wb_zeek_sigma_hunting_2200x489.png
Cache-Control
max-age=63072000
Connection
keep-alive
X-Robots-Tag
none
Content-Length
163
Expires
Fri, 24 Feb 2023 16:20:31 GMT
api.js
www.google.com/recaptcha/
850 B
643 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
293758e111415003d2d741e154bc633cde1320e6788bd75aa9c173ca84985108
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
551
x-xss-protection
1; mode=block
expires
Wed, 24 Feb 2021 16:20:30 GMT
u1600192325246_live_img.png
storage.pardot.com/420832/1602051623F0PVVIzl/
4 KB
5 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051623F0PVVIzl/u1600192325246_live_img.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0befe4879b0c23327fd27d35ff674b9cca26623abda98bfc69ae9f8b0da6dd1a

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 14:30:05 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:20:24 GMT
server
AmazonS3
age
6627
etag
"498b7e6110990f81e1fcad02ebc71770"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
4353
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
3EyI5f2._0D7sdFgHuKVX7Zjue3zGGT_
x-amz-cf-id
j-21nhYCbAXgSjkt9MMArz_MlXq4iJ4ipkcK_irat_dB4yhFDd0epg==
Vince_Stoffer_200x200.png
storage.pardot.com/420832/1612288467o9fyHDNW/
Redirect Chain
  • https://www3.corelight.com/l/420832/2021-02-02/pc6r1b/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png
  • https://storage.pardot.com/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png
53 KB
54 KB
Image
General
Full URL
https://storage.pardot.com/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d4d91ffee7fdb8e005eb23fe0983c107279cf0dbec3043e5f94ec5fd3bd6c720

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 14:30:05 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Tue, 02 Feb 2021 17:54:28 GMT
server
AmazonS3
age
6627
etag
"9e7f07f9fdaa8057dd8ef78e4a8e67a4"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
54666
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
XyYhORnRTMX12NmMQTcG1L0pOhC9UjFL
x-amz-cf-id
vmX9PtqbJh2UA-Y0GlCaLEzcyqRD3uQJgN-RlbQucngeQ6Pq_BRlYw==

Redirect headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Server
PardotServer
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Vary
Accept-Encoding,User-Agent
Content-Type
text/html; charset=UTF-8
Location
https://storage.pardot.com/420832/1612288467o9fyHDNW/Vince_Stoffer_200x200.png
Cache-Control
max-age=63072000
Connection
keep-alive
X-Robots-Tag
none
Content-Length
152
Expires
Fri, 24 Feb 2023 16:20:31 GMT
Mark_Overholser_200x200.png
storage.pardot.com/420832/1612894169UjO34UzZ/
Redirect Chain
  • https://www3.corelight.com/l/420832/2021-02-09/pfhf5n/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png
  • https://storage.pardot.com/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png
59 KB
60 KB
Image
General
Full URL
https://storage.pardot.com/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
277f27f1634f33022f061490ca4625f4564bf51c5aba5ddf70aceb4b51e6bc5f

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 14:30:05 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Tue, 09 Feb 2021 18:09:30 GMT
server
AmazonS3
age
6627
etag
"a6ce0561287fda86bee9be3b4bf8afb7"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
60709
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
20ToerkiMCScaB_4yZT75lsr0rwZUjip
x-amz-cf-id
1uaX-EQ4Sx2q2xzr2h0JTKtdJKLaiYvkKJIkk0hqi7VvY_QQERfoVw==

Redirect headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
X-Pardot-Route
32427ff3465437d362f61c790f7d2406
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Server
PardotServer
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Vary
Accept-Encoding,User-Agent
Content-Type
text/html; charset=UTF-8
Location
https://storage.pardot.com/420832/1612894169UjO34UzZ/Mark_Overholser_200x200.png
Cache-Control
max-age=63072000
Connection
keep-alive
X-Robots-Tag
none
Content-Length
153
Expires
Fri, 24 Feb 2023 16:20:31 GMT
u1600192325246_youtube.png
storage.pardot.com/420832/16020516881ZElz9vu/
1 KB
2 KB
Image
General
Full URL
https://storage.pardot.com/420832/16020516881ZElz9vu/u1600192325246_youtube.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7fcb6119be7ddba96da6ba5dfca8645026a695b028a4f07d734879936326162d

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:21:30 GMT
server
AmazonS3
age
19972
etag
"861cd47c60cf3b13960c422a2b4a2ce0"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
1309
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
U0zbUI66TOIsdq6d.YG.TZ7Fo80ZokgT
x-amz-cf-id
BDRBo-iMQWxXL9vU3jcusUAKbDhaQzJUuQP3gdnOIHEXBYkfg3E3qQ==
u1600192325246_linkedin.png
storage.pardot.com/420832/1602051612DizHfaRu/
1 KB
2 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051612DizHfaRu/u1600192325246_linkedin.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
28883ce30cfd03bad08ae48d1bf459fa0f6e234972de13525c5dcdc90d490767

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:20:13 GMT
server
AmazonS3
age
19972
etag
"5f4a8e1ed0a2bc7ed4319ab3afd25551"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
1507
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
riMWFU3TU_UMdfcFOFnA2z1WLhxwGhyQ
x-amz-cf-id
5bnYcpL9KnuSVLsk7EfyvUU9JCSVTKSiR2OUaP6EGSiL5wTkMOQeGg==
u1600192325246_twitter.png
storage.pardot.com/420832/1602051680ktvhWKcQ/
1 KB
2 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051680ktvhWKcQ/u1600192325246_twitter.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7f6460b539e91908a0a18dc1a087a228bd7cec2a46daf6a2e3d2ca4e97319f25

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:21:21 GMT
server
AmazonS3
age
19972
etag
"678976054412251daf3296247ab643e3"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
1393
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
aSxDCRSFsAE..yAzcb.73HTCAPpVNszG
x-amz-cf-id
-igvQRcFCcKWJC98DFpm-VbmRi_9JCTShC87Q3yR7ykzqHrBt7DHBw==
u1600192325246_facebook.png
storage.pardot.com/420832/1602051592DdRoviaZ/
1 KB
2 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051592DdRoviaZ/u1600192325246_facebook.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fbb75360bcc4ac8e327682a3a2160fb5919f79f6ab665878e16c7a641ee55e4b

