www.recordedfuture.com Open in urlscan Pro
104.18.43.111  Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/9u3basZ4Gj Page URL
2. https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm=gtmv2&e_ipv6=AQIky8U0w6SSBQAAAZB7W2T_Q8qK-LsvNAt_X-CresPdZNUyOzdu0dIlzCXyRTkntls

106 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	9u3basZ4Gj t.co/	443 B 593 B	262ms 154ms	Document text/html	93.184.221.165 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software tsa_f / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers cache-control private,max-age=300 content-encoding gzip content-length 223 content-type text/html; charset=utf-8 date Thu, 04 Jul 2024 01:28:23 GMT expires Thu, 04 Jul 2024 01:33:23 GMT perf 7402827104 server tsa_f strict-transport-security max-age=0 vary Origin x-connection-hash 7374715c5b4174e5662e68db6c0864ade5f70568e1d7ebeb0f4828bbff535b85 x-response-time 116 x-transaction-id 9b2555f44796ee6e x-xss-protection 0
GET H2	200	Primary Request caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Show response www.recordedfuture.com/	88 KB 18 KB	539ms 436ms	Document text/html	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Next.js Resource Hash dae5c472a914e6ab7567aef363437074f301a7ea1ae6270a3c92580dcd8195e4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Referer https://t.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers age 0 cache-control s-maxage=30, stale-while-revalidate cf-cache-status DYNAMIC cf-ray 89db569e1fe123ff-LHR content-encoding gzip content-type text/html; charset=utf-8 date Thu, 04 Jul 2024 01:28:24 GMT server cloudflare strict-transport-security max-age=31536000; includeSubDomains traceresponse 00-17dede47023a870223589afedf4ceb26-981eeba297c774fe-01 vary Accept-Encoding via 1.1 varnish x-cache MISS x-cache-hits 0 x-content-type-options nosniff x-debug-info eyJyZXRyaWVzIjowfQ== x-nextjs-cache STALE x-platform-server i-bac7380798664d7697b0cf11d33520e7 i-bac7380798664d7697b0cf11d33520e7 x-powered-by Next.js x-served-by cache-lcy-eglc8600032-LCY
GET H2	200	brand_logo_long_black_f2ead5b5c6.svg cms.recordedfuture.com/uploads/	4 KB 2 KB	536ms 440ms	Image image/svg+xml	151.101.130.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/brand_logo_long_black_f2ead5b5c6.svg?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1d0ca87959e23cb77cff2f1d7fe2337ecc770de12b1d20762373321d7d287183 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-cache-hits 0 date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 age 0 traceresponse 00-17dea1be548cc8fe5aa267e318116e8a-1c521a5dab5389e1-01 x-cache HIT content-length 1262 x-served-by cache-lcy-eglc8600098-LCY last-modified Thu, 10 Mar 2022 10:37:46 GMT etag W/"6229d4fa-eab" vary Accept-Encoding content-type image/svg+xml cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes expires Wed, 03 Jul 2024 07:04:06 GMT
GET H2	200	large_Main_Feature_6_5392cd9101.jpg cms.recordedfuture.com/uploads/format_webp/	19 KB 19 KB	571ms 475ms	Image image/webp	151.101.130.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/format_webp/large_Main_Feature_6_5392cd9101.jpg?w=640 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3657281c3d67d023ae8887c44a7141c1e7abf87111ab8072355370c56a01f9cc Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 fastly-io-served-by img04-europe-west3 traceresponse 00-17dec533ade8de91e6877c0baca9a163-ce2b22f317e271d2-01 age 0 x-cache HIT fastly-io-info ifsz=19476 idim=1000x375 ifmt=webp ofsz=19476 odim=1000x375 ofmt=webp fastly-stats io=1 content-length 19476 fastly-io-warning Failed to shrink image x-served-by cache-lcy-eglc8600098-LCY etag "GOcba9PshiWSFc/u0GfH7RULqHv/od0ZtIqhD+OeSLg" content-type image/webp cache-control max-age=300, public, s-maxage=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	fonts.css www.recordedfuture.com/fonts/	1 KB 442 B	427ms 426ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/fonts/fonts.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 712a64e252b8b2276803abea9f4ec37e39bc91a63c34159f311b690f988c3a3f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17dede4722b05eb2ec7248226344fb44-80a690449fb8ac0a-01 x-cache MISS content-length 208 x-served-by cache-lcy-eglc8600026-LCY last-modified Tue, 02 Jul 2024 12:12:44 GMT server cloudflare etag W/"416-190735c8e60" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0e95c23ff-LHR x-cache-hits 0
GET H2	200	052769b296a78730.css www.recordedfuture.com/_next/static/css/	62 KB 14 KB	60ms 59ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash abde7461cedcc4b2828ec00671581b64aafba9e7243ef2653f614aafe4cd0ec9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff age 568089 traceresponse 00-17dcd99a967803977750640ef312fe0f-c30c73188d559d99-01 cf-polished origSize=63222 content-encoding gzip x-cache MISS x-served-by cache-lcy-eglc8600067-LCY cf-bgj minify last-modified Thu, 27 Jun 2024 11:37:38 GMT server cloudflare etag W/"f6f6-190597ca15c" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 89db56a0e95f23ff-LHR x-cache-hits 0
GET H2	200	583c733c0bc9b81b.css www.recordedfuture.com/_next/static/css/	24 KB 6 KB	55ms 55ms	Stylesheet text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/583c733c0bc9b81b.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f524f47ebbba0a65428e675b4f08da41e6b9b4889ad71fae08170e801d0bd614 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT strict-transport-security max-age=31536000; includeSubDomains via 1.1 varnish cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff age 1269867 traceresponse 00-17da5b2b24a0b01680202b5b0e9c9be6-5e7fe4d161abe650-01 cf-polished origSize=24391 content-encoding gzip x-cache HIT x-served-by cache-lcy-eglc8600021-LCY cf-bgj minify last-modified Wed, 19 Jun 2024 08:36:14 GMT server cloudflare etag W/"5f47-1902fa3ae4a" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 89db56a0e96023ff-LHR x-cache-hits 0
GET H2	200	webpack-baa24577ac134f77.js Show response www.recordedfuture.com/_next/static/chunks/	5 KB 2 KB	62ms 60ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/webpack-baa24577ac134f77.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff5eaae620774c6c3b4a1a285deb78f2053ace615806a282abb7364552d6a057 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 568089 traceresponse 00-17dcd99a96f5acd5b49444b949fcb033-c6463dcf9a354bdb-01 x-cache MISS content-length 2261 x-served-by cache-lcy-eglc8600077-LCY last-modified Thu, 27 Jun 2024 11:37:38 GMT server cloudflare etag W/"1534-190597ca145" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96623ff-LHR x-cache-hits 0
GET H2	200	framework-467b11a89995b152.js Show response www.recordedfuture.com/_next/static/chunks/	138 KB 45 KB	63ms 62ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/framework-467b11a89995b152.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3d9ec892dee44ec1c6a5778b93c71fbb4357b8dc8e00ba61eb7baeb6b0af79fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17dc8b407871c6f637a417d814b4f21c-c8e6137d1f3de603-01 x-cache MISS content-length 45457 x-served-by cache-lcy-eglc8600040-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"2270d-190545adb94" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96723ff-LHR x-cache-hits 0
GET H2	200	main-75bdb96a41ba80f4.js Show response www.recordedfuture.com/_next/static/chunks/	113 KB 33 KB	96ms 94ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a556b35758f8a2ade1b662eeec7a45a4739325de831c2eca6cbe1171fbc6bfd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17dc8b407dc04f42a66fa5547af0584b-8ce92a095a82a84c-01 x-cache MISS content-length 33036 x-served-by cache-lcy-eglc8600057-LCY last-modified Wed, 26 Jun 2024 11:42:39 GMT server cloudflare etag W/"1c3b0-190545adba7" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96823ff-LHR x-cache-hits 0
GET H2	200	_app-d8e4586260386d57.js Show response www.recordedfuture.com/_next/static/chunks/pages/	122 KB 39 KB	95ms 94ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/_app-d8e4586260386d57.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5e17346547b84fb6eb39887940896609ab42df0d14fdcfa501063d90d226d9c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17d78d8be204c3c89131c342c43354da-1f655c34f145d3b1-01 x-cache HIT content-length 39378 x-served-by cache-lcy-eglc8600020-LCY last-modified Wed, 05 Jun 2024 12:55:41 GMT server cloudflare etag W/"1e8a1-18fe878303e" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96923ff-LHR x-cache-hits 0
GET H2	200	769-11f77e9c8b5aa3c3.js Show response www.recordedfuture.com/_next/static/chunks/	261 KB 76 KB	95ms 94ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/769-11f77e9c8b5aa3c3.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1a01e8687f6a22f7bba9bf6a9eba2fe9e69759920d7ee8b0bb2101cf19dfcf9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17dc8b407874ec84edecb0c81aac1025-6e657cef3ff2a896-01 x-cache MISS content-length 77854 x-served-by cache-lcy-eglc8600046-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"41249-190545adb60" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96a23ff-LHR x-cache-hits 0
GET H2	200	129-18f7d6c1f8c4b98c.js Show response www.recordedfuture.com/_next/static/chunks/	37 KB 11 KB	96ms 94ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/129-18f7d6c1f8c4b98c.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 46d64a78d884e43692e0b4b83e8affef1f858885563fcb1ce92d11235499aa17 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17dc8b407eae59b171e874acc22de03a-2b25b6eff2630097-01 x-cache MISS content-length 11517 x-served-by cache-lcy-eglc8600082-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"93e4-190545adb1e" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96c23ff-LHR x-cache-hits 0
GET H2	200	911-ff01f8a62625f045.js Show response www.recordedfuture.com/_next/static/chunks/	55 KB 19 KB	96ms 95ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8af77a655a0e1ecfd86c2a3aaf8f3492ed33e1a358be8f4bb0d1794db79aa4fa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 654237 traceresponse 00-17dc8b407ed60db26e8a0ff6812c5f31-c25f2e0e1881fe33-01 x-cache MISS content-length 18806 x-served-by cache-lcy-eglc8600083-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"ddd2-190545adb81" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a0f96d23ff-LHR x-cache-hits 0
