www.netcraft.com Open in urlscan Pro
2606:4700:310c::ac42:2cae Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Submission: On March 28 via api (March 28th 2024, 2:12:11 am UTC) from TR — Scanned from DE

Summary HTTP 71 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 22 IPs in 2 countries across 16 domains to perform 71 HTTP transactions. The main IP is 2606:4700:310c::ac42:2cae, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.netcraft.com.
TLS certificate: Issued by GTS CA 1P5 on March 12th 2024. Valid for: 3 months.

This is the only time www.netcraft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
25	2606:4700:310... 2606:4700:310c::ac42:2cae	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:272... 2600:9000:2724:d600:c:7d55:b3c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2	2606:4700:e6:... 2606:4700:e6::ac40:cf26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.65.255.172 172.65.255.172	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a00:1450:400... 2a00:1450:4001:80f::2004	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
4	18.157.122.248 18.157.122.248	16509 (AMAZON-02) (AMAZON-02)
4	2606:4700:10:... 2606:4700:10::6816:176	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
2	172.65.232.43 172.65.232.43	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
2	18.245.46.21 18.245.46.21	16509 (AMAZON-02) (AMAZON-02)
1	172.65.208.22 172.65.208.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:9000:225... 2600:9000:2250:2c00:4:d7e1:700:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81d::2002	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:a07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
1	172.65.238.60 172.65.238.60	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	172.65.202.201 172.65.202.201	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.245.46.32 18.245.46.32	16509 (AMAZON-02) (AMAZON-02)
2	172.65.240.166 172.65.240.166	13335 (CLOUDFLAR...) (CLOUDFLARENET)
71	22

25 2606:4700:310c::ac42:2cae (United States)

ASN13335 (CLOUDFLARENET, US)

www.netcraft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2724:d600:c:7d55:b3c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e6::ac40:cf26 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.255.172 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 18.157.122.248 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com

netcraft.matomo.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:10::6816:176 (United States)

ASN13335 (CLOUDFLARENET, US)

web-perf.netcraft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.65.232.43 (United States)

ASN13335 (CLOUDFLARENET, US)

forms-eu1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.245.46.21 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-21.fra56.r.cloudfront.net

static.netcraft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.208.22 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:2c00:4:d7e1:700:93a1 (United States)

ASN16509 (AMAZON-02, US)

sc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:a07d (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.65.238.60 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.65.202.201 (United States)

ASN13335 (CLOUDFLARENET, US)

js-eu1.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.32 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-32.fra56.r.cloudfront.net

tr-rc.lfeeder.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.65.240.166 (United States)

ASN13335 (CLOUDFLARENET, US)

track-eu1.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
31	netcraft.com www.netcraft.com web-perf.netcraft.com static.netcraft.com	248 KB
12	gstatic.com www.gstatic.com fonts.gstatic.com	439 KB
5	matomo.cloud cdn.matomo.cloud — Cisco Umbrella Rank: 16777 netcraft.matomo.cloud	59 KB
3	hs-banner.com js-eu1.hs-banner.com — Cisco Umbrella Rank: 14857	24 KB
3	hsforms.com forms-eu1.hsforms.com — Cisco Umbrella Rank: 26172 forms.hsforms.com — Cisco Umbrella Rank: 4343	4 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	6 KB
2	hubspot.com track-eu1.hubspot.com — Cisco Umbrella Rank: 15489	2 KB
2	lfeeder.com sc.lfeeder.com — Cisco Umbrella Rank: 14881 tr-rc.lfeeder.com — Cisco Umbrella Rank: 20143	11 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 42	187 KB
2	fontawesome.com use.fontawesome.com — Cisco Umbrella Rank: 1175	28 KB
1	hs-analytics.net js-eu1.hs-analytics.net — Cisco Umbrella Rank: 15056	21 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 2042	255 B
1	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 107	64 B
1	hs-scripts.com js-eu1.hs-scripts.com — Cisco Umbrella Rank: 13914	984 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	19 B
1	hsforms.net js-eu1.hsforms.net — Cisco Umbrella Rank: 50886	154 KB
71	16

	Domain	Requested by
25	www.netcraft.com	www.netcraft.com
8	www.gstatic.com	www.netcraft.com www.google.com www.gstatic.com
4	fonts.gstatic.com	fonts.googleapis.com
4	web-perf.netcraft.com	cdn.matomo.cloud
4	netcraft.matomo.cloud	cdn.matomo.cloud
3	js-eu1.hs-banner.com	js-eu1.hs-scripts.com js-eu1.hs-banner.com
3	fonts.googleapis.com	www.netcraft.com js-eu1.hs-banner.com
2	track-eu1.hubspot.com
2	static.netcraft.com	www.netcraft.com www.googletagmanager.com
2	forms-eu1.hsforms.com	js-eu1.hsforms.net www.netcraft.com
2	www.googletagmanager.com	www.netcraft.com www.googletagmanager.com
2	use.fontawesome.com	www.netcraft.com
1	tr-rc.lfeeder.com	www.netcraft.com
1	js-eu1.hs-analytics.net	js-eu1.hs-scripts.com
1	region1.google-analytics.com	www.googletagmanager.com
1	forms.hsforms.com	www.netcraft.com
1	pagead2.googlesyndication.com	www.googletagmanager.com
1	sc.lfeeder.com	www.netcraft.com
1	js-eu1.hs-scripts.com	www.googletagmanager.com
1	www.google.com	1 redirects
1	js-eu1.hsforms.net	www.netcraft.com
1	cdn.matomo.cloud	www.netcraft.com
71	22

This site contains links to these domains. Also see Links.

Domain
report.netcraft.com
services.netcraft.com
www.facebook.com
twitter.com
www.linkedin.com
old.reddit.com
goharbor.io
www.fcc.gov
toku.co
www.theverge.com
linkedin.com

Subject Issuer	Validity	Valid
www.netcraft.com GTS CA 1P5	`2024-03-12` - `2024-06-10`	3 months	crt.sh
cdn.matomo.cloud Amazon RSA 2048 M03	`2023-10-27` - `2024-11-23`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
use.fontawesome.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-10`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-16` - `2024-05-15`	a year	crt.sh
*.matomo.cloud Amazon RSA 2048 M02	`2023-06-21` - `2024-07-19`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
static.netcraft.com Amazon RSA 2048 M01	`2023-08-10` - `2024-09-07`	a year	crt.sh
*.lfeeder.com Amazon RSA 2048 M02	`2024-02-20` - `2025-03-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Frame ID: DB62A4C57B779FEDC6EED3B9CF6A6B4C
Requests: 71 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Out of the shadows - ’darcula’ iMessage and RCS smishing attacks target USPS and global postal services | Netcraft

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

71
Requests

97 %
HTTPS

59 %
IPv6

16
Domains

22
Subdomains

22
IPs

2
Countries

1186 kB
Transfer

3665 kB
Size

4
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://report.netcraft.com/
Title: Report Fraud

Search URL Search Domain Scan URL

URL: https://services.netcraft.com/
Title: Login

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/t=Out%20of%20the%20shadows%20%26%238211%3B%20%E2%80%99darcula%E2%80%99%20iMessage%20and%20RCS%20smishing%20attacks%20target%20USPS%20and%20global%20postal%20services

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Out%20of%20the%20shadows%20%26%238211%3B%20%E2%80%99darcula%E2%80%99%20iMessage%20and%20RCS%20smishing%20attacks%20target%20USPS%20and%20global%20postal%20services%20https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F

Search URL Search Domain Scan URL

URL: https://old.reddit.com/r/phishing/
Title: Reddit’s /r/phishing

Search URL Search Domain Scan URL

URL: https://goharbor.io/
Title: Harbor

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/pulse/darcula-%E8%BE%BE%E5%B0%94%E5%BA%93%E6%8B%89-oshri-kalfon
Title: Oshri Kalfon’s LinkedIn pages

Search URL Search Domain Scan URL

URL: https://www.fcc.gov/document/fcc-adopts-its-first-rules-focused-scam-texting-0%22%20/h%20HYPERLINK%20%22https://www.fcc.gov/document/fcc-adopts-its-first-rules-focused-scam-texting-0
Title: the Federal Communications Commission has recently introduced laws