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:19:53 GMT
server
AmazonS3
age
19972
etag
"43f3a542c8bba7d46e8d1fd46d65c62e"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
1427
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
odGsGR.L1_6YWI1erC63Vk6Zi4EtxXsc
x-amz-cf-id
Ty9cTN-zP5ZR96PKc4kxVocqQ0JMNgAffZ0j6_ARaKPMC-Bw_hZemw==
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/1.9.0/
91 KB
29 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.0/jquery.min.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
587375
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
29505
cf-request-id
087670a04c0000dfe3f00d9000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-16b8c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=d9VK7ywKxy4LwU8PizM73SGDgLOgNBe9pp%2FrtxrMUDZaZvn23KPBHrwATJ%2BjvcU6jOes%2FIreDtofphaBigwbisZJk6Jt%2B2ZkCrRB6YH0yEIMt%2Fo4UTZvWayUmf9UFHkryg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
626a83ad4ed6dfe3-FRA
expires
Mon, 14 Feb 2022 16:20:30 GMT
gtm.js
www.googletagmanager.com/
175 KB
57 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
538f5dedc39adf70f45e2090160d792666d98dc70ff648599ca1ce0675504b13
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:31 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
58128
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 24 Feb 2021 16:20:31 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www3.corelight.com
Referer
https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Feb 2021 20:46:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
70416
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Wed, 23 Feb 2022 20:46:55 GMT
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www3.corelight.com
Referer
https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 19:41:26 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:10:27 GMT
server
sffe
age
506345
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9080
x-xss-protection
0
expires
Fri, 18 Feb 2022 19:41:26 GMT
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www3.corelight.com
Referer
https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600;700;800&display=swap
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Feb 2021 13:55:06 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:49 GMT
server
sffe
age
95125
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9180
x-xss-protection
0
expires
Wed, 23 Feb 2022 13:55:06 GMT
analytics.js
www.google-analytics.com/
46 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 05 Feb 2021 21:33:27 GMT
server
Golfe2
age
1075
date
Wed, 24 Feb 2021 16:02:36 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18980
expires
Wed, 24 Feb 2021 18:02:36 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
4 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:180::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Jan 2021 22:14:03 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=31914
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1855
uwt.js
static.ads-twitter.com/
5 KB
2 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:31 GMT
via
1.1 varnish
last-modified
Fri, 04 Dec 2020 00:21:46 GMT
age
58901
etag
"cbc512946c8abb461c6215ed5b454e5f+gzip"
vary
Accept-Encoding,Host
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-encoding
gzip
cache-control
no-cache
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
1957
x-timer
S1614183632.733176,VS0,VE0
x-served-by
cache-fra19124-FRA
loader.js
www.gstatic.com/wcm/
3 KB
1 KB
Script
General
Full URL
https://www.gstatic.com/wcm/loader.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dbdc2387f2d0c0aabd370640e1e252bddfb2f1acd582cb62b38502ee309146c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:06:33 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 18:15:00 GMT
server
sffe
age
838
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1358
x-xss-protection
0
expires
Wed, 24 Feb 2021 17:06:33 GMT
7hbw4wxfwim5.js
js.driftt.com/include/1614183900000/
138 KB
45 KB
Script
General
Full URL
https://js.driftt.com/include/1614183900000/7hbw4wxfwim5.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
3c028e9666117b356459012caad6c5b5d20a8227b95b01a899e48ebe7f27b94d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:31 GMT
content-encoding
gzip
x-amz-cf-pop
FRA2-C1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 03 Feb 2021 14:13:50 GMT
server
nginx
etag
W/"4d7b506764645b403852bae487758a92"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=10
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
7RuaGargqelRhqGyj334TXuY4B9IGammUyMEUw4UlgH-MIeYVagMwg==
6si.min.js
j.6sc.co/
15 KB
7 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
7f072dbb779b20cea6866f3f8d398af9cafe418e7e038aa0702feddf741f040c

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Content-Encoding
gzip
Last-Modified
Tue, 02 Feb 2021 06:46:48 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6018f558-3ab9"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
true
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
6144
fbevents.js
connect.facebook.net/en_US/
91 KB
23 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23762
x-fb-rlafr
0
pragma
public
x-fb-debug
rAmSHtONdYQxSKnBWHzjBx0Oj5O5vOF/JzOQHtqwQBu/Ib37vtEZNspyC3uiqYLuzZxWsjxhK2xXn0qcM1Y6ng==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 24 Feb 2021 16:20:31 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracker
www.influ2.com/
6 KB
3 KB
Script
General
Full URL
https://www.influ2.com/tracker?clid=f1fb2ee8-131f-4e86-a2f6-33f3ec23cb8f
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PVV5SJD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.254.219 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
219.254.107.34.bc.googleusercontent.com
Software
/
Resource Hash
6b678f2a766f140fc3d332bf2f339e8f5775e7832b1cc00352373f57530a306d
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2592000; includeSubdomains
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 24 Feb 2021 16:20:31 GMT
x-frame-options
DENY
content-type
application/javascript
via
1.1 google
vary
Accept-Encoding
alt-svc
clear
x-xss-protection
1; mode=block
/
insight.adsrvr.org/track/pxl/
70 B
261 B
Image
General
Full URL
https://insight.adsrvr.org/track/pxl/?adv=evmwzls&ct=0:4vqt9rh&fmt=3
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.188.183 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-188-183.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 16:20:31 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-type
image/gif
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
recaptcha__en.js
www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/
331 KB
129 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b89c4addd9525e5ecf970750e2f2477a9354a59467997c8aa2d79adc55594e1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www3.corelight.com
Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:55:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1526
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
131815
x-xss-protection
0
last-modified
Mon, 15 Feb 2021 05:05:05 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 24 Feb 2022 15:55:05 GMT
u1600192325246_speaker_bg.png
storage.pardot.com/420832/1602051660gOq32JVL/
5 KB
5 KB
Image
General
Full URL
https://storage.pardot.com/420832/1602051660gOq32JVL/u1600192325246_speaker_bg.png
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:1a00:d:7e9b:1200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
7ab1855e562b9d9abbeb65ff8d4bd1c2e71935061eae87698024f8694672d787

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 10:47:40 GMT
via
1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
last-modified
Wed, 07 Oct 2020 06:21:01 GMT
server
AmazonS3
age
19972
etag
"bc342d982317cc869e7937850ad2bb7a"
x-cache
Hit from cloudfront
content-type
image/png; charset=binary
x-amz-replication-status
COMPLETED
content-length
5161
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-version-id
nAi10QEy76SiaSPAvg87Jh48jgqZpMs7
x-amz-cf-id
AtnZjYahnx_NqS_rCik6VCVB2CutSKal2LxH4FSVpozVcgIPjcotIw==
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D292564%26time%3D1614183631768%26url%3Dhttps%253A%252F%252Fwww3.corelight.com%252F...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&liSync=true
0
57 B
Image
General
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&liSync=true
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
server
Play
linkedin-action
1
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
f8YpKXa7ZhZAtjLzaCsAAA==

Redirect headers

strict-transport-security
max-age=31536000
x-content-type-options
nosniff
linkedin-action
1
content-length
0
x-li-uuid
TdjHHXa7ZhYQaEgCpSsAAA==
pragma
no-cache
x-li-pop
afd-prod-lor1
x-msedge-ref
Ref A: DFC6CFF679C447668CB22D06F8802FFE Ref B: FRAEDGE1511 Ref C: 2021-02-24T16:20:32Z
date
Wed, 24 Feb 2021 16:20:32 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options
sameorigin
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=292564&time=1614183631768&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&liSync=true
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
call-tracking_2.js
www.gstatic.com/call-tracking/
51 KB
20 KB
Script
General
Full URL
https://www.gstatic.com/call-tracking/call-tracking_2.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ee0af9cb821e3b90c73da380ca1ea46a9568f50635facf5e263d0044c9124c9e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 22 Feb 2021 15:49:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 23 Apr 2020 17:15:00 GMT
server
sffe
age
174669
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19708
x-xss-protection
0
expires
Tue, 22 Feb 2022 15:49:22 GMT
collect
www.google-analytics.com/j/
2 B
390 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=2015715798&t=pageview&_s=1&dl=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&ul=en-us&de=UTF-8&dt=How%20to%20hunt%20with%20Zeek%20%2B%20Sigma&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1160648230&gjid=719508015&cid=824986155.1614183632&tid=UA-86222136-1&_gid=578321950.1614183632&_r=1&gtm=2wg2h0PVV5SJD&z=871805940
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 16:20:31 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www3.corelight.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
471244410413852
connect.facebook.net/signals/config/
241 KB
69 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/471244410413852?v=2.9.33&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
dd812377147e20adba38aa5510727bbb5b23e96008a5817af45afec1229526b6
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
70555
x-fb-rlafr
0
pragma
public
x-fb-debug
uc/ndiFCsEpuR1aXvoWkT/BsIjGq4aUEqXS/jSiHslT5LFye80aJuf6CDjIgPkROQDJrrRS0mnLyK2qN9fzgSA==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 24 Feb 2021 16:20:31 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-content-id
1306942647
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
c.6sc.co/
47 B
374 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8421e2a8ecc86cd83fac89a4c869f6453f5db719f647bfb5a4172482ad506b62