GET H2	200	81-2528521366cfa8f4.js Show response www.recordedfuture.com/_next/static/chunks/	11 KB 5 KB	108ms 106ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/81-2528521366cfa8f4.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd0aa2edbf70120a3664d67d62c7be974905b21305d74bf06b58d4570bb81dc7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17dc8b4079a802d741dfb1577b5159df-5e40fdf4b49693ba-01 x-cache MISS content-length 4641 x-served-by cache-lcy-eglc8600055-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"2cc8-190545adb72" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1398b23ff-LHR x-cache-hits 0
GET H2	200	407-b4466bcdd3b591b7.js Show response www.recordedfuture.com/_next/static/chunks/	15 KB 5 KB	108ms 107ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/407-b4466bcdd3b591b7.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 735bd170551339d434d846cfe5c124d1032659b500b6946ab57c8b3143dc2f4b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 654238 traceresponse 00-17d87de899c56fc11a7385ac8e6ba58c-ab39e0b3722a62fe-01 x-cache HIT content-length 5304 x-served-by cache-lcy-eglc8600032-LCY last-modified Wed, 05 Jun 2024 12:55:41 GMT server cloudflare etag W/"3cad-18fe8782f93" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1398c23ff-LHR x-cache-hits 0
GET H2	200	663-c50ba2a51fc25db5.js Show response www.recordedfuture.com/_next/static/chunks/	108 KB 25 KB	109ms 108ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/663-c50ba2a51fc25db5.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 80987f8eff70eb2468bca16c26ab55e6e00378987279673f0eb2cb94751ef75d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 654237 traceresponse 00-17dc8b407f10b22483a75ee195abba65-b4ff7aa4085e2b20-01 x-cache MISS content-length 25865 x-served-by cache-lcy-eglc8600066-LCY last-modified Wed, 26 Jun 2024 11:42:38 GMT server cloudflare etag W/"1afd6-190545adb4e" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1398d23ff-LHR x-cache-hits 0
GET H2	200	267-f70488cb05534dfa.js Show response www.recordedfuture.com/_next/static/chunks/	46 KB 12 KB	109ms 108ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/267-f70488cb05534dfa.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 39a6057a5095b38d5771efe30f0b099cee4b3ce6ea48841c1255a5128cf40b09 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 133505 traceresponse 00-17de64dae32775acb6e5c5fe704f5d7d-8e3a168cb36e94e7-01 x-cache MISS content-length 11949 x-served-by cache-lcy-eglc8600095-LCY last-modified Tue, 02 Jul 2024 12:19:38 GMT server cloudflare etag W/"b6d9-1907362e320" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1398e23ff-LHR x-cache-hits 0
GET H2	200	%5B%5B...slug%5D%5D-4d4201baa6805446.js Show response www.recordedfuture.com/_next/static/chunks/pages/	161 KB 34 KB	108ms 108ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/chunks/pages/%5B%5B...slug%5D%5D-4d4201baa6805446.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a4c0f0d8c0024fd0d67597fd49e4a4c0c1ae699b949c9bce91357817cab0b4e0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 224275 traceresponse 00-17de124ce4cd23eabe33f4afed7b3eab-3d31eebad62d45e5-01 x-cache MISS content-length 34798 x-served-by cache-lcy-eglc8600068-LCY last-modified Mon, 01 Jul 2024 11:07:21 GMT server cloudflare etag W/"28564-1906dfa5882" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1398f23ff-LHR x-cache-hits 0
GET H2	200	_buildManifest.js Show response www.recordedfuture.com/_next/static/uXaOVtDN87yjfjwp8syu6/	2 KB 942 B	108ms 107ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/uXaOVtDN87yjfjwp8syu6/_buildManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f49599d3ea2daface549d6db9070ad1e6c13fd21be8afc0ccd7bc590a5e134bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 133464 traceresponse 00-17de64dae86e9b8bec11e5f7f244472b-8f6fdc38e86f86a3-01 x-cache HIT content-length 729 x-served-by cache-lcy-eglc8600072-LCY last-modified Tue, 02 Jul 2024 12:19:39 GMT server cloudflare etag W/"847-1907362e6ed" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a1399023ff-LHR x-cache-hits 1
GET H2	200	_ssgManifest.js Show response www.recordedfuture.com/_next/static/uXaOVtDN87yjfjwp8syu6/	173 B 283 B	108ms 108ms	Script application/javascript	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/uXaOVtDN87yjfjwp8syu6/_ssgManifest.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 020a19839813fdee2eacf5a88bb1c537c26cb6cffb8cb3fffdbac86d5cf939fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 cf-cache-status HIT age 133464 traceresponse 00-17de64dae7fb934fed066c5d0b061b61-d5532a60f85a45d5-01 content-encoding gzip x-cache HIT x-served-by cache-lcy-eglc8600098-LCY last-modified Tue, 02 Jul 2024 12:19:39 GMT server cloudflare etag W/"ad-1907362e6f9" vary Accept-Encoding content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 89db56a1399123ff-LHR x-cache-hits 1
GET H2	200	insikt_group_logo_updated_3_300x48_b5390f4ff2.png cms.recordedfuture.com/uploads/	2 KB 2 KB	537ms 441ms	Image image/png	151.101.130.216 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://cms.recordedfuture.com/uploads/insikt_group_logo_updated_3_300x48_b5390f4ff2.png Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash a18bee42454d2847fd47b2e4fc37156fe94b9e9263653bdb5d30b0b4e8e04070 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers expires Wed, 03 Jul 2024 20:24:57 GMT date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 varnish strict-transport-security max-age=31557600 x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 fastly-io-served-by vpop-etou8240196 traceresponse 00-17decd722d58f52930376b4b33c8886a-293bbec80f8b7b90-01 age 0 x-cache HIT fastly-io-info ifsz=2186 idim=300x48 ifmt=png ofsz=2186 odim=300x48 ofmt=png fastly-stats io=1 content-length 2186 fastly-io-warning Failed to shrink image x-served-by cache-lcy-eglc8600098-LCY etag "EbYSum01FIklEjAVbBxNbvSeI3ULDZ+M77H+n4IBChg" vary Accept-Encoding content-type image/png cache-control max-age=300 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	16 KB 6 KB	111ms 39ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=880669&u=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&vn=2.1&x=true Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software glon1 / Resource Hash 728bc95a42d7bdb44fb495b61321d94e9b9259e79a35849e162d7d8ed09250a3 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 google server glon1 etag W/"1720017278_EA" vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin https://www.recordedfuture.com cache-control public, max-age=0, no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	x-social-media-black-icon.svg www.recordedfuture.com/images/	456 B 637 B	468ms 468ms	Image image/svg+xml	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://www.recordedfuture.com/images/x-social-media-black-icon.svg Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f8837339f39b4de89bcdc5b4705e44d0007a8728881c70d1010f9973dff06306 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 varnish x-content-type-options nosniff strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 cf-cache-status MISS content-encoding gzip traceresponse 00-17dede4726aebf63c141185330283f5d-0225357cd565ba4c-01 x-cache MISS x-served-by cache-lcy-eglc8600035-LCY last-modified Tue, 02 Jul 2024 12:12:44 GMT server cloudflare etag W/"1c8-190735c8e60" vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 89db56a159a323ff-LHR x-cache-hits 0
GET H2	200	Inter-Regular.86422bf3.ttf www.recordedfuture.com/_next/static/media/	303 KB 144 KB	66ms 65ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Regular.86422bf3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 494a9c8817786531126dd245c93f8a85aa6afa405c7b8a2e45b667538470ce7a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status HIT age 2949624 traceresponse 00-17cfde18f207db5fabec17de0353015f-1c2f10857a7d8fa7-01 x-cache HIT content-length 147167 x-served-by cache-lcy-eglc8600037-LCY last-modified Wed, 15 May 2024 10:01:45 GMT server cloudflare etag W/"4ba44-18f7bb364af" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179af23ff-LHR x-cache-hits 0
GET H2	200	Inter-Bold.0b1aaf81.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	66ms 65ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Bold.0b1aaf81.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ad83f2446566c5ecf7c261cc07884a5d5f71965b5df8fd7bb809f83a42bf470 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 2586148 traceresponse 00-17d49064953b298e8797462ae093df7c-c361c61d567a3ff7-01 x-cache HIT content-length 157388 x-served-by cache-lcy-eglc8600030-LCY last-modified Fri, 31 May 2024 11:43:08 GMT server cloudflare etag W/"4d2c4-18fce75f736" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179b023ff-LHR x-cache-hits 0
GET H2	200	icomoon.ttf www.recordedfuture.com/icons/fonts/	6 KB 3 KB	456ms 455ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/icons/fonts/icomoon.ttf?j8daoh Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cea068537a9ce7722b6a08c23bc67dff6b49a272be984b95c2e9156411d2636 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17dede4727ed5f9f26dc17c70d2fd213-617fc2b742d330a7-01 x-cache MISS content-length 3235 x-served-by cache-lcy-eglc8600021-LCY last-modified Tue, 02 Jul 2024 12:12:44 GMT server cloudflare etag W/"160c-190735c8e60" vary Accept-Encoding content-type font/ttf cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179b123ff-LHR x-cache-hits 0
GET H2	200	Inter-SemiBold.ebaf29e9.ttf www.recordedfuture.com/_next/static/media/	308 KB 153 KB	67ms 66ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-SemiBold.ebaf29e9.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f036a45770ce2ad43dfee7f4eac8f8b3784608a24ff00c63dd56704434e014e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 2949613 traceresponse 00-17d1d42ebf3d6f9ac44a6c6f8af0d39c-26134ba6020e600d-01 x-cache HIT content-length 156755 x-served-by cache-lcy-eglc8600057-LCY last-modified Thu, 16 May 2024 07:29:50 GMT server cloudflare etag W/"4d16c-18f804eac0c" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179b223ff-LHR x-cache-hits 0
GET H2	200	Inter-ExtraBold.d19caa02.ttf www.recordedfuture.com/_next/static/media/	309 KB 154 KB	66ms 66ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-ExtraBold.d19caa02.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6fb3140db2839cabd3662044ef7791206df377b2211046abc71dd039f05fe082 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status HIT age 2949624 traceresponse 00-17cdccbbeadfade93a86dcb3622a7851-ac370ed24d0461d0-01 x-cache HIT content-length 157010 x-served-by cache-lcy-eglc8600082-LCY last-modified Wed, 08 May 2024 13:11:54 GMT server cloudflare etag W/"4d52c-18f5854f625" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179b323ff-LHR x-cache-hits 0