Search URL Search Domain Scan URL

URL: https://toku.co/blog/labelled-likely-scam-under-ssir-what-happened-and-how-to-ensure-it-does-not-impact-your-business/
Title: the SMS Sender ID Registry (SSIR) initiative

Search URL Search Domain Scan URL

URL: https://old.reddit.com/r/phishing/comments/1b28fbw/usps_scam_text/
Title: Reddit /r/phishing

Search URL Search Domain Scan URL

URL: https://www.theverge.com/2024/3/1/24087418/google-messages-blocking-rcs-on-rooted-android-devices
Title: Google has moved to block RCS messaging on rooted phones in an attempt to reduce spam

Search URL Search Domain Scan URL

URL: https://www.facebook.com/netcraft
Title: Netcraft's facebook account

Search URL Search Domain Scan URL

URL: https://twitter.com/netcraft
Title: Netcraft's X account

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/netcraft
Title: Netcraft's LinkedIn account

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://www.google.com/jsapi HTTP 301
https://www.gstatic.com/charts/loader.js

71 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ 174 KB
37 KB 142ms
59ms Document
text/html 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a2b1d84aeb89f7b5e7401962d65b5d973b5fbf73c0fdc428126f85163472e52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417df9a2f2c5b-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 28 Mar 2024 02:12:05 GMT
etag: W/"31cad0c45e7ee5125127af61cea509aa"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hdGqNPeenU%2BZEF2a7TkaCwmngC%2BPaTEwPCU%2BL9eYfWgcJmzIVJVLxMm3216yiHdSClk%2FT9jYaOegwFCKI%2Ff5dfInyt8PcSs64%2FMK3gHek2JX%2FdfsXJ7%2Bu1ku7Ev6A3Ywpn%2BpaFUDh%2BWApxVRkeRf"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

GET
H2 200 matomo.js Show response
cdn.matomo.cloud/netcraft.matomo.cloud/ 202 KB
59 KB 90ms
5ms Script
application/javascript 2600:9000:2724:d600:c:7d55:b3c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2724:d600:c:7d55:b3c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

55dc85197400fd84d3861297b615c45b4c99ba4586ef2298bf1d5a874afadbb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 00:58:42 GMT
x-amz-version-id: Gg9oTOluGdvlqOgtb0waW8CIrxK6FrGj
content-encoding: gzip
strict-transport-security: max-age=31536000
via: 1.1 506bffda4b1949c4425629ce0bdce052.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P12
age: 4404
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 21 Mar 2024 00:37:22 GMT
server: CloudFront
etag: W/"2f9a606a9f597a37e3d4ed9c3e130956"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=691200
x-amz-cf-id: DMe4HpAf6Guxp_CBLvw7MKJLcJFPqIEkW1BCe6iwOzPMvdyywdCiEg==

GET
H3 200 main.css
www.netcraft.com/wp-content/themes/netcraft-theme/dist/ 31 KB
6 KB 71ms
70ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/netcraft-theme/dist/main.css?ver=1692788614

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff43a448308aee8d41cda3e357b2e9af72980e5c7603779cbbf00faa4de2dd27

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"a6e8dcfd5de19579ed7f80d7b0c7f1d9"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GtJqJ7kQbv96%2BBsiPkB35iGG5AZEV%2FRcX5tGNbwxnb0r8aa2VSIDge81RV9vhEAhZoOiEYVGO1upZjiEhy3V0%2BM%2FW%2FfG9bb3kkh1xExv8GRDPPcwzoYIDmyw69%2F3NZe%2BQfC0OvcMCWd%2BhTaKb5qI"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a572c5b-FRA

GET
H3 200 style.min.css
www.netcraft.com/wp-includes/css/dist/block-library/ 107 KB
15 KB 72ms
69ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.3

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

42f679ba13b77c3f4ed99e4fdf01134b34688f874db52e55d59149008b4f5c3f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"717040670970b31906dcd18936df7cef"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qcBbcJqdsmM8wfvda3Ulzo8We44mpzQhObfYCstUJ5r3FmgLKAUBwI2FrjHr8Vwt5K1msc6XsQkUM%2F9Hidds066FmIC1PAhr5kYPsBjHskH2nXkAWQQzqcN5T6Bj4BFLD4X%2Fi%2FF1J0bPVWISBuLf"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a592c5b-FRA

GET
H2 200 css
fonts.googleapis.com/ 57 KB
3 KB 48ms
16ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,regular,italic,600,600italic,700,700italic,800,800italic&display=swap

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 01:58:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 28 Mar 2024 02:12:05 GMT

GET
H3 200 wssGraph.css
www.netcraft.com/wp-content/plugins/netcraft-wss-graph/ 163 B
622 B 73ms
69ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/netcraft-wss-graph/wssGraph.css?ver=6.4.3

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f3aba9db1978f53e330395a56c703f761f74d6d782c2a973baef6f457871f27e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"9b8cb72c2a564c93b1181f77301cc980"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0pEK6jcVDAm7PFGFecRlDPyAO%2BiRWSZNnVRa6c1MmcK7RN2YdsMSl0ABlTSlbaPJJXt3L7MQN4Uy5F0Oueea%2BFPqpdxkUrNZ0Wa5AR%2Fi0hG7RDgcCIaFTIKK5Qfaq2jpYjZPaqvb8Lji51cnn%2BuZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5a2c5b-FRA

GET
H3 200 widget-areas.min.css
www.netcraft.com/wp-content/themes/generatepress/assets/css/components/ 3 KB
1 KB 71ms
67ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

134e25738ab5b7ab57aaaa5b7c015b4032cbe653a158dcc117d29dba39d8246a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"7a72b03eb2bd13133e2bc6f66db18cf7"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6MQ2tgZ%2BUMpeGlx1dBVK7hVlFQyzCbWr5ZaRKQle2T1mm%2B39YmBQBICJEV8AraaZJm4iFh1h19mLpG5ZJVSxqjVPK%2B2YjERCWaCc6ItJzfFObShX5plWSlSOE%2BiBzyVa7sTNMhvoZYFDt1fMBydd"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5b2c5b-FRA

GET
H3 200 main.min.css
www.netcraft.com/wp-content/themes/generatepress/assets/css/ 19 KB
5 KB 74ms
70ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14fd3052b2e57e76daf695cffc152e0da077c75a0cc8931dba247712b6ccb139

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"c2fa0754676ca54d233a4c6d73f79725"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WSGGbASkQW1PdI9wKBvuBMy44b2J3sQb88IJ9Pdc2hnpBG0hNwZEDkCnvZ3z7V0GYJipRs7gXXRrrt9t841jp67aFeLmQUM7HaUpmjRn6i8FmIyi17h1kDJegfKwyIVe%2FO5BYz%2BrGwqoOkClGn7n"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5c2c5b-FRA

GET
H3 200 style.css
www.netcraft.com/wp-content/themes/netcraft-theme/ 0
502 B 76ms
72ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/netcraft-theme/style.css?ver=1685358098

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 0
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "9e7a27539226d700e116522ee435029d"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rqwno5fhH8f0aRvfln75161Y8Eqt3nXnotJgLJr9fAbr%2Bun09ya6iwZjbWMYYNsWCv%2BcQ05%2FbuK3zIMeQ%2FOyeHvF4GlgxWMH50URxZE97K3bQL3Qad9hNilYLesgL5GDW%2BmLrXWwoAJ4oxI9xTDt"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5d2c5b-FRA

GET
H2 200 css
fonts.googleapis.com/ 57 KB
2 KB 53ms
22ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans%3A300%2C300italic%2Cregular%2Citalic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic&display=swap&ver=3.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 02:12:05 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 28 Mar 2024 02:12:05 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v6.4.0/css/ 100 KB
23 KB 54ms
23ms Stylesheet
text/css 2606:4700:e6::ac40:cf26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.0/css/all.css
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 444273
etag: W/"ded1c367363e8b20bdc6a19b8350a737"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L7AfJrSOe1KdLM143D9UcokHsQ4waBAgCnzl4oUUMuwuGh0bherV%2FamZ%2FN5aVBV8kg6EUEOpISulckpNZcphnkIP9cS4TTEGF%2BpOCyN6Yq0AJMUlBwB0RCWokbDfplUlTKiuqR7eXkApQo4th5Gp8q%2Bz"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 86b417e03a82366b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 style.min.css
www.netcraft.com/wp-content/plugins/gp-premium/blog/functions/css/ 6 KB
2 KB 75ms
72ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/gp-premium/blog/functions/css/style.min.css?ver=2.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