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:31 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www3.corelight.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
getuidj
secure.adnxs.com/
11 B
706 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 16:20:31 GMT
X-Proxy-Origin
82.102.19.136; 82.102.19.136; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.111:80
AN-X-Request-Uuid
bd56dc32-ed98-4de0-b386-493a4a71a03f
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www3.corelight.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
anchor
www.google.com/recaptcha/api2/ Frame FF4E
20 KB
11 KB
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
15bbdb129ed561849a20d50ee4771aa8c6a68e327a8bd064cec70b5e034ad2f2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-b9JRdwd31QXN08/HdqPFqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 24 Feb 2021 16:20:31 GMT
content-security-policy
script-src 'report-sample' 'nonce-b9JRdwd31QXN08/HdqPFqw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
11073
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
collect
stats.g.doubleclick.net/j/
4 B
90 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-86222136-1&cid=824986155.1614183632&jid=1160648230&gjid=719508015&_gid=578321950.1614183632&_u=YEBAAEAAAAAAAC~&z=1561556837
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 24 Feb 2021 16:20:31 GMT
content-type
text/plain
access-control-allow-origin
https://www3.corelight.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=e13725f521f4b7b8b185e2f10ffe13a5&svisitor=&visitor=3162bad0-a9f2-4efc-81c8-569dd3ffec7a&session=54fd4390-83a5-462f-81f3-59e1538e9e1b&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22Enhance%20your%20threat%20hunting%20capabilities%20with%2075%20free%20Zeek-powered%20queries%20for%20your%20SIEM.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22How%20to%20hunt%20with%20Zeek%20%2B%20Sigma%22%7D&cb=83631905&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.109.70.122 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a104-109-70-122.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:32 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 19:02:58 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502962-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
adsct
t.co/i/
43 B
448 B
Image
General
Full URL
https://t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nz8zc&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
65
x-xss-protection
0
x-response-time
116
pragma
no-cache
last-modified
Wed, 24 Feb 2021 16:20:32 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
d9e5065cdb97e21e4bbfc0c531867e55
x-transaction
00f9709200057ad6
expires
Tue, 31 Mar 1981 05:00:00 GMT
/
t.influ2.com/u/
63 B
283 B
XHR
General
Full URL
https://t.influ2.com/u/?cb=1614183631919
Requested by
Host: www.influ2.com
URL: https://www.influ2.com/tracker?clid=f1fb2ee8-131f-4e86-a2f6-33f3ec23cb8f
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
5c9eeff212ebee0b015e4b74be6803e82b47a331d58853c3a47614e6328f68ea

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
https://www3.corelight.com
date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
gzip
access-control-allow-credentials
true
vary
Accept-Encoding
via
1.1 google
content-type
text/plain; charset=utf-8
/
t.influ2.com/p/vt/
597 B
796 B
Image
General
Full URL
https://t.influ2.com/p/vt/?a=&clid=f1fb2ee8-131f-4e86-a2f6-33f3ec23cb8f&caid=&cb=1614183631919&s=&dt=How%20to%20hunt%20with%20Zeek%20%2B%20Sigma&ref=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
d267998c3594ce7f02341a5a8ef2b2705627f2552960e332d73747022406a30b