GET H2	200	Inter-Medium.6ee661b3.ttf www.recordedfuture.com/_next/static/media/	307 KB 152 KB	66ms 66ms	Font font/ttf	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/media/Inter-Medium.6ee661b3.ttf Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0b1f949528f7a3a2d2ff3b6df67c6c1b5cb8f62a2eba6eb5e06adff2d5795f3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/_next/static/css/052769b296a78730.css Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status HIT age 24325 traceresponse 00-17da53589e000a4fc3a2a791e1603b99-15ee6b267b39fdee-01 x-cache HIT content-length 155503 x-served-by cache-lcy-eglc8600060-LCY last-modified Fri, 14 Jun 2024 09:31:05 GMT server cloudflare etag W/"4cd58-19016161910" vary Accept-Encoding content-type font/ttf cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a179b423ff-LHR x-cache-hits 0
GET H3	200	worker-7421372a322af9900743df8ca71f196e.js Show response dev.visualwebsiteoptimizer.com/edrv/	258 KB 62 KB	70ms 36ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/worker-7421372a322af9900743df8ca71f196e.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software glon1 / Resource Hash eae7b1f8a152cad212a924f2d046369f419a86b76d02fc67f27ef9f8a9bcff68 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding br via 1.1 google last-modified Wed, 03 Jul 2024 14:34:26 GMT server glon1 etag "66856172-f9d2" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 63954
GET H3	200	va_gq-664f38c97114b4d4870f32407bf28853.js Show response dev.visualwebsiteoptimizer.com/edrv/	263 KB 68 KB	85ms 51ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/va_gq-664f38c97114b4d4870f32407bf28853.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software glon1 / Resource Hash e79e5a1d25a4a67c3c950f7323bd92977296558ad34b4ffe537d056349b3eccf Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding br via 1.1 google last-modified Wed, 03 Jul 2024 14:34:26 GMT server glon1 etag "66856172-11083" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 69763
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 145 B	115ms 114ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=880669&d=recordedfuture.com&u=DB28E5E1C5DDF5E976DBE961A24C59770&h=72f737efae975b370ce6b8ba720be073&t=false Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control public, max-age=43200 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35
GET BLOB	200 OK	f4814d9f-8060-4e5d-a20d-2c9b7013d76e https://www.recordedfuture.com/	259 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.recordedfuture.com/f4814d9f-8060-4e5d-a20d-2c9b7013d76e Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 40de1e313fe47fac985ab6bc5217554089ac8da59c0d0e64b3341863d3a394de Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Length 264748 Content-Type application/javascript
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	111ms 110ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=880669&u=DB28E5E1C5DDF5E976DBE961A24C59770&s=1720056504&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22en-gb%22%2C%22r%22%3A%22https%253A%252F%252Ft.co%252F%22%2C%22lt%22%3A1720056504741%2C%22tO%22%3A-1%2C%22tz%22%3A%22Europe%2FLondon%22%7D&cu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1720056504749&v=423eee90f&_ru=https%3A%2F%2Ft.co%2F Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 google x-content-type-options nosniff server gnv1c content-type image/gif access-control-allow-origin * cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Mon, 10 Jan 2005 00:00:01 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	320 KB 106 KB	199ms 62ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2e28b9587102225add1f2cc697ceaad33a3ae04f7dcac084032306b576dc64fd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 108281 x-xss-protection 0 last-modified Thu, 04 Jul 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	resource-sidebars Show response cms.recordedfuture.com/api/	82 B 824 B	548ms 483ms	XHR application/json	151.101.130.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resource-sidebars?populate[0]=type&populate[1]=blocks&populate[2]=blocks.image&populate[3]=blocks.image.desktop&populate[4]=blocks.image.tablet&populate[5]=blocks.image.mobile&populate[6]=blocks.link&populate[7]=blocks.link.page&filters[type][key][$eq]=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash 6f2a66b7c2567498349c8dc31d361a2208aa2babd36fdaabe7ef20aefe992bd9 Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Thu, 04 Jul 2024 01:28:25 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-permitted-cross-domain-policies none age 0 traceresponse 00-17dede473fd3c10e08c844e2694347c3-a65cd3737633568c-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache MISS via 1.1 varnish content-length 82 x-served-by cache-lcy-eglc8600046-LCY referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H2	200	resources Show response cms.recordedfuture.com/api/	22 KB 22 KB	821ms 757ms	XHR application/json	151.101.130.216 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cms.recordedfuture.com/api/resources?populate[0]=cardImage&populate[1]=cardImage.desktop&populate[2]=cardImage.mobile&populate[3]=cardImage.tablet&populate[4]=countryTags&populate[5]=downloadResource&populate[6]=downloadResource.type&populate[7]=eventResource&populate[8]=eventResource.type&populate[9]=industryTags&populate[10]=integrationResource&populate[11]=integrationResource.tags&populate[12]=newsAndResearchResource&populate[13]=newsAndResearchResource.researchPreviewImage&populate[14]=newsAndResearchResource.researchPreviewImageDesktop&populate[15]=newsAndResearchResource.researchPreviewImageMobile&populate[16]=newsAndResearchResource.researchPreviewImageTablet&populate[17]=newsAndResearchResource.type&populate[18]=page&populate[19]=productTags&populate[20]=threatTags&populate[21]=topicTags&populate[22]=language&filters[$or][0][downloadResource][type][key][$in]=&filters[$or][1][eventResource][type][key][$in]=&filters[$or][2][newsAndResearchResource][type][key][$in][0]=research&filters[$and][1][$or][0][showFrom][$null]=true&filters[$and][1][$or][1][showFrom][$lte]=2024-07-04T01%3A28%3A24Z&pagination%5BpageSize%5D=4&pagination%5Bpage%5D=1&sort%5B0%5D=eventResource.startDate%3Aasc&sort%5B1%5D=publishedAt%3Adesc Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/911-ff01f8a62625f045.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.130.216 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Strapi <strapi.io> Resource Hash d5b8cb7c7d7a9dc728856756f232e296449bb9dfd14d0c9186f4d511766d3ed9 Security Headers Name Value Content-Security-Policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' Strict-Transport-Security max-age=31557600 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept application/json, text/plain, */* Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy connect-src 'self' https:;img-src 'self' data: blob: https://market-assets.strapi.io;media-src 'self' data: blob:;default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline' date Thu, 04 Jul 2024 01:28:25 GMT x-content-type-options nosniff strict-transport-security max-age=31557600 x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-permitted-cross-domain-policies none age 0 traceresponse 00-17dede473ffd4ccb91b5f96e81220717-a9ea108a4884c17d-01 x-powered-by Strapi <strapi.io> x-dns-prefetch-control off x-cache MISS via 1.1 varnish content-length 22273 x-served-by cache-lcy-eglc8600046-LCY referrer-policy no-referrer x-download-options noopen x-frame-options SAMEORIGIN vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes x-cache-hits 0
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/	34 KB 8 KB	37ms 37ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=880669&settings_type=1&vn=&eventArch=1&uuid= Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software glon1 / Resource Hash 707accc754dc4a7c823d01b409c64232fc9ce19c0b3036844e3ded15c57f5510 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip via 1.1 google server glon1 etag W/"1720017278_EA" content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	blog.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	46 KB 8 KB	480ms 479ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/blog.json?slug=blog Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224cc14c4a682bde74fe3870d2139a96216d186d6e710d29721bd91019f9c34b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec68c7de92ee577f4ef32cce9c2ad-135cdb7a7928ac54-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 7982 x-served-by cache-lcy-eglc8600032-LCY server cloudflare etag "oi67649tzi106o" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a41b4c23ff-LHR x-cache-hits 0
GET H2	200	careers.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	81 KB 14 KB	385ms 384ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/careers.json?slug=careers Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3ff1a3187d0387f041f31e8bf1b60a48629eaf43f0ad66896b6d148553a82e7b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec6fd13c8c578fd0d9007c29d6e35-c19531c544d71e1a-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 13975 x-served-by cache-lcy-eglc8600044-LCY server cloudflare etag "e3oi0pmfzs1rmr" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b4e23ff-LHR x-cache-hits 0
GET H2	200	contact.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	55 KB 10 KB	391ms 390ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/contact.json?slug=contact Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17e7907f3499ab1dced9cb081f6759eb0464fd4519d7e1758303237444e510e8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec6a0d414462bee843b8d40ec2265-552b18490841f6b8-01 via 1.1 varnish x-cache HIT x-nextjs-cache HIT content-length 10191 x-served-by cache-lcy-eglc8600086-LCY server cloudflare etag "127yzv3j3mb173m" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b4f23ff-LHR x-cache-hits 0
GET H2	200	index.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	149 KB 22 KB	121ms 121ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/index.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 95737ccf96930768f725727224fddaac462468168f17ac3672b76ce78288f6fb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 3266 traceresponse 00-17dec8277e0894b999a73eb14401c695-570ed037dbd5e43b-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 22344 x-served-by cache-lcy-eglc8600026-LCY server cloudflare etag "1qhtgevzh739p3" vary Accept-Encoding content-type application/json x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5023ff-LHR x-cache-hits 0