233923b409e4c0dbc91dfbd56472194d73a2e1a6aed85e68a8e35a448231750f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"1d9f673cd81cf20debb496dcefc93551"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=33jrLxBeACarv7LhNa9t6nc6CJ%2BuYf%2FVyOHAsAXTKGWcSTlBDzxRkociqLrVOOo6bw3KE2lECPoGZ5h9Bs12zJ0%2FJqUfpCh87d%2Ftbc%2FNiT0COUU3%2FIconY9onDPAdfB8S7F0yefaJ3KC4GQodFjp"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5e2c5b-FRA

GET
H3 200 main.min.css
www.netcraft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/ 7 KB
2 KB 74ms
72ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/main.min.css?ver=2.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cca60d3beeb7fae944cfb31e92bce126ac7ac3228a2bd580e51d9340b6c56535

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"fe95b155f0e4752ad7c2f3b00770c2c6"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Izmp2ZeTVfbF3fM%2B32y4ZB%2BhzXMihZfGTsl5lfVD8C4ag6fRyxdgtxOTGgClcwXnKNABznFU7lAI5xHwtBGNPR0fgAHGtS%2B2KqAs1pJjGfrfxLoViqcOaJ9ok1FUf7o%2BHdNn%2B4XG7D85jf8py7Tc"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a5f2c5b-FRA

GET
H3 200 main-mobile.min.css
www.netcraft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/ 3 KB
1 KB 75ms
73ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/main-mobile.min.css?ver=2.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5cf43dc4abb60d3addc9541d4ea585937f1cc7357375e577e80390c35839a1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"76e719661281090e8d1308fd539a028a"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FEDoqQGNX6GUYZbz64BGSuwS%2FCr67chv20tgE50w9lEVYH4IeqcmLJy%2BrtQtO9SMo9mEj3WKATcZUeMNUQgqBHiSd%2BpqvzDtn9fgUhct484vHw9V0Zly%2BxPEzinhiwPB1HbKEi3FCbQyA5dLq1zG"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a602c5b-FRA

GET
H3 200 offside.min.css
www.netcraft.com/wp-content/plugins/gp-premium/menu-plus/functions/css/ 6 KB
2 KB 76ms
74ms Stylesheet
text/css 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/gp-premium/menu-plus/functions/css/offside.min.css?ver=2.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f545431e89887d72de299c18b62a28a0cec08cde2d8e010f2560f2ebbbb73f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"d444064a4e93c7699d39de86a9b56ecb"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Gk%2BbzAx%2B64Qp8KwWA3pouGPwGwTbDHWf59qYv5T69nK4OFdLxrQSeYv%2Fk9KMa3Y8aWjU7maZaX5L9VJVnvfdQlerR82B%2BrZYflQk4fzuRcGGz8kG8sKuR7gHbUdH9eVlMjmnLQFzGh20s7B%2BDRm"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a612c5b-FRA

GET
H2 200 v4-shims.css
use.fontawesome.com/releases/v6.4.0/css/ 27 KB
5 KB 65ms
36ms Stylesheet
text/css 2606:4700:e6::ac40:cf26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v6.4.0/css/v4-shims.css
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:cf26 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d3037f42050da6c98f31f801c26a5fe3df7327240ce40314b805e5e25b052ea2

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 22 Sep 2023 01:46:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 444273
etag: W/"0e111e42b92aa32f0847263dfaadbc6a"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0DNy5H6uqWbvhFT%2Btow4Mz85u9i%2Ff7gWtvIGlOxMahlcM3yJWjjNlcF99qhmoOA0cKf%2FnP414pE6QBwE1AY%2BTn39vo3rUhnlp1TcRNLAymweoihrSqN2VkMhT%2FPPoBaDjZhJAcVGZ0z%2Bv2k2bRQwLCaR"}],"group":"cf-nel","max_age":604800}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 86b417e03a81366b-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 jquery.min.js Show response
www.netcraft.com/wp-includes/js/jquery/ 85 KB
31 KB 79ms
78ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83b9c9675e2754f8b004c403581a8558c16f81cf746c57241b5fc8c101f6fb94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"3fc5da5a5e322a848cab5df47bfae82a"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D1X6Lndv%2FcXrH5O82Nd1m%2FKdG1j8Ymb5gTqloBiWLHbQtx0zM1nouWNh%2F9tic97vqhSdPEOz%2B61WnfEIWjrKCSvRiG%2FLBR7NkikP4Me2bYp9Bi1qByjEd5g5VDFGvNnYKNKPN4mEFXPZZu9eV%2BMc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a622c5b-FRA

GET
H3 200 jquery-migrate.min.js Show response
www.netcraft.com/wp-includes/js/jquery/ 13 KB
5 KB 76ms
74ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

765eb1dcd37c5d83c3df75654fda881374d5135474c7bb3029ae61bc9942515c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"f2ec51320e36f7a9a391b85e37f690bc"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Cy2jO3iEAnRolINJ4wi2TVgfcVAoDuLHMjqR847O9ia%2FptQH1cxAlyPxjjKZav7ypVlmGN3ICVn6A%2FOM1Ng5KIeAV8u0mZa5DbkIXrQ9fyoRfjyaysker1OVCvmzK1RAmsz8llnBm9v6lLlrQq3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e00a632c5b-FRA

GET
H3 200 image5-2-1024x450.png
www.netcraft.com/wp-content/uploads/2024/03/ 35 KB
35 KB 64ms
63ms Image
image/png 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.netcraft.com/wp-content/uploads/2024/03/image5-2-1024x450.png

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6c4a06d4f782d24c9218dd38b1984a074e5669bc0d38e26ba9155991ed243d9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 35824
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "49a093cb35ae70b58b3f64cce2ab715d"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YFSmgfhvNK%2BriH52quIr9VKIKcJ3F84pYbQbn9GWNDJWjUMNLFebAWXbSiPwvm6UH%2BwVFDr1d1zcssMkVz1b3%2FKIub1RJNvmDS6%2BZg%2B3YiGFxeJoPEOX%2FHuJ1JviFscYoRg4VMh9Cg51iBMOsay5"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e02a6d2c5b-FRA

GET
H2 200 v2.js Show response
js-eu1.hsforms.net/forms/embed/ 481 KB
154 KB 89ms
21ms Script
application/javascript 172.65.255.172
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hsforms.net/forms/embed/v2.js

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.255.172 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b715034010b1479e7a4a2e5d571689fd05142a6a765fa341fb8f61e9ce576329

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: br
age: 15
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.4774/bundles/project-v2.js&cfRay=86b4177eba842bc5-FRA
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"9485dc4b1fa9efefba4862f8a0581794"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.4774/bundles/project-v2.js
date: Thu, 28 Mar 2024 02:12:05 GMT
x-amz-version-id: 9d7EqS.wP16C3hZhn1hsKrzc1cSTV7NB
via: 1.1 6d96f6742a3e24fad8577272b38c550a.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: FRA60-P6
x-hubspot-correlation-id: 092edb39-32d5-4d07-abb7-0ef6073a8a85
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: 092edb39-32d5-4d07-abb7-0ef6073a8a85
last-modified: Thu, 29 Feb 2024 15:14:22 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YTSlPzcYJ9wFXXr1n1waXugZdnVpV6A6Ah7naFx6W6bw51LG6cRdIsHEdsYqTFdl819098tWfEQ8pGotnIsTXCYMbV88mUzba0CfYBftbJfSan64HLcbhlx5kibamEkFmucbfg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: fra04/app-td/envoy-proxy-66467d85b4-gsvbr
cf-ray: 86b417e08cc7921d-FRA
x-amz-cf-id: 7quvgEfuATugzwcWo34-dCoLhu0S0qNMHU6Pv0Hkp_P71KI8NcczRA==

GET
H3 200 offside.min.js Show response
www.netcraft.com/wp-content/plugins/gp-premium/menu-plus/functions/js/ 7 KB
3 KB 67ms
66ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