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin
*
date
Wed, 24 Feb 2021 16:20:32 GMT
via
1.1 google
access-control-allow-credentials
true
content-length
597
content-type
image/jpeg
ga-audiences
www.google.com/ads/
42 B
483 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-86222136-1&cid=824986155.1614183632&jid=1160648230&_u=YEBAAEAAAAAAAC~&z=169240316
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 16:20:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-86222136-1&cid=824986155.1614183632&jid=1160648230&_u=YEBAAEAAAAAAAC~&z=169240316
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 16:20:31 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
styles__ltr.css
www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/ Frame FF4E
50 KB
25 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6b08ea3a348838bc942ad470a757575975bd09459b63c1872c6e1129a6ca1939
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:13:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 15 Feb 2021 05:05:05 GMT
server
sffe
age
4036
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25479
x-xss-protection
0
expires
Thu, 24 Feb 2022 15:13:15 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/ Frame FF4E
331 KB
129 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b89c4addd9525e5ecf970750e2f2477a9354a59467997c8aa2d79adc55594e1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:50:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1826
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
131815
x-xss-protection
0
last-modified
Mon, 15 Feb 2021 05:05:05 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 24 Feb 2022 15:50:05 GMT
/
www.facebook.com/tr/
44 B
409 B
Image
General
Full URL
https://www.facebook.com/tr/?id=471244410413852&ev=PageView&dl=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&rl=&if=false&ts=1614183631936&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1614183631934.2002259378&it=1614183631794&coo=false&rqm=GET
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:31 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 24 Feb 2021 16:20:31 GMT
truncated
/ Frame FF4E
14 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame FF4E
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame FF4E
2 KB
2 KB
Image
General
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/styles__ltr.css
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/styles__ltr.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 12:56:30 GMT
x-content-type-options
nosniff
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
age
530641
content-type
image/png
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
expires
Thu, 25 Feb 2021 12:56:30 GMT
KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v18/ Frame FF4E
10 KB
11 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.google.com
Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 19 Feb 2021 04:25:38 GMT
x-content-type-options
nosniff
last-modified
Mon, 16 Oct 2017 17:32:51 GMT
server
sffe
age
474894
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10748
x-xss-protection
0
expires
Sat, 19 Feb 2022 04:25:38 GMT
OO1-U3lU0dAcjgy9Mul1Jwiij773bxCQH26zOKTm-Ow.js
www.google.com/js/bg/ Frame FF4E
14 KB
6 KB
Script
General
Full URL
https://www.google.com/js/bg/OO1-U3lU0dAcjgy9Mul1Jwiij773bxCQH26zOKTm-Ow.js
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
38ed7e537954d1d01c8e0cbd32e9752708a28fbef76f10901f6eb338a4e6f8ec
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:04:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 11:00:00 GMT
server
sffe
age
978
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6301
x-xss-protection
0
expires
Thu, 24 Feb 2022 16:04:13 GMT
webworker.js
www.google.com/recaptcha/api2/ Frame FF4E
102 B
295 B
Other
General
Full URL
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
81fa50822806b58c63d123c956b740c92033836e2477e82237f9c9ca0fa8c3a0
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&co=aHR0cHM6Ly93d3czLmNvcmVsaWdodC5jb206NDQz&hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&size=normal&cb=2688dx5s7jtv
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
content-security-policy
frame-ancestors 'self'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
112
x-xss-protection
1; mode=block
expires
Wed, 24 Feb 2021 16:20:32 GMT
bframe
www.google.com/recaptcha/api2/ Frame BF6F
7 KB
1 KB
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
6e40c6e854c06e934f6fb430f9242281f9668fc15bb375fec549cd0f7e3d2ccf
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-Svu8QVvS8cRILzpMdOkHtA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
www.google.com
:scheme
https
:path
/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 24 Feb 2021 16:20:32 GMT
content-security-policy
script-src 'report-sample' 'nonce-Svu8QVvS8cRILzpMdOkHtA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
1; mode=block
content-length
1125
server
GSE
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
styles__ltr.css
www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/ Frame BF6F
50 KB
25 KB
Stylesheet
General
Full URL
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6b08ea3a348838bc942ad470a757575975bd09459b63c1872c6e1129a6ca1939
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:13:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 15 Feb 2021 05:05:05 GMT
server
sffe
age
4037
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
25479
x-xss-protection
0
expires
Thu, 24 Feb 2022 15:13:15 GMT
recaptcha__en.js
www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/ Frame BF6F
331 KB
129 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/pRiAUlKgZOMcFLsfzZTeGtOA/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b89c4addd9525e5ecf970750e2f2477a9354a59467997c8aa2d79adc55594e1f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/recaptcha/api2/bframe?hl=en&v=pRiAUlKgZOMcFLsfzZTeGtOA&k=6LfVnCYTAAAAAB4x9xlkeTsV8CO6np5UMhNjRNNZ&cb=4a265hcchztp
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:50:05 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1827
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
131815
x-xss-protection
0
last-modified
Mon, 15 Feb 2021 05:05:05 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 24 Feb 2022 15:50:05 GMT
pd.js
pi.pardot.com/
5 KB
2 KB
Script
General
Full URL
https://pi.pardot.com/pd.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.78.146 Pearland, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
pi0-lba1-5-ue1.aws.pardot.com
Software
PardotServer /
Resource Hash
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:33 GMT
Content-Encoding
gzip
X-Pardot-Route
ea50fcd3dcf777490e1499615b883deb
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
Last-Modified
Fri, 13 Mar 2020 19:48:39 GMT
Server
PardotServer
ETag
"1442-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
application/javascript
Cache-Control
max-age=63072000
Accept-Ranges
bytes
Content-Length
1842
Expires
Fri, 24 Feb 2023 16:20:33 GMT
adsct
analytics.twitter.com/i/
31 B
651 B
Script
General
Full URL
https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0&txn_id=nz8zc&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma
Requested by
Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_f /
Resource Hash
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status
200 OK
x-twitter-response-tags
BouncerCompliant
content-length
57
x-xss-protection
0
x-response-time
103
pragma
no-cache
last-modified
Wed, 24 Feb 2021 16:20:32 GMT
server
tsa_f
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
content-type
application/javascript;charset=utf-8
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash
3f22bddf8d78250a836877323217fbfd
x-transaction
00cc786b00daf7ab
expires
Tue, 31 Mar 1981 05:00:00 GMT
lp.js
metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/
5 KB
6 KB
Script
General
Full URL
https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js
Requested by
Host: www3.corelight.com
URL: https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.10 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
20b11d2c0012e286c38350d6c9b2ba03341667d9bc7226bf526fb47e89668fd9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 16:20:32 GMT
Connection
Keep-Alive
Last-Modified
Fri, 18 Dec 2020 19:31:32 GMT
x-amz-request-id
tx0000000000000445616fd-006033bb93-5ef4480-sfo2a
ETag
"23752d527a82df9be63eb97fe04bceb3"
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1614183632.dop219.fr8.t,1614183632.cds136.fr8.shn,1614183632.cds136.fr8.c
Content-Type
application/x-javascript
Cache-Control
max-age=424259
x-rgw-object-type
Normal
Strict-Transport-Security
max-age=15552000; includeSubDomains; preload
Accept-Ranges
bytes
Content-Length
5105
index.html
js.driftt.com/deploy/assets/ Frame 2E09
894 B
1 KB
Document
General
Full URL
https://js.driftt.com/deploy/assets/index.html
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1614183900000/7hbw4wxfwim5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
f5ad087583ff5fd1e6c49c0ebab627e7d6a2f422e7733854cc9e3c6496321099
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

:method
GET
:authority
js.driftt.com
:scheme
https
:path
/deploy/assets/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma

Response headers

content-type
text/html; charset=utf-8
content-length
894
server
nginx
last-modified
Wed, 03 Feb 2021 14:13:50 GMT
x-amz-server-side-encryption
AES256
accept-ranges
bytes
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
date
Wed, 24 Feb 2021 16:20:32 GMT
cache-control
max-age=10
etag
"b35186c816a7a6b826e604eabbf1ec55"
x-cache
Hit from cloudfront
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
tjX1f-fa3SxC5n9EmnBwSCr6QmrNuvsUigzmvZPEPaU6OpP6JBsIrQ==
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/ Frame 2E09
2 KB
1 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/normalize.min.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcef96bd3d8479bd51214ea2308b44862e719474c22c78361e02e6546156c96f
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2408991
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
697
cf-request-id
087670a7950000dfe311a3a000000001
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:13:31 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03f2b-78e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5d6Qg50aHdB6h4YmrACzIngTtoVR3ty6ArsBugqlhDNpczD0yuJrtV1SOq6XRw8zwibX9%2FNpLVp8V2NSj5YG%2BCjLb6wgG%2B%2FS2iNUtoGsGcuI3lqV6QSsYQXTqvVtwaomKg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
626a83b8ed92dfe3-FRA
expires
Mon, 14 Feb 2022 16:20:32 GMT
widget-7e220ee10661d28927f7.css
js.driftt.com/deploy/assets/assets/ Frame 2E09
5 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
9f2a69efa5fabd2d3dfa461dbcf0f0db1f28d0113e14a4b8f93eeaea1b64c1ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 14:13:57 GMT
content-encoding
gzip
age
1821995
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:25:03 GMT
server
nginx
etag
W/"4439f045419bf781a98dac4a8b2bed34"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Xw2EXp82vqXxSI9eHjsjlp78Ijwy9QedNvaxV2Lz3UtmfKQva4evYw==
moment-7a16b8118a2b48c6fdcc.js
js.driftt.com/deploy/assets/assets/ Frame 2E09
239 KB
45 KB
Script
General
Full URL
https://js.driftt.com/deploy/assets/assets/moment-7a16b8118a2b48c6fdcc.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
596cdf795972ac9b23882d03a89f1fd1f6e1b62262c8dccc987fcbd1de459158
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 09 Feb 2021 01:38:17 GMT
content-encoding
gzip
age
1348935
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:24:56 GMT
server
nginx
etag
W/"7a16b8118a2b48c6fdccdb6800da768f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
qlYAow6Bj8Tb0RHov9jkJJO4GQKumVYMbhLuEdGOiCE5KrtMqfWfMA==
vendors-widget-6ac8ab748a0b008d8e72.js
js.driftt.com/deploy/assets/assets/ Frame 2E09
767 KB
213 KB
Script
General
Full URL
https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
a925a7615a63368a764f7614a5dd0a0e65faf78cab5cd6cb33a006f83693ae84
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 06 Feb 2021 02:57:12 GMT
content-encoding
gzip
age
1603400
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:24:58 GMT
server
nginx
etag
W/"6ac8ab748a0b008d8e72be439fd58dc9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
FkhVVW3NzzdwPBGOTl4aLP5AbHUe-mpfCPF7v4vCWUbaE75v-B2EhA==
widget-9dbd3bdaf99090d3be1e.js
js.driftt.com/deploy/assets/assets/ Frame 2E09
320 KB
77 KB
Script
General
Full URL
https://js.driftt.com/deploy/assets/assets/widget-9dbd3bdaf99090d3be1e.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
bf50721039216bbaaa55798397fd19d650f4440d1758766bb06a7eac9ae38834
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 14:13:57 GMT
content-encoding
gzip
age
1821995
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:24:58 GMT
server
nginx
etag
W/"9dbd3bdaf99090d3be1e19b88d2af130"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
nTA_fgbQSr7irbc2_HoEJbs8UDH2Ic-y1A1roYFjX6Zg3klEIzYP_A==
css
fonts.googleapis.com/ Frame 2E09
675 B
455 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fa8bc6afa7e5d6454a8d64e4d68015529dcc2221d4f8ee9f0194f71dc2ee3586
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 15:11:52 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:32 GMT
css
fonts.googleapis.com/ Frame 2E09
2 KB
623 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 15:00:56 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:32 GMT
css
fonts.googleapis.com/ Frame 2E09
2 KB
613 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c68d781eeb01bd19249e5301c2e13974cf71f00e32efe05c043b14142c0d2a00
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 14:59:31 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:32 GMT
css
fonts.googleapis.com/ Frame 2E09
2 KB
648 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto+Slab
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d92ee5028e2e8dc92bdeb0db40fdbf44bc09dbc4567a90daf066f305eb3070d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 15:35:21 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:32 GMT
css
fonts.googleapis.com/ Frame 2E09
699 B
436 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Overpass
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e4bfbb6b5cb05fcb69719eee3626c40701baa93745c1158783bb5dd6dd835af6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://js.driftt.com/deploy/assets/assets/widget-7e220ee10661d28927f7.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 16:12:23 GMT
server
ESF
date
Wed, 24 Feb 2021 16:20:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 16:20:32 GMT
52284660f7abf8538f64d3f7b857f505.mp3
js.driftt.com/deploy/assets/static/audio/ Frame 2E09
9 KB
9 KB
Media
General
Full URL
https://js.driftt.com/deploy/assets/static/audio/52284660f7abf8538f64d3f7b857f505.mp3
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
8258504b69b8fd0eebb0227f90133f487dd42f8d92a4abcd463c2207fddb4c4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-

Response headers

date
Tue, 15 Dec 2020 05:43:18 GMT
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
age
6172635
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
Content-Range
bytes 0-8852/8853
Content-Length
8853
last-modified
Thu, 21 Nov 2019 18:59:33 GMT
server
nginx
etag
"52284660f7abf8538f64d3f7b857f505"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
content-type
audio/mpeg
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LYEGhFmGbcCZzDcMMKNHgWDkZS_6jz58duQUd52cMrVCEYS5unULkA==
7hbw4wxfwim5.json
embeds.driftcdn.com/embeds/ Frame 2E09
49 KB
11 KB
Fetch
General
Full URL
https://embeds.driftcdn.com/embeds/7hbw4wxfwim5.json
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-9dbd3bdaf99090d3be1e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-26.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
94c47c6188b6b6f5e2b6820feeabe52e89d8b7d8c55c9d32cc3a7c98a1b4e913

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:32 GMT
content-encoding
gzip
age
11
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Tue, 23 Feb 2021 16:08:21 GMT
server
AmazonS3
etag
W/"10c44c590e3f19750bf2c2efd9458757"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/json; charset=UTF-8
via
1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront)
cache-control
public, max-age=30
x-amz-cf-pop
FRA2-C1
x-amz-cf-id
BLJ_-xlNoxbsl61ODPvdGlf3N3hVmn9gKMPqO9E93QiICNrLVPp-_Q==
analytics
pi.pardot.com/
2 KB
2 KB
Script
General
Full URL
https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=113053&account_id=421832&title=How%20to%20hunt%20with%20Zeek%20%2B%20Sigma&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&referrer=
Requested by
Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.78.146 Pearland, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
pi0-lba1-5-ue1.aws.pardot.com
Software
PardotServer /
Resource Hash
c3d39d3e02d504e14d9759cb8731a5c2ee5fefae0b12583600a4843e364b8746