GET H2	200	intelligence-cloud.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/platform/	77 KB 13 KB	502ms 501ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/platform/intelligence-cloud.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash edd0eb8c37c783aceafeaafe8e68b092f19e6849c6af713e738dc7f1dccaabf6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17ded014b31bfebc5aee9cf0a06261e3-9ee888dcaa16534f-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 13525 x-served-by cache-lcy-eglc8600037-LCY server cloudflare etag "imm0cg43u11p39" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5123ff-LHR x-cache-hits 0
GET H2	200	solutions.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	81 KB 14 KB	393ms 392ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/solutions.json?slug=solutions Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8af9667e4b92e23dd01bda0acabc12ffbdec5a308dc8723bb7f8534ffe8704f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec6fd1390b284ccfd06a6dcffffd0-78eb94bc8c75031d-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 13816 x-served-by cache-lcy-eglc8600033-LCY server cloudflare etag "7toqh2ef1w1s1p" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5223ff-LHR x-cache-hits 0
GET H2	200	client-success.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/services-support/	53 KB 10 KB	481ms 481ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/services-support/client-success.json Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cfb248d1453cc818d07f1fea3237c99b8bcdd932b085e0535c096fac1ba5b348 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec68c84f8de740cc94ac05d920767-7de976a1a3496906-01 via 1.1 varnish x-cache HIT x-nextjs-cache HIT content-length 9779 x-served-by cache-lcy-eglc8600080-LCY server cloudflare etag "h0261bsbkg15mx" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5323ff-LHR x-cache-hits 0
GET H2	200	research.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	104 KB 16 KB	479ms 478ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/research.json?slug=research Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c6deadaaf1092c3b8e4d29388bfa7357cd28e02147627c67a00688589cf9e5a3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-bac7380798664d7697b0cf11d33520e7, i-bac7380798664d7697b0cf11d33520e7 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec7523c3574d99aa6dafc1250f56e-0f6fdb75848812ef-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 16349 x-served-by cache-lcy-eglc8600039-LCY server cloudflare etag "u91lmc2evc2ahk" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5423ff-LHR x-cache-hits 0
GET H2	200	resources.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	59 KB 10 KB	394ms 393ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/resources.json?slug=resources Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 18e50d601dfe031148072f2594202cecad00bef032b3477ff54d76d0800948c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec7914c3cfbf54d14a4f4ba780773-1986e1b22665e727-01 via 1.1 varnish x-cache HIT x-nextjs-cache STALE content-length 10222 x-served-by cache-lcy-eglc8600075-LCY server cloudflare etag "15lo2v2zfkn1azc" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5523ff-LHR x-cache-hits 0
GET H2	200	company.json Show response www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/	52 KB 10 KB	487ms 486ms	Fetch application/json	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/data/uXaOVtDN87yjfjwp8syu6/company.json?slug=company Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67fe4a4d1fe0598225b08e4157f69b15741162ab98bcdcfc59dfe52824bdbbd2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" purpose prefetch x-nextjs-data 1 Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-nextjs-matched-path /[[...slug]] strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-be21b5795622437d8136c8a0cedbd8d0, i-be21b5795622437d8136c8a0cedbd8d0 x-content-type-options nosniff cf-cache-status DYNAMIC age 0 traceresponse 00-17dec75236c60eafa0276eed3a5d2388-2e4886aa7c31e1d4-01 via 1.1 varnish x-cache HIT x-nextjs-cache HIT content-length 9664 x-served-by cache-lcy-eglc8600076-LCY server cloudflare etag "11h0on4vycn14um" vary Accept-Encoding content-type application/json cache-control s-maxage=30, stale-while-revalidate x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56a42b5623ff-LHR x-cache-hits 0
GET H2	200	583c733c0bc9b81b.css Show response www.recordedfuture.com/_next/static/css/	24 KB 0	0ms 0ms	Fetch text/css	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/_next/static/css/583c733c0bc9b81b.css Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/_next/static/chunks/main-75bdb96a41ba80f4.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f524f47ebbba0a65428e675b4f08da41e6b9b4889ad71fae08170e801d0bd614 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT via 1.1 varnish x-content-type-options nosniff cf-cache-status HIT x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 age 1269867 traceresponse 00-17da5b2b24a0b01680202b5b0e9c9be6-5e7fe4d161abe650-01 cf-polished origSize=24391 content-encoding gzip x-cache HIT x-served-by cache-lcy-eglc8600021-LCY cf-bgj minify last-modified Wed, 19 Jun 2024 08:36:14 GMT server cloudflare etag W/"5f47-1902fa3ae4a" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control public, max-age=31536000, immutable x-debug-info eyJyZXRyaWVzIjowfQ== cf-ray 89db56a0e96023ff-LHR x-cache-hits 0
GET H2	200	64dc3ec5-330c-4652-88d3-147ee65e90ba.js Show response j.6sc.co/j/	6 KB 2 KB	537ms 436ms	Script application/javascript	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9a73601ec1d6e441ee47efbe510855a822e6d855fa36728d42ff8db3ca13edb9 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-amz-version-id 3w5hm63GPAfRo68wp1nEVb5uiedjUjtH content-encoding gzip date Thu, 04 Jul 2024 01:28:25 GMT x-amz-cf-pop FRA60-P8 x-amz-server-side-encryption AES256 x-amz-meta-content-type application/json content-length 1962 pragma no-cache last-modified Thu, 28 Mar 2024 14:04:56 GMT server AmazonS3 etag "7d2aaf9fa96d19c8ff79cd758e1347b6" vary Accept-Encoding content-type application/javascript cache-control max-age=0, no-cache, no-store accept-ranges bytes x-amz-cf-id OTdlyQhHD54PpblV7sA2X82sEE84Fq18RJX4JQezRCStlGSe6ikwag== expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	320 KB 105 KB	73ms 72ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9b7be9efff838d2c9ce5aab5005dca41d574da601585c4041bf8444cbc0a2680 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 107429 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	270 KB 93 KB	62ms 61ms	Script application/javascript	2a00:1450:4001:830::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 0ef1233cb9ba35aa3d7b53742090ca2588482bb5e5bb388a1fbfeb668cf1ea41 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 95077 x-xss-protection 0 last-modified Thu, 04 Jul 2024 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	149ms 43ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip last-modified Fri, 22 Mar 2024 21:07:24 GMT x-amz-server-side-encryption AES256 etag "bbbcf811d8437a575d796a4c1e5d4fad+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15412 x-served-by cache-iad-kiad7000168-IAD, cache-fra-etou8220036-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	38 KB 14 KB	149ms 46ms	Script application/javascript	2a02:26f0:3500:10::210:a99 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 942a9ba1fe78b402e8b52b83058dbbabde8db6b4d1debf960d6d5afe5192db52 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 18 Jun 2024 16:46:52 GMT x-cdn AKAM x-amz-server-side-encryption AES256 vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control max-age=17135 accept-ranges bytes content-length 14004
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	136ms 43ms	Script text/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 04 Jul 2024 00:51:36 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT server Golfe2 age 2209 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 17168 expires Thu, 04 Jul 2024 02:51:36 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	141ms 45ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Wed, 03 Jul 2024 06:17:58 GMT content-encoding gzip x-content-type-options nosniff age 69027 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 03 Jul 2025 06:17:58 GMT
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	222 KB 59 KB	127ms 42ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 63bae03aa97278acb1d6f7863e593999bbdc5d280d2fa5a3050f234ce5eee850 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' 'unsafe-eval' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 04 Jul 2024 01:28:25 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 58293 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=40, rtx=0, c=12, mss=1297, tbw=2769, tp=-1, tpl=-1, uplat=0, ullat=-1 pragma public x-fb-debug VwVHRhztPbzj8oCZyIFM6k6vzJmfcViYUHHgnzxqD7He9IuUKGNrqOTXWH0lJXv5q/tae7KVCCy6C48gTVxNIg== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	container_nbhoRDM8.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	245 KB 70 KB	239ms 127ms	Script application/javascript	2600:9000:26db:bc00:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/container_nbhoRDM8.js Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26db:bc00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash f4f166786bcc7e3bf5c9e81f67543f21c360c01e444ed0b9ae2fbb6a627a8463 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 00:23:55 GMT content-encoding gzip via 1.1 3346ad1679ff01fe81e117084323b814.cloudfront.net (CloudFront) x-amz-version-id eLUQFaKj6d49XWuPagkqMFVLyDVfvoR_ last-modified Fri, 21 Jun 2024 17:05:31 GMT server CloudFront strict-transport-security max-age=31536000 x-amz-cf-pop MUC50-P3 age 3871 etag W/"01925612e76ab7279832176ad15f8bb5" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id wXqo5lMcIHBnuQOx6uEa34rwVuuqZ4xvZpxAroyvdrV4vaUIlPeWUQ==
GET H2	200	matomo.js Show response cdn.matomo.cloud/recordedfuture.matomo.cloud/	202 KB 59 KB	170ms 58ms	Script application/javascript	2600:9000:26db:bc00:c:7d55:b3c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:26db:bc00:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software CloudFront / Resource Hash 7d1e4da46e65ade35e0017500907b2d3bc738bb33b10266f679f2113cc56861c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 00:23:55 GMT x-amz-version-id nUcBrzhVy9JMMaAtFkxpvW8b5Jy3nYQT content-encoding gzip strict-transport-security max-age=31536000 via 1.1 3346ad1679ff01fe81e117084323b814.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-P3 age 3871 x-cache Hit from cloudfront x-amz-replication-status FAILED last-modified Mon, 29 Apr 2024 00:09:25 GMT server CloudFront etag W/"5c359e1fa9398dc7248bc8740cc8eb49" vary Accept-Encoding content-type application/javascript; charset=utf-8 cache-control max-age=691200 x-amz-cf-id 8hn9T41jwmEspY15Mz_3lbQlIdRsH-64PTLTZHn-x8y3pG63C7BPZA==