50fe1014e82dd9acea2f5b26061c8f135cb11ea0aa5d5ad5985e6b265b7f50a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"7e857fb79faacc0eedf4319643ad67a1"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y6JTiD%2BUDGmuXhuNbNk3Hp%2BUXHcTprnlctGubXAZJb4P1dItiNH9xfMHZXLQoXZseuq4U5w%2BockjLCMtlKU4Q2b0EGSRMjTYf3MLG%2FyFa7aU4js%2Fj3MYljGDgEScETOGui5inoZ6Ovg3vJX%2FcXwt"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e02a6e2c5b-FRA

GET
H3 200 main.js Show response
www.netcraft.com/wp-content/themes/netcraft-theme/dist/ 16 KB
6 KB 42ms
42ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/netcraft-theme/dist/main.js?ver=1692788614

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

baf94589b02ec4c06550ef6e1b73303943cf82dcb47705551e2e4702c415bc95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"1048ca911e49abe807749fa7e3d7868c"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y5A12AbS%2FMyZT8AjQURcZSd8NVtlJ0pqwrSVud6RTwQjiPM4bdOeWjGB1thZ84I6BfUkILb6eHjumLr4jNWfcjdyZTDeywxFeLfwiUeO3mBk%2Bb%2B66SfcGjro05lHYetxTGnKcZ9TT7Ywo7RLfR3H"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0baac2c5b-FRA

GET
H3 200 stats-block.js Show response
www.netcraft.com/wp-content/themes/netcraft-theme/assets/js/blocks/ 1 KB
1 KB 72ms
70ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/netcraft-theme/assets/js/blocks/stats-block.js?ver=1686142524

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49129152a148d9d9b01aa274f237488ce89a0649a48fca094cea8ee1465ad6c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"008d9de78268c178ce7599b4dbb82633"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zOZDTR78Kpq3Ck8F%2FsvUQGpeNXI2vIaMgVQpao9vPJOkH0IJQJWUdZ8vm%2FmFfSYtz8kVOxKI3sssIv5UKIL7%2Bk1XEXuxPEDSonRVgqsqjUyJX%2FieW%2FGW%2BQlysKgKUftFCdr2iv2MSfv4lBRQOSQn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0face2c5b-FRA

GET
H2

200

loader.js Show response
www.gstatic.com/charts/
Redirect Chain

https://www.google.com/jsapi
https://www.gstatic.com/charts/loader.js

61 KB
19 KB

42ms
13ms

Script
text/javascript

2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/loader.js

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.netcraft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

date: Thu, 28 Mar 2024 01:56:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 933
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18534
x-xss-protection: 0
last-modified: Tue, 04 Apr 2023 17:52:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:56:33 GMT

Redirect headers

date: Thu, 28 Mar 2024 01:59:31 GMT
x-content-type-options: nosniff
server: sffe
age: 754
content-type: text/html; charset=UTF-8
location: https://www.gstatic.com/charts/loader.js
cache-control: public, max-age=1800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Thu, 28 Mar 2024 02:29:31 GMT

GET
H3 200 wssGraphData.js Show response
www.netcraft.com/wp-content/plugins/netcraft-wss-graph/js/ 409 KB
77 KB 72ms
70ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/netcraft-wss-graph/js/wssGraphData.js?ver=25032024

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aabbd49e260bed02e16c62f62040090f98a885fca0e51f1530d9582371e65f10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"ec423ce46e21d3e6715e1f34480edeb0"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rfw695jpl5uS%2BaezxZrtmm0iYWu11ftmQ6ujcPhY2F9K9ATrttMGFdUih%2FusKPlFxYFiz0wuG84c9RG6O2WFpLCyIhnzvtLEgmMDA21F1BfjfwFi3zeZ1JlkPlWs%2B7gZrRxdNW%2FjW3YoxJLIPF4F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0fad22c5b-FRA

GET
H3 200 wssGraph.js Show response
www.netcraft.com/wp-content/plugins/netcraft-wss-graph/js/ 5 KB
2 KB 69ms
66ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/netcraft-wss-graph/js/wssGraph.js?ver=1

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8d7f71d80b95e2b5c71177e13e2a6c6eb13954ca4d1b0600eedf43fc38fbbf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"93e1fb7c1eab1a3da74c64777200b058"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IAsmPHVsPuP4eYH5SDYxsWV9nEnL4wdQqO2tatUKp8rT8WJZ6dabZGuhkedNiND3LcW9m3gxw6t%2FIuKvvnDGPR0zBrcB2MRtVXmxY%2BElpDHidNF2IC134rEaQatMGQOhtJ9qcuAeqJ%2BVY9sboJ1%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0fad32c5b-FRA

GET
H3 200 menu.min.js Show response
www.netcraft.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 70ms
67ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

395121e5b9981325951ef88bec68d065d23087b16a70d4459109e1dd84a10936

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"3b65821b5a60f9580e32488666275fff"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yfOBZh%2F4np7uUajO5bPFet8kJ0TWc%2Bm1rnb0HsMu7KpGvI9Vy7Lw5YypH%2B%2BLSzXzJYoDp8wPJqoiYPZ4j%2FZNNVkQFZosxyGeAMfL0phPyBIpk9mqJDSysIIrqR59g%2BMYK83ivla3x4q6px%2B%2F%2BmzF"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0fad42c5b-FRA

GET
H3 200 modal.js Show response
www.netcraft.com/wp-content/themes/generatepress/assets/dist/ 3 KB
2 KB 74ms
71ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/themes/generatepress/assets/dist/modal.js?ver=3.4.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c8e1579aa7404b9625c0fc00902f78b726da2e5ffe42569f4a3f45298dafb55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"70c71d6dc23fb40c3972ceb50118e2f4"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FodeSy6vsz3QGqgzrRzNJY0C1sl%2B9AnJj0SbLt3lY7ClhuCtBprxRsaZsxIHXJq5tYuEzGUIN1Fc9ue1O4T%2F4YnVZcQYrpnqvSE%2BpSY%2F60PSWMjPmjcYWebXEllku3C2gSmtLNz8fOQLkokuDmWK"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0fad52c5b-FRA

GET
H3 200 smush-lazy-load.min.js Show response
www.netcraft.com/wp-content/plugins/wp-smush-pro/app/assets/js/ 8 KB
4 KB 67ms
64ms Script
application/javascript 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/plugins/wp-smush-pro/app/assets/js/smush-lazy-load.min.js?ver=3.16.0

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3f1471c449f4069c6b7b63e0b34c6e18fea65406b18fbe2923735e2565685193

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"017b6de50285f5023160d00160777311"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hO3W1Wb8I6T9Z1OlbHGNx3W7jILtPLLmav3KIeR%2FLKY9NL0qQc3jrftX5%2BVQX5n8V0xI25i6Y7EbyHmhIIfjFMQeq4LMGdEuP54G%2BDZNp50CUjXL7OlyeZvVmu1SVubg1ZDZvXXaksTb9wQr%2F2LU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e0fad62c5b-FRA

POST
H2 204 matomo.php
netcraft.matomo.cloud/ 0
169 B 88ms
57ms Ping
text/plain 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://netcraft.matomo.cloud/matomo.php?action_name=Out%20of%20the%20shadows%20-%20%E2%80%99darcula%E2%80%99%20iMessage%20and%20RCS%20smishing%20attacks%20target%20USPS%20and%20global%20postal%20services%20%7C%20Netcraft&idsite=1&rec=1&r=040231&h=3&m=12&s=5&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=XP80eq&pf_net=83&pf_srv=59&pf_tfr=13&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22123.0.6312.86%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22123.0.6312.86%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=800x600
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.netcraft.com
date: Thu, 28 Mar 2024 02:12:05 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

POST
H2 204 matomo.php
web-perf.netcraft.com/api/ 0
469 B 344ms
249ms Ping
text/plain 2606:4700:10::6816:176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://web-perf.netcraft.com/api/matomo.php?action_name=Out%20of%20the%20shadows%20-%20%E2%80%99darcula%E2%80%99%20iMessage%20and%20RCS%20smishing%20attacks%20target%20USPS%20and%20global%20postal%20services%20%7C%20Netcraft&idsite=1&rec=1&r=244928&h=3&m=12&s=5&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=zWYtDU&pf_net=83&pf_srv=59&pf_tfr=13&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22123.0.6312.86%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22123.0.6312.86%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=800x600