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 16:20:33 GMT
Content-Encoding
gzip
X-Pardot-Route
13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
X-Pardot-Rsp
16/3/166
Vary
Accept-Encoding,User-Agent
P3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Content-Length
857
Server
PardotServer
Expires
Thu, 19 Nov 1981 08:52:00 GMT
react-intl-locale-data-en-a1cbb2108a7cc436f811.js
js.driftt.com/deploy/assets/assets/ Frame 2E09
7 KB
2 KB
Script
General
Full URL
https://js.driftt.com/deploy/assets/assets/react-intl-locale-data-en-a1cbb2108a7cc436f811.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-9dbd3bdaf99090d3be1e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
bdfb9122739945d02a227d781a0f7731d8b3ac09fd9a97c59c0dea3b9b2ce466
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 14:13:58 GMT
content-encoding
gzip
age
1821995
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:24:57 GMT
server
nginx
etag
W/"a1cbb2108a7cc436f811cc5c47862d05"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Pl0H803UyX6ET3N1b6fhlxo6RGJ-RAVNq4SkO011Tt67YXUh-eB3FA==
drift-translations-en_US-0c56fa65dc7c4e1bf68e.js
js.driftt.com/deploy/assets/assets/ Frame 2E09
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/deploy/assets/assets/drift-translations-en_US-0c56fa65dc7c4e1bf68e.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/widget-9dbd3bdaf99090d3be1e.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.224.195.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-224-195-8.fra2.r.cloudfront.net
Software
nginx /
Resource Hash
7435da548daea41bed968bcb59f262fb71f04e1cced01e32a1f276e6ae95c72e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 03 Feb 2021 14:13:58 GMT
content-encoding
gzip
age
1821995
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Tue, 02 Feb 2021 14:24:56 GMT
server
nginx
etag
W/"0c56fa65dc7c4e1bf68e20d21f36ec19"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 d7e55181ad8192e74c103c6003cd4d9c.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA2-C1
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
83kn2vx3h6G9gL36j951FTEC78_fMhjse7Nki523L7Ou3Bd--j4zXQ==
v2
customer.api.drift.com/geo/ Frame
0
0
Other
General
Full URL
https://customer.api.drift.com/geo/v2
Protocol
HTTP/1.1
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
HEAD,GET,OPTIONS
requestid
drifta74dfb24c46afcf35dbbb35be1a
content-length
18
x-envoy-upstream-service-time
0
server
istio-envoy
token
customer.api.drift.com/oauth/ Frame 2E09
1 KB
1 KB
Fetch
General
Full URL
https://customer.api.drift.com/oauth/token
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
469dff0d0397f92a168efa30a3a7bae509b66665615b43067da3ebbe05016789
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
content-encoding
gzip
server
istio-envoy
requestid
a67f2ba35e08a5c4
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
70
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
720
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
v2
customer.api.drift.com/geo/ Frame 2E09
209 B
880 B
Fetch
General
Full URL
https://customer.api.drift.com/geo/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
e8fd5708bbc9048c5766fe9d6a3f2e2e1bcc658765cd14ba99f3072b02de3721
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
server
istio-envoy
requestid
228e67832e845b3
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
209
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
init
metrics.api.drift.com/monitoring/metrics/widget/ Frame 2E09
25 B
697 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init?version=1
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
server
istio-envoy
requestid
d8fdd842ec6d9c44
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
11
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
init
metrics.api.drift.com/monitoring/metrics/widget/ Frame
0
0
Other
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init?version=1
Protocol
HTTP/1.1
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drift0b5892b4f2483628a92dea39d1f
content-length
13
x-envoy-upstream-service-time
1
server
istio-envoy
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ Frame 2E09
9 KB
9 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://js.driftt.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Feb 2021 20:46:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
70418
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Wed, 23 Feb 2022 20:46:55 GMT
/
www.facebook.com/tr/
44 B
259 B
Image
General
Full URL
https://www.facebook.com/tr/?id=471244410413852&ev=Microdata&dl=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&rl=&if=false&ts=1614183633560&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22How%20to%20hunt%20with%20Zeek%20%2B%20Sigma%22%2C%22meta%3Akeywords%22%3A%22%22%2C%22meta%3Adescription%22%3A%22Enhance%20your%20threat%20hunting%20capabilities%20with%2075%20free%20Zeek-powered%20queries%20for%20your%20SIEM.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1614183633558.231343564&it=1614183631794&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Wed, 24 Feb 2021 16:20:33 GMT
analytics
www3.corelight.com/
52 B
1 KB
Script
General
Full URL
https://www3.corelight.com/analytics?conly=true&visitor_id=670708164&visitor_id_sign=0330cb0fbfe76e3b16c7f6a0163ca1d5096c8301fccc5c3ab6a1a6afc05e5421a88cad444a773550896c8e3d2c658c777801c146&pi_opt_in=&campaign_id=113053&account_id=421832&title=How%20to%20hunt%20with%20Zeek%20%2B%20Sigma&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&referrer=
Requested by
Host: pi.pardot.com
URL: https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=113053&account_id=421832&title=How%20to%20hunt%20with%20Zeek%20%2B%20Sigma&url=https%3A%2F%2Fwww3.corelight.com%2Fwebinar%2Fhow-to-hunt-with-zeek-sigma&referrer=
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.78.146 Pearland, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
pi0-lba1-5-ue1.aws.pardot.com
Software
PardotServer /
Resource Hash
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825

Request headers

Referer
https://www3.corelight.com/webinar/how-to-hunt-with-zeek-sigma
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 16:20:33 GMT
X-Pardot-Route
13c7a24cfc43e49b0467af9964bf67ec
X-Pardot-LB
d3d7f55bb0643f40d338b3c1e133d5c5
X-Pardot-Rsp
16/6/27
Vary
User-Agent
P3p
CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Content-Length
52
Server
PardotServer
Expires
Thu, 19 Nov 1981 08:52:00 GMT
track
event.api.drift.com/ Frame
0
0
Other
General
Full URL
https://event.api.drift.com/track
Protocol
H2
Server
18.205.49.143 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-205-49-143.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
content-type
text/plain
content-length
13
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
allow
POST,OPTIONS
requestid
driftb9cfe8f48e7a128f85927435a86
clearbit
targeting.api.drift.com/targeting/enrichment/ Frame
0
0
Other
General
Full URL
https://targeting.api.drift.com/targeting/enrichment/clearbit?orgId=1239138&endUserId=8732122184
Protocol
H2
Server
100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-63.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
content-type
text/plain
content-length
13
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
allow
POST,OPTIONS
requestid
drift9896b874cbc8a0e5eb4c8a729c0
auth
1239138-38.chat.api.drift.com/api/ Frame
0
0
Other
General
Full URL
https://1239138-38.chat.api.drift.com/api/auth
Protocol
H2
Server
107.23.243.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-23-243-169.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
access-control-allow-credentials
true
access-control-allow-headers
origin,content-type,accept,authorization,auth-token
access-control-allow-methods
GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-allow-origin
*
access-control-expose-headers
access-control-max-age
1728000
cache-control
max-age=0, private, must-revalidate
server
Cowboy
x-request-id
Fma7doPJoDxW9TAhSY8B
v2
targeting.api.drift.com/hours/availability/combined/7hbw4wxfwim5/ Frame
0
0
Other
General
Full URL
https://targeting.api.drift.com/hours/availability/combined/7hbw4wxfwim5/v2
Protocol
H2
Server
100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-63.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
content-type
text/plain
content-length
18
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
allow
HEAD,GET,OPTIONS
requestid
drift401ae3342a9acd3fe3813f9bf0a
auth
presence.api.drift.com/api/ Frame
0
0
Other
General
Full URL
https://presence.api.drift.com/api/auth
Protocol
HTTP/1.1
Server
35.174.210.7 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-174-210-7.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin,content-type,accept,authorization,auth-token
access-control-allow-methods
GET,POST,PUT,PATCH,DELETE,OPTIONS
access-control-allow-origin
*
access-control-expose-headers
access-control-max-age
1728000
cache-control
max-age=0, private, must-revalidate
date
Wed, 24 Feb 2021 16:20:33 GMT
server
Cowboy
x-request-id
Fma7dorHW3247jgsVf2G
track
event.api.drift.com/ Frame 2E09
886 B
1 KB
XHR
General
Full URL
https://event.api.drift.com/track
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.205.49.143 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-205-49-143.compute-1.amazonaws.com
Software
/
Resource Hash
f418f97164e877885ab646a5fb81a28d35d20f25fd8a21bc8c1ada85cbdaae71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://js.driftt.com/deploy/assets/index.html
Authorization
bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4NzMyMTIyMTg0IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTIzOTEzOCIsImV4cCI6MTY0NTcxOTYzMywiaWF0IjoxNjE0MTgzNjMzfQ.PDea09cUTWr87oERIpTXaVDmM_16QCcnO1GMrgrUDTLjxEQ_-0BT6oq9FY2BluM2Z8BC7HMYBoK5HuMkPNFDGQ
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
requestid
e4db3163e3840696
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
886
clearbit
targeting.api.drift.com/targeting/enrichment/ Frame 2E09
2 KB
2 KB
XHR
General
Full URL
https://targeting.api.drift.com/targeting/enrichment/clearbit?orgId=1239138&endUserId=8732122184
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-63.compute-1.amazonaws.com
Software
/
Resource Hash
e5ec3f162785a951a4358bf9fb9a77ad55dc4c3eef3a3e3fae4b41d5b783b53a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://js.driftt.com/deploy/assets/index.html
Authorization
bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4NzMyMTIyMTg0IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTIzOTEzOCIsImV4cCI6MTY0NTcxOTYzMywiaWF0IjoxNjE0MTgzNjMzfQ.PDea09cUTWr87oERIpTXaVDmM_16QCcnO1GMrgrUDTLjxEQ_-0BT6oq9FY2BluM2Z8BC7HMYBoK5HuMkPNFDGQ
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
content-encoding
gzip
requestid
44abfab65f12db6e
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
1801
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
auth
1239138-38.chat.api.drift.com/api/ Frame 2E09
336 B
570 B
XHR
General
Full URL
https://1239138-38.chat.api.drift.com/api/auth
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
107.23.243.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-107-23-243-169.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
bfb330e89c4922bdcb2df52d39bdb3dd48f2f461073aad584d181e74a396bbfd