GET H2	200	252628.js Show response js.hs-scripts.com/	2 KB 1 KB	118ms 44ms	Script application/javascript	2606:4700::6810:89d1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-scripts.com/252628.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-539N74N Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 26265c96c3d050f4862bd4c12b95141b60541653f56b7f47c328c1ffd25e3299 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT x-hubspot-correlation-id 18f178d6-7373-4c76-bbfc-46e380b9fb80 x-evy-trace-route-service-name envoyset-translator cf-polished origSize=2007 age 73 x-envoy-upstream-service-time 12 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 18f178d6-7373-4c76-bbfc-46e380b9fb80 cf-bgj minify last-modified Thu, 04 Jul 2024 01:27:12 GMT server cloudflare access-control-max-age 3600 vary origin, Accept-Encoding content-type application/javascript;charset=utf-8 access-control-allow-origin https://therecord.media x-evy-trace-served-by-pod iad02/hubapi-td/envoy-proxy-7dd59b876-l4ql2 x-evy-trace-virtual-host all access-control-allow-credentials true cache-control public, max-age=90 cf-ray 89db56a60d099529-LHR expires Thu, 04 Jul 2024 01:29:55 GMT
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/	4 KB 2 KB	180ms 59ms	Script text/javascript	142.250.184.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1003136084/?random=1720056505312&cv=11&fst=1720056505312&bg=ffffff&guid=ON&async=1&gtm=45be4730v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&ref=https%3A%2F%2Ft.co%2F&hn=www.googleadservices.com&frm=0&tiba=Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&npa=0&pscdl=noapi&auid=2147244238.1720056505&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-1003136084&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.184.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f2.1e100.net Software cafe / Resource Hash e3b3f028299e4733e07b104d342825872091eef3d238165cd4dce7c0b5301f62 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 1552 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect region1.analytics.google.com/g/	0 0	140ms 40ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-MHTMF48BZH&gtm=45je4730v873499763z8830966511za200zb830966511&_p=1720056504860&_gaz=1&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=0&cid=859320873.1720056505&ul=en-gb&sr=1600x1200&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1720056505&sct=1&seg=0&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&dr=https%3A%2F%2Ft.co%2F&dt=Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1475&_z=fetch Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 259 B	138ms 39ms	Ping text/plain	2a00:1450:400c:c0b::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-MHTMF48BZH&cid=859320873.1720056505&gtm=45je4730v873499763z8830966511za200zb830966511&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-MHTMF48BZH&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.recordedfuture.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.co.uk/ads/	42 B 63 B	132ms 52ms	Image image/gif	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.co.uk/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-MHTMF48BZH&cid=859320873.1720056505&gtm=45je4730v873499763z8830966511za200zb830966511&aip=1&dma=0&gcd=13l3l3l3l1&npa=0&frm=0&z=1404019930 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 197 B	82ms 52ms	Image image/gif	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=754512073&utmhn=www.recordedfuture.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-gb&utmje=0&utmfl=-&utmdt=Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&utmhid=465261208&utmr=https%3A%2F%2Ft.co%2F&utmp=%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&utmht=1720056505402&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D93161374.859320873.1720056505.1720056505.1720056505.1%3B%2B__utmz%3D93161374.1720056505.1.1.utmcsr%3Dt.co%7Cutmccn%3D(referral)%7Cutmcmd%3Dreferral%7Cutmcct%3D%2F%3B&utmjid=1405214214&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 376 B	266ms 144ms	Image image/gif	93.184.221.165 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=05ef6239-a0d2-494c-9c7b-5ff85d1d2940&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=869602cd-4d83-4ba2-929f-bf8f5dbffb4d&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.221.165 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 106 date Thu, 04 Jul 2024 01:28:24 GMT strict-transport-security max-age=0 server tsa_f content-type image/gif;charset=utf-8 x-transaction-id 02c83ebd269fc67d cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash 3f62c35a404390f033a915c0bb872b28c32bbc64a8b120eacbd107d842d66f22 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 391 B	244ms 144ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=05ef6239-a0d2-494c-9c7b-5ff85d1d2940&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=869602cd-4d83-4ba2-929f-bf8f5dbffb4d&tw_document_href=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nv0r6&type=javascript&version=2.3.30 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-response-time 112 date Thu, 04 Jul 2024 01:28:25 GMT strict-transport-security max-age=631138519 server tsa_f content-type image/gif;charset=utf-8 x-transaction-id 8211a0c7a6d0f06a cache-control no-cache, no-store, max-age=0 perf 7402827104 x-connection-hash c5903ca10ab819ea5e760f6c261570fce142158b81aa006ed4c00a37131dcaa7 content-length 43
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 446 B	294ms 195ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept * Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 133C4F60297F4E0B897F67E9CB67D384 Ref B: LON04EDGE1122 Ref C: 2024-07-04T01:28:25Z linkedin-action 1 vary Origin x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 access-control-allow-origin https://www.recordedfuture.com x-li-proto http/2 access-control-allow-credentials true x-li-uuid AAYcYd0CZ9zEh2lADFZLQQ==
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 812 B	211ms 131ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept * Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:24 GMT content-encoding gzip x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: 10F0B5C5068A4D2D8C47931B99A3004A Ref B: LON04EDGE0619 Ref C: 2024-07-04T01:28:25Z access-control-allow-methods GET, OPTIONS x-li-fabric prod-lva1 access-control-allow-origin * x-cache CONFIG_NOCACHE content-type application/json x-li-proto http/2 x-restli-protocol-version 1.0.0 access-control-allow-headers * x-li-uuid AAYcYd0CDoRNbijL9rN6Eg== x-fs-uuid 00061c61dd020e844d6e28cbf6b37a12
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&t...	0 263 B	236ms 165ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm=gtmv2&e_ipv6=AQIky8U0w6SSBQAAAZB7W2T_Q8qK-LsvNAt_X-CresPdZNUyOzdu0dIlzCXyRTkntls Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language en-GB,en;q=0.9;q=0.9 Referer https://www.recordedfuture.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers date Thu, 04 Jul 2024 01:28:25 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 1602FC19C21D444482D02749AAE56A93 Ref B: LTSEDGE1008 Ref C: 2024-07-04T01:28:25Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAYcYd0GBGgHb/9GaL2unw== Redirect headers date Thu, 04 Jul 2024 01:28:25 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 609EAE7C6A1444B0AD0BC72E3813E3B3 Ref B: LON04EDGE1122 Ref C: 2024-07-04T01:28:25Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3869953%2C26800&time=1720056505418&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&tm=gtmv2&e_ipv6=AQIky8U0w6SSBQAAAZB7W2T_Q8qK-LsvNAt_X-CresPdZNUyOzdu0dIlzCXyRTkntls x-li-proto http/2 content-length 0 x-li-uuid AAYcYd0CZ8Fd/xgHRAz0mA==
GET H2	200	194163687656043 Show response connect.facebook.net/signals/config/	70 KB 15 KB	178ms 177ms	Script application/x-javascript	2a03:2880:f084:105:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/194163687656043?v=2.9.160&r=stable&domain=www.recordedfuture.com&hme=733c3732ec767f7a62e7787aff967e6d19b1e13e533937876f2e15efe07bf678&ex_m=67%2C113%2C100%2C104%2C58%2C3%2C93%2C66%2C15%2C91%2C84%2C49%2C51%2C160%2C163%2C175%2C171%2C172%2C174%2C28%2C94%2C50%2C73%2C173%2C155%2C158%2C168%2C169%2C176%2C122%2C39%2C33%2C134%2C14%2C48%2C181%2C180%2C124%2C17%2C38%2C1%2C41%2C62%2C63%2C64%2C68%2C88%2C16%2C13%2C90%2C87%2C86%2C101%2C103%2C37%2C102%2C29%2C25%2C156%2C159%2C131%2C27%2C10%2C11%2C12%2C5%2C6%2C24%2C21%2C22%2C54%2C59%2C61%2C71%2C95%2C26%2C72%2C8%2C7%2C76%2C46%2C20%2C97%2C96%2C98%2C9%2C19%2C18%2C81%2C53%2C79%2C32%2C70%2C0%2C89%2C31%2C78%2C83%2C45%2C44%2C82%2C36%2C4%2C85%2C77%2C42%2C34%2C80%2C2%2C35%2C60%2C40%2C99%2C43%2C75%2C65%2C105%2C57%2C56%2C30%2C92%2C55%2C52%2C47%2C74%2C69%2C23%2C106 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 979396d43e8f2ec3f8fc11ef079bbff716312df1b66c3c26b1ff0e905049d3c4 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src *.fbcdn.net *.facebook.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 04 Jul 2024 01:28:25 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality GOOD; q=0.7, rtt=51, rtx=0, c=65, mss=1297, tbw=63795, tp=-1, tpl=-1, uplat=134, ullat=0 pragma public x-fb-debug Ax/mbEmevRsx5GwBEFizhI9/q2vNEE8fLqeGpz0/83cdHAhcRd1twmG+kedjT92HbjsCtytvKvy2+bX+l7aT4g== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type application/x-javascript; charset=utf-8 x-frame-options DENY origin-agent-cluster ?0 cache-control public, max-age=1200 permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), battery=(self), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" timing-allow-origin * expires Sat, 01 Jan 2000 00:00:00 GMT