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:176 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/8.1.19

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=15724800; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/8.1.19
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://www.netcraft.com
access-control-allow-credentials: true
cf-ray: 86b417e16b1518d4-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-xss-protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 238 KB
85 KB 112ms
34ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-K3HGX85

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bc17aab3fc9b02ba142116a42c0cc5d0898e5dedf9d298b90c7fe38377a96a56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87033
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 00:20:15 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 28 Mar 2024 02:12:05 GMT

GET
H2 200 configs.php Show response
netcraft.matomo.cloud/plugins/HeatmapSessionRecording/ 116 B
291 B 26ms
22ms Script
application/javascript 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://netcraft.matomo.cloud/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=WJY80f&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 3c1653d2241596010eb38c5586a6c4d38b7ce7537b1304862bec7acee4321b46

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:05 GMT
content-encoding: gzip
server: Apache
content-length: 119
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,Accept-Encoding,User-Agent
content-type: application/javascript

GET
H2 200 configs.php Show response
web-perf.netcraft.com/api/plugins/HeatmapSessionRecording/ 116 B
563 B 311ms
236ms Script
application/javascript 2606:4700:10::6816:176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://web-perf.netcraft.com/api/plugins/HeatmapSessionRecording/configs.php?idsite=1&trackerid=HL4qU9&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:176 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/8.1.19

Resource Hash

c0768972024b3cf4d8561b22d1d60eae9c35f447c319b3142238f4da73651650

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/8.1.19
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 86b417e16b1318d4-FRA
content-length: 119
x-xss-protection: 1; mode=block

GET
BLOB 200
OK c5c29ffe-7f28-435d-9832-31cedae91cea
https://www.netcraft.com/ 972 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.netcraft.com/c5c29ffe-7f28-435d-9832-31cedae91cea
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c3eb98f65e4a84641eaa826018905207de425e06ed526fa2b7b8b9861fbeb42d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 972
Content-Type: text/javascript

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK json Show response
forms-eu1.hsforms.com/embed/v3/form/25394294/6d65592b-5dd2-4efd-94c0-6b7481413aea/ 2 KB
2 KB 139ms
71ms XHR
application/json 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms-eu1.hsforms.com/embed/v3/form/25394294/6d65592b-5dd2-4efd-94c0-6b7481413aea/json?hs_static_app=forms-embed&hs_static_app_version=1.4774&X-HubSpot-Static-App-Info=forms-embed-1.4774

Requested by

Host: js-eu1.hsforms.net
URL: https://js-eu1.hsforms.net/forms/embed/v2.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ba9588f5501fa6f9bd65a6e698689f9e0d8b5fdb9d79fa7011ddf9ed983afe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

X-Origin-Hublet: eu1
Date: Thu, 28 Mar 2024 02:12:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: f61d51f9-9cdc-4ecf-8e23-845131c57513
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 8
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f61d51f9-9cdc-4ecf-8e23-845131c57513
Server: cloudflare
X-Trace: 2B8E4967A2C68F44FBA647E8048B5F7C51A5DA0A35000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.netcraft.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 86b417e1ac462ba2-FRA
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-5d745d6d44-qxlbf

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 79ms
20ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,regular,italic,600,600italic,700,700italic,800,800italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 00:50:53 GMT
x-content-type-options: nosniff
age: 177673
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 00:50:53 GMT

GET
H2 200 memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2
fonts.gstatic.com/s/opensans/v40/ 49 KB
49 KB 84ms
27ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memtYaGs126MiZpBA-UFUIcVXSCEkx2cmqvXlWqWuU6F.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,regular,italic,600,600italic,700,700italic,800,800italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 08:10:11 GMT
x-content-type-options: nosniff
age: 151315
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50296
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:10:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 08:10:11 GMT

GET
H/1.1 200
OK www-stats.json Show response
static.netcraft.com/json/ 73 B
765 B 107ms
8ms Fetch
application/json 18.245.46.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.netcraft.com/json/www-stats.json
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/wp-content/themes/netcraft-theme/assets/js/blocks/stats-block.js?ver=1686142524
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-21.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9124a5c88305bdb315b7480560abdd5d814c23e2f026468568c4c527e9f5c70e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 01:54:08 GMT
Via: 1.1 5a2cb96a37aeca3f9626798c4e9dab28.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P9
Age: 2320
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 73
Last-Modified: Tue, 19 Mar 2024 10:28:38 GMT
Server: AmazonS3
ETag: "9054373a0dfdfe261f5589c4abd1b61f"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/json
Access-Control-Allow-Origin: *
Vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
Accept-Ranges: bytes
X-Amz-Cf-Id: iaPhdj7fZHrwtVi7ywj5gMoWLPVAqlpRzlTswBRdr8_BPCJJLsGbkw==

GET
H2 200 loader.js Show response
www.gstatic.com/charts/51/ 48 KB
16 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/loader.js

Requested by

Host: www.google.com
URL: https://www.google.com/jsapi

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15f9c7dcb6d3f3fd50ac55a55f8a4168652122756d7763c13c333c9d4b8a36f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:02:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15900
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:04:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 03:02:06 GMT

GET
H/1.1 200
OK hubspot-cookie.js Show response
static.netcraft.com/js/ 656 B
1 KB 56ms
7ms Script
application/javascript 18.245.46.21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.netcraft.com/js/hubspot-cookie.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3HGX85
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-21.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2886dd451a7594ccfb0e42fcc41b9e1f674e7a323c7bb6aa9e6e52feea11f46a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 27 Mar 2024 06:48:43 GMT
Via: 1.1 e4a4a1d8cbc68200b55d6f49ec5eb07a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-P9
Age: 69804
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 656
Last-Modified: Tue, 19 Mar 2024 10:24:29 GMT
Server: AmazonS3
ETag: "958ad6b7429a3111efd027430964293d"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
Accept-Ranges: bytes
X-Amz-Cf-Id: CMpPs8HBeDUg91u-FxnVbVMOdr35NjyLom3ar83LLJBF9WlVvygYFA==

GET
H2 200 25394294.js Show response
js-eu1.hs-scripts.com/ 879 B
984 B 93ms
35ms Script
application/javascript 172.65.208.22
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hs-scripts.com/25394294.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3HGX85

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.208.22 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291f14d7f8c590578ffb4b99e918aa672d5edd2121e6d1fffae8c8742d38b37a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-hubspot-correlation-id: dec9e0ad-28f0-4dd6-9b88-e4cf9288ea9b
x-evy-trace-route-service-name: envoyset-translator
cf-polished: origSize=986
age: 2471
x-envoy-upstream-service-time: 31
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: dec9e0ad-28f0-4dd6-9b88-e4cf9288ea9b
cf-bgj: minify
last-modified: Thu, 28 Mar 2024 01:30:55 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://www.netcraft.com
x-evy-trace-served-by-pod: fra04/hubapi-td/envoy-proxy-c7845b94-qb256
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cf-ray: 86b417e2d8ef9bb3-FRA

GET
H2 200 lftracker_v1_ywVkO4XP0wb4Z6Bj.js Show response
sc.lfeeder.com/ 30 KB
11 KB 65ms
8ms Script
application/javascript 2600:9000:2250:2c00:4:d7e1:700:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sc.lfeeder.com/lftracker_v1_ywVkO4XP0wb4Z6Bj.js
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:2c00:4:d7e1:700:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 293914cb953179d8dc5fcb8de2abc4c96947d445224c1e8fd578e4b8632453fb

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: f3uqbQLaWpbvPH2kqgcIL6AvV0toskEk
content-encoding: gzip
via: 1.1 b3bfeb8eb7405a05775de8861a4d117c.cloudfront.net (CloudFront)
date: Thu, 28 Mar 2024 01:26:28 GMT
last-modified: Wed, 07 Feb 2024 07:39:38 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 2739
x-amz-server-side-encryption: AES256
etag: W/"4c609a03724e7063655be1b5bcfaa663"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
x-amz-cf-id: b4wto9w_eBRhwd4hMvO8YO0OOo1BufU1by6byQzxCL13L8Ju3wzjpA==