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
server
Cowboy
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
336
x-request-id
Fma7doohUi-n29kCHmTE
v2
targeting.api.drift.com/hours/availability/combined/7hbw4wxfwim5/ Frame 2E09
335 B
712 B
XHR
General
Full URL
https://targeting.api.drift.com/hours/availability/combined/7hbw4wxfwim5/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.24.186.63 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-100-24-186-63.compute-1.amazonaws.com
Software
/
Resource Hash
7b95b1dfdf7c440babbb84b9d3764c369236102136cf935d8f90bf49cc89cdfa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://js.driftt.com/deploy/assets/index.html
Authorization
bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4NzMyMTIyMTg0IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTIzOTEzOCIsImV4cCI6MTY0NTcxOTYzMywiaWF0IjoxNjE0MTgzNjMzfQ.PDea09cUTWr87oERIpTXaVDmM_16QCcnO1GMrgrUDTLjxEQ_-0BT6oq9FY2BluM2Z8BC7HMYBoK5HuMkPNFDGQ
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:34 GMT
content-encoding
gzip
requestid
d544e8e37a4fa50e
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
250
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
auth
presence.api.drift.com/api/ Frame 2E09
355 B
688 B
XHR
General
Full URL
https://presence.api.drift.com/api/auth
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.174.210.7 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-174-210-7.compute-1.amazonaws.com
Software
Cowboy /
Resource Hash
a033495f913051f3ca4297bf60997b82d7b96452143fdd2f6ceabcf5009d5a4a

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:33 GMT
server
Cowboy
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
cache-control
max-age=0, private, must-revalidate
access-control-allow-credentials
true
content-length
355
x-request-id
Fma7dpDzbiS-Gs0sVf3G
bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame 2E09
25 B
696 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/add/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://js.driftt.com/deploy/assets/index.html
Authorization
bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJzdWIiOiI4NzMyMTIyMTg0IiwiY2xpZW50SWQiOiJmNnp1aXpkeWh4cm03ciIsInVzZXJJZFR5cGUiOiJMRUFEIiwic2NvcGUiOiJsZWFkIiwiaXNzIjoiMTIzOTEzOCIsImV4cCI6MTY0NTcxOTYzMywiaWF0IjoxNjE0MTgzNjMzfQ.PDea09cUTWr87oERIpTXaVDmM_16QCcnO1GMrgrUDTLjxEQ_-0BT6oq9FY2BluM2Z8BC7HMYBoK5HuMkPNFDGQ
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:38 GMT
server
istio-envoy
requestid
91cd5967b26a2907
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
bulk
metrics.api.drift.com/monitoring/metrics/add/ Frame
0
0
Other
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/add/bulk
Protocol
HTTP/1.1
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:38 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drift89fb0ff4874aaf46b22fbeffa58
content-length
13
x-envoy-upstream-service-time
1
server
istio-envoy
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Other
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
HTTP/1.1
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Wed, 24 Feb 2021 16:20:38 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drift906f90c45adad472240231a36a4
content-length
13
x-envoy-upstream-service-time
1
server
istio-envoy
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 2E09
25 B
697 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/deploy/assets/assets/vendors-widget-6ac8ab748a0b008d8e72.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/deploy/assets/index.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 24 Feb 2021 16:20:38 GMT
server
istio-envoy
requestid
d8c2889a8bd60b0c
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
11
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info

Verdicts & Comments Add Verdict or Comment

85 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| dataLayer object| google_tag_manager object| pardot object| piAjax object| piUtils function| $ function| jQuery string| piAId string| piCId string| piHostname object| google_tag_data string| GoogleAnalyticsObject function| ga string| _linkedin_data_partner_id function| twq function| _googWcmImpl string| _googWcmAk function| drift function| driftt object| _6si function| fbq function| _fbq function| getParam function| getExpiryRecord function| addGclid object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| anchors object| anchor object| labels object| label string| text object| nextElement object| elements object| jQuery190008442549916334818 function| onYouTubeIframeAPIReady function| lintrk boolean| _already_called_lintrk object| gaplugins object| gaGlobal object| gaData boolean| _storagePopulated object| true object| twttr object| recaptcha object| closure_lm_566560 object| __core-js_shared__ object| platform boolean| __DRIFTT_WIDGET_INCLUDED__ string| __DRIFT_INSTANCE_ID__ boolean| __DRIFTT_SHOW_WIDGET_ON_BOOT__ object| google_js_reporting_queue number| google_srt function| _googWccDebug function| _googCallTrackingImpl function| _gaPhoneImpl object| Metadata function| checkNamespace function| getPardotUrl function| piTracker function| piGetParameter function| piGetCookie function| piSetCookie string| piVersion number| piScriptNum object| piScriptObj object| pi number| c_start string| property function| piResponse

10 Cookies

Domain/Path Name / Value
www3.corelight.com/ Name: _gd_svisitor
Value: 9fb5100203690000cf7c3660d8020000be8d0100
www3.corelight.com/ Name: _gd_session
Value: 54fd4390-83a5-462f-81f3-59e1538e9e1b
www3.corelight.com/ Name: _gd_visitor
Value: 3162bad0-a9f2-4efc-81c8-569dd3ffec7a
.corelight.com/ Name: _fbp
Value: fb.1.1614183631934.2002259378
www3.corelight.com/ Name: _an_uid
Value: 0
.corelight.com/ Name: _gcl_au
Value: 1.1.987648014.1614183632
www3.corelight.com/ Name: driftt_aid
Value: eef7c94d-94ec-41f8-b432-744034fde436
.corelight.com/ Name: _gat_UA-86222136-1
Value: 1
.corelight.com/ Name: _gid
Value: GA1.2.578321950.1614183632
.corelight.com/ Name: _ga
Value: GA1.2.824986155.1614183632