POST H2	204	matomo.php recordedfuture.matomo.cloud/	0 173 B	192ms 91ms	Ping text/plain	3.126.133.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/matomo.php?action_name=www.recordedfuture.com%2FCaught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&idsite=1&rec=1&r=102610&h=2&m=28&s=25&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&urlref=https%3A%2F%2Ft.co%2F&_id=&_idn=1&send_image=0&_refts=1720056505&_ref=https%3A%2F%2Ft.co%2F&pv_id=Xd6aLS&pf_net=103&pf_srv=436&pf_tfr=7&pf_dm1=19&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Not%2FA)Brand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22126.0.6478.126%22%7D%2C%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22126.0.6478.126%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200 Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.126.133.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-133-169.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=utf-8 Response headers access-control-allow-origin https://www.recordedfuture.com date Thu, 04 Jul 2024 01:28:25 GMT access-control-allow-credentials true server Apache vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent
GET H2	200	configs.php Show response recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/	116 B 291 B	144ms 57ms	Script application/javascript	3.126.133.169 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://recordedfuture.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=0qN4Ah&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Requested by Host: cdn.matomo.cloud URL: https://cdn.matomo.cloud/recordedfuture.matomo.cloud/matomo.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.126.133.169 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-126-133-169.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash af770d427da91d89a2441f35f51fefcdeeae6fcf00fdbfd84d066cc8f971553b Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip server Apache content-length 119 vary X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent content-type application/javascript
GET H3	200	/ www.google.com/pagead/1p-user-list/1003136084/	42 B 64 B	141ms 54ms	Image image/gif	142.250.186.100 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1003136084/?random=1720056505312&cv=11&fst=1720054800000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&ref=https%3A%2F%2Ft.co%2F&hn=www.googleadservices.com&frm=0&tiba=Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&npa=0&pscdl=noapi&auid=2147244238.1720056505&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDaQooLoG1PluhpA3qkgXbZ6Gc82FX6mRufUw&random=2281248157&rmt_tld=0&ipr=y Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f4.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.co.uk/pagead/1p-user-list/1003136084/	42 B 64 B	53ms 53ms	Image image/gif	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.co.uk/pagead/1p-user-list/1003136084/?random=1720056505312&cv=11&fst=1720054800000&bg=ffffff&guid=ON&async=1&gtm=45be4730v9185284645z8830966511za200zb830966511&gcd=13l3l3l3l1&dma=0&tag_exp=0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&ref=https%3A%2F%2Ft.co%2F&hn=www.googleadservices.com&frm=0&tiba=Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future&npa=0&pscdl=noapi&auid=2147244238.1720056505&uaa=x86&uab=64&uafvl=Not%252FA)Brand%3B8.0.0.0%7CChromium%3B126.0.6478.126%7CGoogle%2520Chrome%3B126.0.6478.126&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&fdr=QA&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSGwDaQooLoG1PluhpA3qkgXbZ6Gc82FX6mRufUw&random=2281248157&rmt_tld=1&ipr=y Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	0 274 B	132ms 42ms	Image text/plain	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1720056505677&sw=1600&sh=1200&v=2.9.160&r=stable&ec=0&o=4126&fbp=fb.1.1720056505675.622299837118074250&cs_est=true&ler=other&cdl=API_unavailable&it=1720056505458&coo=false&rqm=GET Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-fb-connection-quality EXCELLENT; q=0.9, rtt=41, rtx=0, c=10, mss=1297, tbw=2773, tp=-1, tpl=-1, uplat=0, ullat=0 strict-transport-security max-age=31536000; includeSubDomains date Thu, 04 Jul 2024 01:28:25 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 3 KB	330ms 240ms	Image image/png	2a03:2880:f177:185:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=194163687656043&ev=PageView&dl=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1720056505677&sw=1600&sh=1200&v=2.9.160&r=stable&ec=0&o=4126&fbp=fb.1.1720056505675.622299837118074250&cs_est=true&ler=other&cdl=API_unavailable&it=1720056505458&coo=false&rqm=FGET Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0xcf00d931e065a430","source_keys":["1","2"]},{"key_piece":"0x9167bbb7805ac3d9","source_keys":["1","2"]}],"aggregatable_values":{"1":1}} content-encoding zstd x-content-type-options nosniff content-security-policy default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; strict-transport-security max-age=15552000; preload document-policy force-load-at-top date Thu, 04 Jul 2024 01:28:25 GMT cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-xss-protection 0 reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7387586436525554356", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" x-fb-connection-quality EXCELLENT; q=0.9, rtt=41, rtx=0, c=10, mss=1297, tbw=3091, tp=-1, tpl=-1, uplat=198, ullat=0 pragma no-cache x-fb-debug lv1qBLhnr8WbXBHGSd3uWmeoqo+3TUIOFUynVR0ZuJYz8AZlHhyfqqZbuui7ftQdvUT4Zj6VRJzHV+Z+kJFF1A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" vary Accept-Encoding report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7387586436525554356"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} content-type image/png x-frame-options DENY origin-agent-cluster ?0 cache-control private, no-store, no-cache, must-revalidate permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), battery=(self), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), usb-unrestricted=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	66 KB 18 KB	42ms 42ms	Script application/javascript	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/64dc3ec5-330c-4652-88d3-147ee65e90ba.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 4d3dab569c7b9e24ba3484873769a6b4a34bd3ab4ef6ff53b1c5a5c60f7d5663 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 14 Jun 2024 00:42:44 GMT server nginx/1.14.0 (Ubuntu) etag "666b9204-10980" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 18315 expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	252628.js Show response js.hs-banner.com/	62 KB 19 KB	112ms 40ms	Script text/javascript	2606:4700:4400::6812:22e5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:22e5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfb12bb49b914abebe510f3db1d251c4f716a6bc7d756d3cec1e86a3ff5c22d2 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT x-amz-version-id bPQ5w41eGU7xVs8LqFVUPJz9uqRHGODn content-encoding gzip cf-cache-status HIT x-amz-request-id RABDVTPYSFEKBW5Q x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id f982d0bd-d0ad-4aad-acb7-af09570114ae age 72 x-envoy-upstream-service-time 22 x-amz-id-2 kYbexiZQjCogTAl7eKFbtbxLh8CIMLN5TUeNPMy4m+RMtnARErKjBT7YOMLrNPeqPFS5qZ3IZgU= x-evy-trace-listener listener_https x-request-id f982d0bd-d0ad-4aad-acb7-af09570114ae x-evy-trace-route-configuration listener_https/all last-modified Thu, 06 Jun 2024 18:54:42 GMT server cloudflare etag W/"c52f58bd4ec4f3ccbcb2164c8210fcc7" access-control-max-age 604800 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type text/javascript; charset=UTF-8 access-control-allow-origin https://securitytrails.com x-evy-trace-virtual-host all access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing cache-control max-age=300,public access-control-allow-credentials true x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-78cb6f459b-2r68v vary origin, Accept-Encoding timing-allow-origin * access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id cf-ray 89db56a97ad84141-LHR expires Thu, 04 Jul 2024 01:32:13 GMT
GET H2	200	leadflows.js Show response js.hsleadflows.net/	551 KB 92 KB	120ms 40ms	Script application/javascript	2606:4700::6812:8a11 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hsleadflows.net/leadflows.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:8a11 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dd26d9d88899d0587c9377964b7d1ab478a318b0fdbee7b9d6a084e4aa6425f7 Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding gzip age 24325 x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js&cfRay=89d904c56c6c531c-LHR x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"be45bdb720f44c8db4ee42bc228ff2a8" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control s-maxage=86400, max-age=0 x-hs-target-asset lead-flows-js/static-1.1355/bundle/main/lead-flows-release.js date Thu, 04 Jul 2024 01:28:25 GMT x-amz-version-id HLkmxotJV8gQ_mnvhNwLT9fnVmh1uWjb x-content-type-options nosniff cf-cache-status HIT via 1.1 16df6ade68382d048f8aad1f7e39da28.cloudfront.net (CloudFront) x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 9f3e7968-cdbe-4f15-bdbe-276bf864e240 x-cache Hit from cloudfront cache-tag staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod x-envoy-upstream-service-time 11 x-evy-trace-route-configuration listener_https/all x-request-id 9f3e7968-cdbe-4f15-bdbe-276bf864e240 last-modified Thu, 30 May 2024 10:22:15 UTC server cloudflare access-control-max-age 3000 x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-65f7f7c749-th2td cf-ray 89db56a98d009571-LHR x-amz-cf-id 5F42o3r1dUC7y3iQ6o9MaQ4pCv865FeS99RGdQkp4R8EjvB3ZYTsdw==
GET H2	200	web-interactives-embed.js Show response js.hubspot.com/	82 KB 24 KB	211ms 133ms	Script application/javascript	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hubspot.com/web-interactives-embed.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ab1fca31f7e7a89c198881e69c42c6bb3578b7d55f2cee7463b96360feaf7eaa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Origin https://www.recordedfuture.com Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-encoding gzip x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1194/bundles/project.js&cfRay=89db56a9883371bd-LHR x-amz-replication-status COMPLETED x-evy-trace-listener listener_https etag W/"50f2e99c1f025777ca05bdae3cfcf91d" vary Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods GET content-type application/javascript; charset=utf-8 access-control-allow-origin * x-evy-trace-virtual-host all cache-control max-age=600 x-hs-target-asset web-interactives-embed/static-2.1194/bundles/project.js date Thu, 04 Jul 2024 01:28:25 GMT x-amz-version-id MDb_7hFyElKIrRJmReYAEj96Es7nef4a x-content-type-options nosniff cf-cache-status EXPIRED via 1.1 53b70ac9dc46d1c13992b291cf22a9aa.cloudfront.net (CloudFront) nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-amz-cf-pop IAD12-P3 x-hubspot-correlation-id 664e5639-885f-4489-9b90-47b94d4bea66 x-cache Hit from cloudfront cache-tag staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod x-envoy-upstream-service-time 6 x-evy-trace-route-configuration listener_https/all x-request-id 664e5639-885f-4489-9b90-47b94d4bea66 last-modified Thu, 20 Jun 2024 14:37:30 UTC server cloudflare access-control-max-age 3000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b5CByulfPIv%2Fc72YdmoSmz6AE%2BHlRsvwxIaz%2FjpNKn2r%2FQErUWw27RJ2WD%2BK6vY%2FPra6eR%2B9SL5P4e946ke6uAo9X3VzLO5BkKA1qw%2FQaDrFk8fiCkClUGjp5YHWL34tgWiDLrQWTfhwFkeZ"}],"group":"cf-nel","max_age":604800} x-hs-cache-status MISS x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-65f7f7c749-5bdqs cf-ray 89db56a9883371bd-LHR x-amz-cf-id aC1_3YLu5CsD75M28W_NLvmbCZ5P7yU2vLMyFDrUmqG7jtg9OyzNtQ==