GET
H3 200 netcraft-logo.svg
www.netcraft.com/wp-content/uploads/2023/01/ 4 KB
2 KB 36ms
36ms Image
image/svg+xml 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.netcraft.com/wp-content/uploads/2023/01/netcraft-logo.svg

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4099d721537d0ccf3989ea3352c1652a4314d05124540003980312de92fe9c03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"3c96c8d3dfc4f035c44ad9055eb7e49e"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l5NQqRqzGGCojm4jjKy%2FfASd7ic5HHpKuNkS0rlh8E8Gm5HIqLHUK1DowuFJp6EjCbXhM6uaxNmHBct3FLyKZ7lx3zGzJ%2FlLjMVsm1KWbaa%2BFKk8PLdNSN%2FaLH%2FkNh4w46aVXGh1nt1ONY0gutO%2B"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e27b822c5b-FRA

POST
H3 200 landing
pagead2.googlesyndication.com/pagead/ 42 B
64 B 44ms
16ms Ping
image/gif 2a00:1450:4001:81d::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/landing?gcs=G100&gcd=13p3p3l2l5&rnd=652095256.1711591926&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&dma_cps=sypham&dma=1&npa=1&gtm=45He43p0n81K3HGX85v9122438638za200

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3HGX85

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81d::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 28 Mar 2024 02:12:06 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 308 KB
102 KB 36ms
35ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Z8W5Z5ZF2S&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3HGX85

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3e501b5b3ed35e7d60d62881683a90fb3cd6c6ac2b307b57a7eeba646d935b67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 104319
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 28 Mar 2024 02:12:06 GMT

GET
H3 404 wp-emoji-release.min.js
www.netcraft.com/wp-includes/js/ 0
0 48ms
46ms Script
text/html 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.3

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fv2lyGKYvne8ufKjqIBYpB%2B5W455h5YfIwL0WF3gUDure1h%2BfgbpKUMhvCkW9sYskM2BEGdkXP15hx95qIY0ZHgvjYmbOM9KbHVJ70nKn1eyskqV6q6LsX%2BfXK%2F3t6LRRiUnQLIBXHaEzkmRJD9n"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cf-ray: 86b417e2ab902c5b-FRA
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
739 B 147ms
128ms Image
image/gif 2606:4700::6812:a07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:a07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 4c9135b6-a059-4919-8453-bd026f125597
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 4c9135b6-a059-4919-8453-bd026f125597
server: cloudflare
x-trace: 2B95A9F83FEBD171FD27FC0CBFF5B4C23EA6C66F67000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-74c94cd679-fblhj
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 86b417e2dcad9763-FRA

GET
H3 200 tooltip.css
www.gstatic.com/charts/51/css/core/ 1 KB
560 B 11ms
11ms Stylesheet
text/css 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/css/core/tooltip.css

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cb6d99c8ba2262a4d0c6d0333a35b67be6d4db6c5a7d2c4a9cff74e5970e4f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 01:54:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1069
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 533
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:22:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/css
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:54:17 GMT

GET
H3 200 util.css
www.gstatic.com/charts/51/css/util/ 12 KB
3 KB 12ms
12ms Stylesheet
text/css 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/css/util/util.css

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9c9244f08810a7573b16fd89288d4587f617de4c005b3e4d74ee034b6dbf280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:00:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 726
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3203
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:22:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/css
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 03:00:00 GMT

GET
H3 200 jsapi_compiled_default_module.js Show response
www.gstatic.com/charts/51/js/ 263 KB
83 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/js/jsapi_compiled_default_module.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e7e72eecf6a4fb2981627eb8d15b947d394398db4e67c7ca7705749cdb2f832

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 01:22:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2995
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84496
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:09:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:22:11 GMT

GET
H3 200 jsapi_compiled_graphics_module.js Show response
www.gstatic.com/charts/51/js/ 24 KB
8 KB 22ms
19ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/js/jsapi_compiled_graphics_module.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ad0d8bf9e4659eb773ec937a69b25c1e8869b17c43acd258f01e268f0194088

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 01:20:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3118
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7953
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:09:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:20:08 GMT

GET
H3 200 jsapi_compiled_ui_module.js Show response
www.gstatic.com/charts/51/js/ 507 KB
167 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/js/jsapi_compiled_ui_module.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0867ee1df230c80dc1601a8c56c499fabe444ab3ec173ce8b901444560c8816d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 01:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 171024
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:09:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:52:32 GMT

GET
H3 200 jsapi_compiled_corechart_module.js Show response
www.gstatic.com/charts/51/js/ 8 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/51/js/jsapi_compiled_corechart_module.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/charts/51/loader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30c48eef4e305a1f7e77d50dcac4b5f7baf250b0d55dfbab468db645bfb13c65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 01:43:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1712
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1354
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 03:09:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Thu, 28 Mar 2024 02:43:34 GMT

GET
H/1.1 200
OK counters.gif
forms-eu1.hsforms.com/embed/v3/ 35 B
1 KB 355ms
32ms Image
image/gif 172.65.232.43
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-eu1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

172.65.232.43 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 28 Mar 2024 02:12:06 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: 3a8090e7-4e8d-498f-a7fa-f61cd45d5fc8
x-envoy-upstream-service-time: 2
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 3a8090e7-4e8d-498f-a7fa-f61cd45d5fc8
Server: cloudflare
X-Trace: 2B1EFAA08235CFD7157ACCFF16D853A15AF84B758A000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/star-hubspot-td/envoy-proxy-5d745d6d44-qxlbf
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 86b417e5090591d5-FRA

POST
H2 204 collect
region1.google-analytics.com/g/ 0
255 B 90ms
14ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-Z8W5Z5ZF2S&gtm=45je43p0v9113939191z89122438638za200&_p=1711591925908&gcs=G100&gcd=13p3p3l2l5&npa=1&dma_cps=sypham&dma=1&cid=329674458.1711591926&ul=en-us&sr=800x600&uaa=x86&uab=64&uafvl=Google%2520Chrome%3B123.0.6312.86%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.86&uamb=0&uam=&uap=Win32&uapv=10.0.0&uaw=0&pscdl=denied&_s=1&sid=1711591926&sct=1&seg=0&dl=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&dt=Out%20of%20the%20shadows%20-%20%E2%80%99darcula%E2%80%99%20iMessage%20and%20RCS%20smishing%20attacks%20target%20USPS%20and%20global%20postal%20services%20%7C%20Netcraft&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=670
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Z8W5Z5ZF2S&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 28 Mar 2024 02:12:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.netcraft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 25394294.js Show response
js-eu1.hs-analytics.net/analytics/1711589400000/ 66 KB
21 KB 101ms
24ms Script
text/javascript 172.65.238.60
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-analytics.net/analytics/1711589400000/25394294.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25394294.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.238.60 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b8493592356a9abf9a1f65e29133bfdad0916a3b59d3342d6f9d0695f13cdf64

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: BP501G8M9KZR5NQE
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: f6a8c51d-bf56-4aec-84d8-d427943db7e2
age: 221
x-envoy-upstream-service-time: 21
x-amz-id-2: +g94r5XzPFQ7Qc4XV6ide7IvnSXFUyEkqabHrL1ntWmLUR5g5EA1atbY3bvUT1AHVAFUrlXdCRY=
x-evy-trace-listener: listener_https
x-request-id: f6a8c51d-bf56-4aec-84d8-d427943db7e2
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 27 Feb 2024 15:31:54 GMT
server: cloudflare
etag: W/"75a0c1c954b65b17df53f0ce98f419b7"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-5f564b4b94-wlsgc
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 86b417e3d9032ba4-FRA
expires: Thu, 28 Mar 2024 02:13:25 GMT

GET
H2 200 banner.js Show response
js-eu1.hs-banner.com/v2/25394294/ 73 KB
24 KB 105ms
24ms Script
text/javascript 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/v2/25394294/banner.js
Requested by: Host: js-eu1.hs-scripts.com
URL: https://js-eu1.hs-scripts.com/25394294.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6125eed92fe0627dd65adf1c932b4abbe8d265324594c7056ed8861f28edff33