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1239138-38.chat.api.drift.com
analytics.twitter.com
b.6sc.co
c.6sc.co
cdnjs.cloudflare.com
connect.facebook.net
customer.api.drift.com
embeds.driftcdn.com
event.api.drift.com
fonts.googleapis.com
fonts.gstatic.com
go.pardot.com
insight.adsrvr.org
j.6sc.co
js.driftt.com
metadata-static-files.sfo2.cdn.digitaloceanspaces.com
metrics.api.drift.com
pi.pardot.com
presence.api.drift.com
px.ads.linkedin.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
storage.pardot.com
t.co
t.influ2.com
targeting.api.drift.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.influ2.com
www.linkedin.com
www3.corelight.com
100.24.186.63
104.109.70.122
104.244.42.195
104.244.42.197
107.23.243.169
13.224.195.26
13.224.195.8
151.101.12.157
18.205.49.143
185.33.221.88
205.185.216.10
2600:9000:2156:1a00:d:7e9b:1200:93a1
2606:4700::6810:135e
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:809::2003
2a00:1450:4001:810::2003
2a00:1450:4001:810::2004
2a00:1450:4001:811::2003
2a00:1450:4001:811::2013
2a00:1450:4001:813::2004
2a00:1450:4001:827::2008
2a00:1450:4001:827::200e
2a00:1450:4001:82a::200a
2a00:1450:400c:c07::9b
2a02:26f0:7100:180::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.107.254.219
35.174.210.7
35.174.78.146
52.208.188.183
54.147.21.139
0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e
0befe4879b0c23327fd27d35ff674b9cca26623abda98bfc69ae9f8b0da6dd1a
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
15bbdb129ed561849a20d50ee4771aa8c6a68e327a8bd064cec70b5e034ad2f2
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
20b11d2c0012e286c38350d6c9b2ba03341667d9bc7226bf526fb47e89668fd9
277f27f1634f33022f061490ca4625f4564bf51c5aba5ddf70aceb4b51e6bc5f
28883ce30cfd03bad08ae48d1bf459fa0f6e234972de13525c5dcdc90d490767
293758e111415003d2d741e154bc633cde1320e6788bd75aa9c173ca84985108
2d82b4d87784cbd006cf395bcbcba172b100ed84d7058c6805ff7eaef45840a8
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
38ed7e537954d1d01c8e0cbd32e9752708a28fbef76f10901f6eb338a4e6f8ec
3c028e9666117b356459012caad6c5b5d20a8227b95b01a899e48ebe7f27b94d
4352380f92ce7f9a4a4a23306b992bed10055dbfffe90987cc72083e583fc280
43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27
469dff0d0397f92a168efa30a3a7bae509b66665615b43067da3ebbe05016789
4cf52cc73734aa71f26f6a10be9aeec89602af45bf0f9abd5c8445a076c1ae1a
538f5dedc39adf70f45e2090160d792666d98dc70ff648599ca1ce0675504b13
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
596cdf795972ac9b23882d03a89f1fd1f6e1b62262c8dccc987fcbd1de459158
5c9eeff212ebee0b015e4b74be6803e82b47a331d58853c3a47614e6328f68ea
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
6b08ea3a348838bc942ad470a757575975bd09459b63c1872c6e1129a6ca1939
6b678f2a766f140fc3d332bf2f339e8f5775e7832b1cc00352373f57530a306d
6e40c6e854c06e934f6fb430f9242281f9668fc15bb375fec549cd0f7e3d2ccf
7435da548daea41bed968bcb59f262fb71f04e1cced01e32a1f276e6ae95c72e
744d368a676dabf6be331840fdf74176a9ad7a784bf3920e3f640c9ed89fc43c
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ab1855e562b9d9abbeb65ff8d4bd1c2e71935061eae87698024f8694672d787
7b95b1dfdf7c440babbb84b9d3764c369236102136cf935d8f90bf49cc89cdfa
7f072dbb779b20cea6866f3f8d398af9cafe418e7e038aa0702feddf741f040c
7f6460b539e91908a0a18dc1a087a228bd7cec2a46daf6a2e3d2ca4e97319f25
7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e
7fcb6119be7ddba96da6ba5dfca8645026a695b028a4f07d734879936326162d
81fa50822806b58c63d123c956b740c92033836e2477e82237f9c9ca0fa8c3a0
8258504b69b8fd0eebb0227f90133f487dd42f8d92a4abcd463c2207fddb4c4d
8421e2a8ecc86cd83fac89a4c869f6453f5db719f647bfb5a4172482ad506b62
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8811374d4980d5de710666ca92062cccd4fb14f12139bee714cc659ac8fb42fc
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
925be107869153b6120de872c1ae333977bfaee69a0f7c6271f32d4a8348bca8
94c47c6188b6b6f5e2b6820feeabe52e89d8b7d8c55c9d32cc3a7c98a1b4e913
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
9f2a69efa5fabd2d3dfa461dbcf0f0db1f28d0113e14a4b8f93eeaea1b64c1ef
a033495f913051f3ca4297bf60997b82d7b96452143fdd2f6ceabcf5009d5a4a
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a925a7615a63368a764f7614a5dd0a0e65faf78cab5cd6cb33a006f83693ae84
aa473c660041cc5b4db9d799fd35b2821d791569c2c5b431e1800d7e581a98c2
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b89c4addd9525e5ecf970750e2f2477a9354a59467997c8aa2d79adc55594e1f
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
bdfb9122739945d02a227d781a0f7731d8b3ac09fd9a97c59c0dea3b9b2ce466
bf50721039216bbaaa55798397fd19d650f4440d1758766bb06a7eac9ae38834
bfb330e89c4922bdcb2df52d39bdb3dd48f2f461073aad584d181e74a396bbfd
c068ddcef990fe6faea20fa3861d5c5265c4b493bbd5f0244b74775057895850
c3d39d3e02d504e14d9759cb8731a5c2ee5fefae0b12583600a4843e364b8746
c68d781eeb01bd19249e5301c2e13974cf71f00e32efe05c043b14142c0d2a00
cf7a2b3976c3af63dc2bca70cc5625a26341f19b1ccd484feddf076df895ed58
d267998c3594ce7f02341a5a8ef2b2705627f2552960e332d73747022406a30b
d4d91ffee7fdb8e005eb23fe0983c107279cf0dbec3043e5f94ec5fd3bd6c720
d92ee5028e2e8dc92bdeb0db40fdbf44bc09dbc4567a90daf066f305eb3070d3
dbdc2387f2d0c0aabd370640e1e252bddfb2f1acd582cb62b38502ee309146c2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd812377147e20adba38aa5510727bbb5b23e96008a5817af45afec1229526b6
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4bfbb6b5cb05fcb69719eee3626c40701baa93745c1158783bb5dd6dd835af6
e5ec3f162785a951a4358bf9fb9a77ad55dc4c3eef3a3e3fae4b41d5b783b53a
e8fd5708bbc9048c5766fe9d6a3f2e2e1bcc658765cd14ba99f3072b02de3721
eca19fb64be166fabab688d0cdb2ae946d3370f8124ff0f3f18119cc2d4eb825
ee0af9cb821e3b90c73da380ca1ea46a9568f50635facf5e263d0044c9124c9e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f418f97164e877885ab646a5fb81a28d35d20f25fd8a21bc8c1ada85cbdaae71
f5ad087583ff5fd1e6c49c0ebab627e7d6a2f422e7733854cc9e3c6496321099
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fa8bc6afa7e5d6454a8d64e4d68015529dcc2221d4f8ee9f0194f71dc2ee3586
fbb75360bcc4ac8e327682a3a2160fb5919f79f6ab665878e16c7a641ee55e4b
fcef96bd3d8479bd51214ea2308b44862e719474c22c78361e02e6546156c96f