GET H2	200	252628.js Show response js.hs-analytics.net/analytics/1720056300000/	68 KB 25 KB	120ms 42ms	Script text/javascript	2606:4700::6811:afc9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1720056300000/252628.js Requested by Host: js.hs-scripts.com URL: https://js.hs-scripts.com/252628.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:afc9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ac619be83a8ae851e711f9d6ced973ed413c09dec1fd1130b0d78f90e1611d5b Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT x-amz-version-id null content-encoding gzip cf-cache-status HIT x-amz-request-id VKNEMD09BDG29HVE x-evy-trace-route-service-name envoyset-translator x-amz-server-side-encryption AES256 x-hubspot-correlation-id aa7368f5-beba-42a1-9537-6a41ef7ea651 age 72 x-envoy-upstream-service-time 22 x-amz-id-2 lGgd9RhEchl7OjT/WwbDOywt+npsyq/nym9F28bXCXjckmRbzhE2ssvKGefGGk/+GAqKqfKMTzzKAJaJ8OhFhwqxqQp3kJUNOjjdgAkx64A= x-evy-trace-listener listener_https x-request-id aa7368f5-beba-42a1-9537-6a41ef7ea651 x-evy-trace-route-configuration listener_https/all last-modified Wed, 26 Jun 2024 15:57:50 GMT server cloudflare etag W/"c0dae186acbb36363b995450e08debf9" vary origin, Accept-Encoding content-type text/javascript x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-zmwrp cache-control max-age=300,public access-control-allow-credentials false cf-ray 89db56a98ce43859-LHR expires Thu, 04 Jul 2024 01:32:13 GMT
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 707 B	172ms 37ms	XHR application/json	185.89.210.180 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.180 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT an-x-request-uuid 5f15b79a-3c03-402c-9303-270312b91f75 server nginx/1.23.4 accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" content-type application/json; charset=utf-8 access-control-allow-origin https://www.recordedfuture.com cache-control no-store, no-cache, private access-control-allow-credentials true x-proxy-origin 217.138.196.100; 217.138.196.100; 958.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com content-length 11 x-xss-protection 0 expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 198 B	59ms 42ms	XHR text/html	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://www.recordedfuture.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	16 B 307 B	146ms 43ms	XHR text/html	2a02:26f0:ab00::214:8e70 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ab00::214:8e70 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash e42cfd64d75ad6b477ef8b4e371159648ea399a7b426f5b0992d7edf32008ad2 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:25 GMT vary Origin content-type text/html access-control-allow-origin https://www.recordedfuture.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:ac8:21:e::3 server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1720056505886_34901612_63470751_25_953_41_44_219";dur=1 content-length 16 expires Thu, 04 Jul 2024 01:28:25 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	166ms 138ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A21%3Ae%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:26 GMT x-content-type-options nosniff last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:26 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	749 B 724 B	144ms 52ms	XHR application/json	52.59.167.42 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.59.167.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-59-167-42.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash 1264087bbd4672bbcea47f3cdc8b6b6894a96909638e499738c6894b7e303909 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 Authorization Token 47c555096cc32557d3e6e7a333d7cb3ea692cee1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 X-6s-CustomID WebTag 64dc3ec5-330c-4652-88d3-147ee65e90ba Referer https://www.recordedfuture.com/ sec-ch-ua-platform "Win32" Response headers x-trace-id 3506584068662044601 date Thu, 04 Jul 2024 01:28:26 GMT content-encoding gzip server nginx vary Origin, Accept-Encoding content-type application/json x-6si-region eu-central-1a access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-allow-credentials true timing-allow-origin https://6sense.com, https://www.ssga.com content-length 399
OPTIONS H2	200	details epsilon.6sense.com/v3/company/	0 0	160ms 48ms	Preflight	52.59.167.42 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.59.167.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-59-167-42.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.recordedfuture.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.recordedfuture.com access-control-expose-headers X-6si-Region access-control-max-age 1800 date Thu, 04 Jul 2024 01:28:26 GMT server nginx timing-allow-origin https://6sense.com, https://www.ssga.com x-6si-region eu-central-1a x-trace-id 7901456402499531368
GET H2	200	combinedConfigs Show response cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/	108 B 1 KB	308ms 300ms	Fetch application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=252628&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&referrer=https%3A%2F%2Ft.co%2F Requested by Host: js.hubspot.com URL: https://js.hubspot.com/web-interactives-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9a45c89da6cfa94009a61215c8921175ec1bf18444adb5bcba07e22e9b12954d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 267ab4fa-5988-4df5-811d-bd9a5d0313f9 content-encoding br x-envoy-upstream-service-time 9 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 267ab4fa-5988-4df5-811d-bd9a5d0313f9 server cloudflare vary origin access-control-allow-methods OPTIONS, GET content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all access-control-max-age 180 access-control-allow-credentials true cache-control max-age=0, no-cache, no-store report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vv9JfnW88n4m5w3Yv4weS6OcYZBmfhDyRzSe%2Fuc3ahIzKjVMQltVG4RiyEuLJ6odAdTYcouJqL3Y884Y2UEikNUt4jJdt%2F6x2fpTQuIfxYMriUmOCLtmZbS2nBr4Bt5jiZLmN2C46O6BiBnaFZ76trzIdNTN0nMSUgY%3D"}],"group":"cf-nel","max_age":604800} x-robots-tag noindex, follow access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 89db56aa787471bd-LHR x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-6lppp
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	139ms 135ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:26 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:26 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	138ms 135ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22f2675e8089b7d209a58fce8ad312f51c%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2247c555096cc32557d3e6e7a333d7cb3ea692cee1%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%2264dc3ec5-330c-4652-88d3-147ee65e90ba%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:26 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:26 GMT
GET H3	200	nc-140ba39d2d936df2473b9259a56315ba.js Show response dev.visualwebsiteoptimizer.com/edrv/	9 KB 3 KB	35ms 34ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/edrv/nc-140ba39d2d936df2473b9259a56315ba.js Requested by Host: www.recordedfuture.com URL: https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software glon1 / Resource Hash a0d78f12dc55546bc2ec58c06fdd7b90f84b5ed3c81a1a502f99341b202c4fad Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding br via 1.1 google last-modified Wed, 03 Jul 2024 14:34:26 GMT server glon1 etag "66856172-cb9" vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3257
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	225ms 151ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-gb&bfp=3981457101&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&r=https%3A%2F%2Ft.co%2F&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&t=Caught+in+the+Net%3A+Using+Infostealer+Logs+to+Unmask+CSAM+Consumers+%7C+Recorded+Future&cts=1720056506121&vi=56ac86796886f0b20ae0de7eea81e957&nc=true&u=57501621.56ac86796886f0b20ae0de7eea81e957.1720056506120.1720056506120.1720056506120.1&b=57501621.1.1720056506120&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id a1449a48-45c8-404e-9525-202d53165437 p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 8 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id a1449a48-45c8-404e-9525-202d53165437 server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tRqxw8%2BIYXiqlnSIpiOucra0FOHj%2BTu8YtMVblgwEWzmYeSzr1b4a4iyR9rHe6frwQLBiwYG%2Blh8D3MmD5A12ZCTA0lAB8ZQuffAm10GNpGTkkcwXxcC61bsANvdRZIMZ%2FhNbd0ZE%2FK%2BBp0OVmRd"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-5gwdl x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 89db56abde4260f0-LHR x-robots-tag none
GET H2	200	favicon.ico www.recordedfuture.com/	17 KB 898 B	455ms 455ms	Other image/x-icon	104.18.43.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.recordedfuture.com/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.43.111 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b73b7e0eaffe020cd9d4eaccd4afc57904bba61c4a3423f8640e4a05abf1b7ca Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/caught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT content-encoding gzip via 1.1 varnish strict-transport-security max-age=31536000; includeSubDomains x-platform-server i-72f68d9e5fc844fb8d11227fc18ff9f4, i-72f68d9e5fc844fb8d11227fc18ff9f4 x-content-type-options nosniff cf-cache-status MISS traceresponse 00-17dede4786944819e8becd947dd86128-a92e4d4c8c4a4ed3-01 x-cache MISS content-length 676 x-served-by cache-lcy-eglc8600033-LCY last-modified Tue, 02 Jul 2024 12:12:44 GMT server cloudflare etag W/"423e-190735c8e60" vary Accept-Encoding content-type image/x-icon cache-control public, max-age=0 x-debug-info eyJyZXRyaWVzIjowfQ== accept-ranges bytes cf-ray 89db56ab5fb923ff-LHR x-cache-hits 0