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
x-amz-version-id: NbkdL95eZTA18Z.3e0d3ZLW69PFXJfRO
content-encoding: br
cf-cache-status: HIT
x-amz-request-id: R6BTD9KT2K2HKHT6
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 80b7ad6f-e9de-4697-af5f-7000d73a55bd
age: 221
x-envoy-upstream-service-time: 43
x-amz-id-2: 4hOBisplsiOCf+mKLPMsHepQynALFtyecstEre9m+cjN06ADaFSMsrX9Q2lYB3PkzJto5pzSsQ0=
x-evy-trace-listener: listener_https
x-request-id: 80b7ad6f-e9de-4697-af5f-7000d73a55bd
x-evy-trace-route-configuration: listener_https/all
last-modified: Mon, 25 Mar 2024 21:28:16 GMT
server: cloudflare
etag: W/"c65c3320bf1d645bc4c29eb2a827a376"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://www.netcraft.com
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-69d6cc4745-kkkrt
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 86b417e3dfdf9a0f-FRA
expires: Thu, 28 Mar 2024 02:13:25 GMT

GET
H2 200 /
tr-rc.lfeeder.com/ 43 B
294 B 107ms
60ms Image
image/gif 18.245.46.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr-rc.lfeeder.com/?sid=ywVkO4XP0wb4Z6Bj&data=eyJnYVRyYWNraW5nSWRzIjpbXSwiZ2FNZWFzdXJlbWVudElkcyI6WyJHLVo4VzVaNVpGMlMiXSwiZ2FDbGllbnRJZHMiOltdLCJjb250ZXh0Ijp7ImxpYnJhcnkiOnsibmFtZSI6ImxmdHJhY2tlciIsInZlcnNpb24iOiIyLjYyLjMifSwicGFnZVVybCI6Imh0dHBzOi8vd3d3Lm5ldGNyYWZ0LmNvbS9ibG9nL2RhcmN1bGEtc21pc2hpbmctYXR0YWNrcy10YXJnZXQtdXNwcy1hbmQtZ2xvYmFsLXBvc3RhbC1zZXJ2aWNlcy8iLCJwYWdlVGl0bGUiOiJPdXQgb2YgdGhlIHNoYWRvd3MgLSDigJlkYXJjdWxh4oCZIGlNZXNzYWdlIGFuZCBSQ1Mgc21pc2hpbmcgYXR0YWNrcyB0YXJnZXQgVVNQUyBhbmQgZ2xvYmFsIHBvc3RhbCBzZXJ2aWNlcyB8IE5ldGNyYWZ0IiwicmVmZXJyZXIiOiIifSwiZXZlbnQiOiJ0cmFja2luZy1ldmVudCIsImNsaWVudEV2ZW50SWQiOiI3NzA5OTdkNjBiYjNiYjY0Iiwic2NyaXB0SWQiOiJ5d1ZrTzRYUDB3YjRaNkJqIiwiY29va2llc0VuYWJsZWQiOmZhbHNlLCJjb25zZW50TGV2ZWwiOiJub25lIiwiYW5vbnltaXplSXAiOmZhbHNlLCJsZkNsaWVudElkIjoiTEYxLjEuNGIwOThjNzFjZTllZjA3MS4xNzExNTkxOTI2MzY3LkNNIiwiZm9yZWlnbkNvb2tpZXMiOltdLCJwcm9wZXJ0aWVzIjp7fSwiYXV0b1RyYWNraW5nRW5hYmxlZCI6dHJ1ZSwiYXV0b1RyYWNraW5nTW9kZSI6InNwYSJ9
Requested by: Host: www.netcraft.com
URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.245.46.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-245-46-32.fra56.r.cloudfront.net
Software: CloudFront /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
via: 1.1 e999795aa400a9b7027a66ec4ada5728.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P9
x-cache: LambdaGeneratedResponse from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: aSRKwJ1LxASon5dRGXXD6ta1ejMwLny8iK93pFrjJkho5yOIti9PGA==

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
552 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Requested by

Host: js-eu1.hs-banner.com
URL: https://js-eu1.hs-banner.com/v2/25394294/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 28 Mar 2024 02:12:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 01:25:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 28 Mar 2024 02:12:06 GMT

POST
H2 204 view
js-eu1.hs-banner.com/v2/activity/ 0
0 40ms
40ms Fetch 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-eu1.hs-banner.com/v2/activity/view

Requested by

Host: js-eu1.hs-banner.com
URL: https://js-eu1.hs-banner.com/v2/25394294/banner.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator, envoyset-translator
x-hubspot-correlation-id: d132bc85-a88f-4aef-8cb0-e79f0aa005d7
x-envoy-upstream-service-time: 19
x-evy-trace-route-configuration: listener_http/all, listener_https/all
x-evy-trace-listener: listener_http, listener_https
x-request-id: d132bc85-a88f-4aef-8cb0-e79f0aa005d7
server: cloudflare
x-trace: 2B4594FC1EE7425FDC78F208B40DD3B9BF7EE8AE3A000000000000000000
vary: origin
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-evy-trace-virtual-host: all, all
x-evy-trace-served-by-pod: fra04/private-hubapi-td/envoy-proxy-84cdd65f9f-cwvl6, fra04/analytics-js-proxy-td/envoy-proxy-5f564b4b94-qk6gz
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-allow-origin: https://www.netcraft.com
access-control-allow-credentials: true
access-control-max-age: 604800
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 86b417e468eb1e0c-FRA

OPTIONS
H2 200 view
js-eu1.hs-banner.com/v2/activity/ 0
0 38ms
21ms Preflight
application/octet-stream 172.65.202.201
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js-eu1.hs-banner.com/v2/activity/view
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.65.202.201 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.netcraft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://www.netcraft.com
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age: 604800
cf-cache-status: DYNAMIC
cf-ray: 86b417e438d71e0c-FRA
content-length: 0
content-type: application/octet-stream
date: Thu, 28 Mar 2024 02:12:06 GMT
server: cloudflare
timing-allow-origin: *
vary: origin
x-envoy-upstream-service-time: 0
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: fra04/analytics-js-proxy-td/envoy-proxy-5f564b4b94-qk6gz
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: a9a654fa-4d4f-43f9-97ba-825ca7c758a9
x-request-id: a9a654fa-4d4f-43f9-97ba-825ca7c758a9

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 16ms
7ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 07:43:00 GMT
x-content-type-options: nosniff
age: 152946
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 07:43:00 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 14ms
8ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,400;0,700;1,400&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://fonts.googleapis.com/
Origin: https://www.netcraft.com
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 07:57:42 GMT
x-content-type-options: nosniff
age: 152064
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 Mar 2025 07:57:42 GMT

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
1 KB 154ms
64ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=1&sd=800x600&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2141725003&v=1.1&a=25394294&rcu=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&pu=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&t=Out+of+the+shadows+-+%E2%80%99darcula%E2%80%99+iMessage+and+RCS+smishing+attacks+target+USPS+and+global+postal+services+%7C+Netcraft&cts=1711591926647&rv=1&vi=60490afd67042c7ba0c2f066f7baa766&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: f886ecfe-013e-4321-90c1-020529f939ef
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 3
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: f886ecfe-013e-4321-90c1-020529f939ef
last-modified: Thu, 28 Mar 2024 02:12:06 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6WAYpdTtp1%2F0T6gV5Y2GIyhXdN2wyk0iEbPXQJFcbCPAGdNNYlydJEyk0yQRaW%2FvcgpZkphzArlCTAt4XoG%2FHurOKLooHi5TSO%2ByAwhMnnSUdI8DNltZaoOIx4yqIyMdZdFmRFoN8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-6d877cf44b-2gdkv
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 86b417e64cbb2bbc-FRA
x-robots-tag: none