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	113ms 113ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=423eee90f&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&_ru=https%3A%2F%2Ft.co%2F Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 04 Jul 2024 01:28:25 GMT content-encoding gzip via 1.1 google server gnv1c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	251ms 251ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_syncVisitorProp&a=880669&v=423eee90f&_cu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&_ru=https%3A%2F%2Ft.co%2F Requested by Host: t.co URL: https://t.co/9u3basZ4Gj Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv1c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-platform "Win32" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 04 Jul 2024 01:28:26 GMT content-encoding gzip via 1.1 google server gnv1c access-control-allow-methods GET, POST content-type application/javascript; charset=UTF-8 access-control-allow-origin * access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET H2	200	json Show response forms.hubspot.com/lead-flows-config/v1/config/	2 KB 2 KB	167ms 159ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hubspot.com/lead-flows-config/v1/config/json?portalId=252628&utk=56ac86796886f0b20ae0de7eea81e957&__hstc=57501621.56ac86796886f0b20ae0de7eea81e957.1720056506120.1720056506120.1720056506120.1&__hssc=57501621.1.1720056506120&referrer=https%3A%2F%2Ft.co%2F&currentUrl=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers Requested by Host: js.hsleadflows.net URL: https://js.hsleadflows.net/leadflows.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22f8090eee69c3bebf98b973b0865df2f81925359d3577adf4cb541423bd0b00 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 4443fc39-22ca-4057-a1ae-92248af9a528 x-envoy-upstream-service-time 34 content-length 1083 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 4443fc39-22ca-4057-a1ae-92248af9a528 server cloudflare vary origin access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD content-type application/json;charset=utf-8 access-control-allow-origin https://www.recordedfuture.com x-evy-trace-virtual-host all cache-control max-age=0, no-cache, no-store access-control-allow-credentials false x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-8bqln access-control-max-age 180 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Z8MbAKMMBieBVlg7RprAA5QbTtcoidN4z8D94UOtcbQorvsQV2pQkuJo0LkpY6pPjdm5U23WZkTFN6m1YiEuW61l%2F0Ep4W5VIKlfX3u1mtgSmupPaWhyuRMvu13OE6W%2BG2wcrIluL4mIgE63tQN"}],"group":"cf-nel","max_age":604800} x-robots-tag none access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent cf-ray 89db56abf93f71bd-LHR
GET H3	200	counters.gif perf-na1.hsforms.com/embed/v3/	35 B 927 B	183ms 137ms	Image image/gif	104.19.175.188 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1 Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status MISS x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id b2196c07-eed4-49a0-97c7-7b47883745c0 x-envoy-upstream-service-time 9 alt-svc h3=":443"; ma=86400 content-length 35 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id b2196c07-eed4-49a0-97c7-7b47883745c0 last-modified Thu, 04 Jul 2024 01:28:26 GMT server cloudflare vary origin, Accept-Encoding content-type image/gif x-evy-trace-virtual-host all x-evy-trace-served-by-pod iad02/star-hubspot-td/envoy-proxy-776cb5686f-k4hjn access-control-expose-headers X-Origin-Hublet cache-control max-age=0, no-cache, no-store access-control-allow-credentials false accept-ranges bytes x-robots-tag none cf-ray 89db56acadfb60f3-LHR
GET H2	200	__ptq.gif track.hubspot.com/	45 B 436 B	158ms 158ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=16&fi=e887dce6-7b34-4ba5-9eac-4d2ca9a2983c&lfi=2694383&ft=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-gb&bfp=3981457101&v=1.1&a=252628&rcu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&r=https%3A%2F%2Ft.co%2F&pu=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&t=Caught+in+the+Net%3A+Using+Infostealer+Logs+to+Unmask+CSAM+Consumers+%7C+Recorded+Future&cts=1720056506384&vi=56ac86796886f0b20ae0de7eea81e957&nc=true&u=57501621.56ac86796886f0b20ae0de7eea81e957.1720056506120.1720056506120.1720056506120.1&b=57501621.1.1720056506120&pt=0&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 04 Jul 2024 01:28:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status DYNAMIC nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-route-service-name envoyset-translator x-hubspot-correlation-id 11fc0b74-8cea-4bdd-9d6a-5c6234d82c8c p3p CP="NOI CUR ADM OUR NOR STA NID" x-envoy-upstream-service-time 18 content-length 45 x-evy-trace-route-configuration listener_https/all x-evy-trace-listener listener_https x-request-id 11fc0b74-8cea-4bdd-9d6a-5c6234d82c8c server cloudflare vary origin, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IzZLyDfiyjeby8RIEXyufpOjDI4zdnWDb38KIgkfbzcuyngn4UL%2FoWBUeL3owxrgBXvcL0bUQluxpLQDyUotSWATvbc38X5qkXDgZ2QX1ddcRnjbsbkthKoJ%2B8Koz0qQv6tCHogBO5Amoa82W5gq"}],"group":"cf-nel","max_age":604800} content-type image/gif x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-l8qsb x-evy-trace-virtual-host all cache-control no-cache, no-store, no-transform access-control-allow-credentials false cf-ray 89db56acfecf60f0-LHR x-robots-tag none
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	136ms 136ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A25%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:26 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:26 GMT
GET H3	200	iphone-cd1.jpg go.recordedfuture.com/hubfs/	83 KB 85 KB	165ms 74ms	Image image/webp	199.60.103.2 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://go.recordedfuture.com/hubfs/iphone-cd1.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 199.60.103.2 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash ab221b9e81a8439634c9f73c15c96457f75d3632fea1f6256fa4833acc6a314a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=31536000 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers content-security-policy upgrade-insecure-requests x-amz-meta-cache-tag F-99167145604,P-252628,FLS-ALL age 47740 x-amz-request-id 9YFTHENXFYESKT4P x-amz-server-side-encryption AES256 edge-cache-tag F-99167145604,P-252628,FLS-ALL x-amz-replication-status COMPLETED content-disposition inline; filename="iphone-cd1.webp" x-hs-cf-lambda us-east-1.EnforceAclForReads 3 cf-bgj imgq:85,h2pri etag "f5c3d1b581a50e5c3637310137a43f0e" vary Accept, Accept-Encoding access-control-allow-methods GET content-type image/webp access-control-allow-origin * x-amz-meta-created-unix-time-millis 1674144065940 cache-control s-maxage=2592000, max-age=1209600, stale-while-revalidate=900 x-robots-tag all x-hs-cf-lambda-enforce us-east-1.EnforceAclForReads 3 date Thu, 04 Jul 2024 01:28:27 GMT strict-transport-security max-age=31536000 via 1.1 d31be1bb3cd2f187c0f45c1f03ead3c6.cloudfront.net (CloudFront) cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-amz-version-id CyJHfLHHqfqm77ShwrX4xZ78eMxn5Xvx x-amz-cf-pop LHR3-C2 x-hs-alternate-content-type text/plain cf-polished qual=85, origFmt=jpeg, origSize=229013 x-cache RefreshHit from cloudfront cache-tag F-99167145604,P-252628,FLS-ALL x-amz-meta-index-tag all x-amz-storage-class INTELLIGENT_TIERING alt-svc h3=":443"; ma=86400 content-length 85082 x-amz-id-2 nhwI7OaVqgvzgTRQANn3x06YF/ikS8+P7kFr2X7zVplJYzPxLGXtjymAa8ER4M/3JMOfX35iX8w= last-modified Thu, 19 Jan 2023 16:01:07 GMT server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ol8q32l2dbkNMiib%2F0Kap75cUK4hL0BGB4dnAieRVZhNg6ajf6EU7Pa27shwe0m4RLH9K9Vj%2FLWugHauTU5q0A7WSZM9Ta48%2FxzriC0Q%2BgV1OJG5MLhaDsrJPFVk9%2BT1ToDXtdMUg%3D%3D"}],"group":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 89db56b3cbd76400-LHR timing-allow-origin d8fk70yj6xfhx.cloudfront.net x-amz-cf-id oUhzIdOriBAmX7_JVeOtBCHMnKkyigggKX0ZW5xxJnLiq6D1rTipzQ==
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	137ms 136ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=ni%3AmapCookie&q=%7B%22thirdPartyValues%22%3A%22%5B%7B%5C%22map%5C%22%3A%5C%22Hubspot%5C%22%2C%5C%22cookieName%5C%22%3A%5C%22hubspotutk%5C%22%2C%5C%22cookieValue%5C%22%3A%5C%2256ac86796886f0b20ae0de7eea81e957%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:27 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu) etag "63f020a0-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:27 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	138ms 138ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A26%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:27 GMT x-content-type-options nosniff last-modified Sat, 18 Feb 2023 02:04:22 GMT server nginx/1.14.0 (Ubuntu) etag "63f03226-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:27 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	134ms 134ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A27%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:28 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:28 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	244ms 243ms	Image image/gif	2.17.100.210 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=f2675e8089b7d209a58fce8ad312f51c&svisitor=null&visitor=fa2160ae-66c1-4ce1-8098-6760cc8cd163&session=ee110327-eb4c-4367-8f10-4ca0dd535076&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2004%20Jul%202024%2001%3A28%3A28%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Discover%20how%20Recorded%20Future%20uses%20infostealer%20logs%20to%20identify%20CSAM%20consumers%20and%20trends.%20Learn%20key%20findings%20and%20mitigation%20strategies.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Caught%20in%20the%20Net%3A%20Using%20Infostealer%20Logs%20to%20Unmask%20CSAM%20Consumers%20%7C%20Recorded%20Future%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.recordedfuture.com%2Fcaught-in-the-net-using-infostealer-logs-to-unmask-csam-consumers&pageViewId=7588cf2a-8643-4cc3-8736-df93a146f64e&an_uid=0&webTagId=64dc3ec5-330c-4652-88d3-147ee65e90ba&v=1.1.21 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.210 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-210.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://www.recordedfuture.com/ Accept-Language en-GB,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 04 Jul 2024 01:28:30 GMT x-content-type-options nosniff last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" content-type image/gif cache-control max-age=0, no-cache, no-store accept-ranges bytes content-length 43 expires Thu, 04 Jul 2024 01:28:30 GMT