GET
H2 200 __ptq.gif
track-eu1.hubspot.com/ 45 B
743 B 153ms
70ms Image
image/gif 172.65.240.166
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track-eu1.hubspot.com/__ptq.gif?k=15&fi=6d65592b-5dd2-4efd-94c0-6b7481413aea&fci=1ec54657-ff01-45a7-b002-26b10cbc5ae1&ft=0&sd=800x600&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2141725003&v=1.1&a=25394294&rcu=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&pu=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&t=Out+of+the+shadows+-+%E2%80%99darcula%E2%80%99+iMessage+and+RCS+smishing+attacks+target+USPS+and+global+postal+services+%7C+Netcraft&cts=1711591926648&rv=1&vi=60490afd67042c7ba0c2f066f7baa766&nc=true&ce=false&cc=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.65.240.166 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 6431fbd6-31e0-4a2b-8a0e-1e1051d49410
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 5
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 6431fbd6-31e0-4a2b-8a0e-1e1051d49410
last-modified: Thu, 28 Mar 2024 02:12:06 GMT
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pKpMudn603kI1%2FEUvH%2FEsIAwewz%2FER0noaCX0lqpgHymlBixEj0ylLpnAombAh0rHhXzopGoAK0L%2Bk5fw5Io1x0fZpGRu8v%2FKHUvOmNQyxnCp7mErepS30S1lBI%2BQ0i8HnUUS6Eu5w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: fra04/analytics-tracking-td/envoy-proxy-6d877cf44b-dldx9
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 86b417e64cb92bbc-FRA
x-robots-tag: none

GET
H3 200 cropped-logo-icon-512x512-1-32x32.png
www.netcraft.com/wp-content/uploads/2023/01/ 442 B
937 B 55ms
54ms Other
image/png 2606:4700:310c::ac42:2cae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netcraft.com/wp-content/uploads/2023/01/cropped-logo-icon-512x512-1-32x32.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6cc48538a4a10e1241d355778c77d333a40d37c3c447240167d6423d1d168bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 442
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "57129bdff9d48a4af77cc3c544d9d021"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EL86c9cOxah%2BVcvC%2FRUZlGtcZEi1fRP%2FGFGKVCov4n89LQB9bKYDzFLpACCLr5vf5vyIcjzTO1G0go6CvrRT7Nd7TDP5sijU37WFPcokUcXEa7TU5YcSW6X4MaEgenBPV%2BL5dXjP%2FEC048X2rPBf"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: public, max-age=0, must-revalidate
cf-ray: 86b417e5ccde2c5b-FRA

POST
H2 204 matomo.php
netcraft.matomo.cloud/ 0
169 B 54ms
51ms Ping
text/plain 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://netcraft.matomo.cloud/matomo.php?e_c=abtesting&e_a=book-a-demo-cta&e_n=bright-blue&ca=1&idsite=1&rec=1&r=217645&h=3&m=12&s=5&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=XP80eq&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22123.0.6312.86%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22123.0.6312.86%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=800x600
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.netcraft.com
date: Thu, 28 Mar 2024 02:12:06 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

POST
H2 204 matomo.php
web-perf.netcraft.com/api/ 0
40 B 108ms
98ms Ping
text/plain 2606:4700:10::6816:176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://web-perf.netcraft.com/api/matomo.php?e_c=abtesting&e_a=book-a-demo-cta&e_n=bright-blue&ca=1&idsite=1&rec=1&r=836563&h=3&m=12&s=5&url=https%3A%2F%2Fwww.netcraft.com%2Fblog%2Fdarcula-smishing-attacks-target-usps-and-global-postal-services%2F&_id=&_idn=1&send_image=0&_refts=0&pv_id=zWYtDU&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22123.0.6312.86%22%7D%2C%7B%22brand%22%3A%22Not%3AA-Brand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22123.0.6312.86%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Win32%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=800x600

Requested by

Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:176 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/8.1.19

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Thu, 28 Mar 2024 02:12:06 GMT
strict-transport-security: max-age=15724800; includeSubDomains
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/8.1.19
access-control-max-age: 1728000
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: https://www.netcraft.com
access-control-allow-credentials: true
cf-ray: 86b417e5edaf18d4-FRA
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
x-xss-protection: 1; mode=block

POST
H2 204 matomo.php
netcraft.matomo.cloud/ 0
169 B 33ms
32ms Ping
text/plain 18.157.122.248
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://netcraft.matomo.cloud/matomo.php
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.157.122.248 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-157-122-248.eu-central-1.compute.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

access-control-allow-origin: https://www.netcraft.com
date: Thu, 28 Mar 2024 02:12:09 GMT
access-control-allow-credentials: true
server: Apache
vary: X-Forwarded-Port-Override,X-Forwarded-Proto-Override,User-Agent

POST
H2 500 matomo.php
web-perf.netcraft.com/api/ 0
0 79ms
78ms Ping
application/json 2606:4700:10::6816:176
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://web-perf.netcraft.com/api/matomo.php
Requested by: Host: cdn.matomo.cloud
URL: https://cdn.matomo.cloud/netcraft.matomo.cloud/matomo.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:176 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://www.netcraft.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

Verdicts & Comments Add Verdict or Comment

3066 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.netcraft.com/	1970-01-20 19:26:33	Name: __cf_bm Value: S25NOaYVDGUfLlMjhk2PFzGwXzYSNpx41g5nMaWXnHs-1711591926-1.0.1.1-jO7vFj80pm9wNlT.hfI5gQTKCOcMz0RjaZabkDCMm7L5hAzUdgMF_VDJvLcywP3VAgMSt3RGBhPvbGzYhFURDw
.hsforms.com/	1969-12-31 23:59:59	Name: _cfuvid Value: aXeAo8VNs68gwdPTIzUhuql_5TSRhKk6ZxxNfg.6MRc-1711591926587-0.0.1.1-604800000
.hubspot.com/	1970-01-20 19:26:33	Name: __cf_bm Value: 71gkIcl5WL3l3lFBLh26KGpK0Ppx3T6sMh4lh0oE5FI-1711591926-1.0.1.1-1b7KnVw6lOhyZf0ayxZ6Iftneag7su_2R039IEuMGa2sjZFEpiW158zXPKMbDtqhKzGXL0ntP76uLlcOFXsnlw
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 4wQHy0sqpsb5XnfwPHyqPn0s1cFi0c45qEE1FxqiGeA-1711591926813-0.0.1.1-604800000

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.netcraft.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.3 Message: Failed to load resource: the server responded with a status of 404 ()
security	error	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Refused to execute script from 'https://www.netcraft.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.3' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.netcraft.com/blog/darcula-smishing-attacks-target-usps-and-global-postal-services/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://web-perf.netcraft.com/api/matomo.php Message: Failed to load resource: the server responded with a status of 500 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.matomo.cloud
fonts.googleapis.com
fonts.gstatic.com
forms-eu1.hsforms.com
forms.hsforms.com
js-eu1.hs-analytics.net
js-eu1.hs-banner.com
js-eu1.hs-scripts.com
js-eu1.hsforms.net
netcraft.matomo.cloud
pagead2.googlesyndication.com
region1.google-analytics.com
sc.lfeeder.com
static.netcraft.com
tr-rc.lfeeder.com
track-eu1.hubspot.com
use.fontawesome.com
web-perf.netcraft.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.netcraft.com
172.65.202.201
172.65.208.22
172.65.232.43
172.65.238.60
172.65.240.166
172.65.255.172
18.157.122.248
18.245.46.21
18.245.46.32
2001:4860:4802:32::36
2600:9000:2250:2c00:4:d7e1:700:93a1
2600:9000:2724:d600:c:7d55:b3c0:93a1
2606:4700:10::6816:176
2606:4700:310c::ac42:2cae
2606:4700::6812:a07d
2606:4700:e6::ac40:cf26
2a00:1450:4001:802::2003
2a00:1450:4001:80f::2004
2a00:1450:4001:81d::2002
2a00:1450:4001:81d::2008
2a00:1450:4001:827::200a
2a00:1450:4001:82b::2003
0867ee1df230c80dc1601a8c56c499fabe444ab3ec173ce8b901444560c8816d
0d8601a776b7dc777cd23bc42392d05a43df0d6402328e8913b58811083b513d
134e25738ab5b7ab57aaaa5b7c015b4032cbe653a158dcc117d29dba39d8246a
14fd3052b2e57e76daf695cffc152e0da077c75a0cc8931dba247712b6ccb139
15f9c7dcb6d3f3fd50ac55a55f8a4168652122756d7763c13c333c9d4b8a36f0
1edb1725a9ea8ca4dcf2f5508cee183218aa1685e47c1b23056717f754f58ebf
233923b409e4c0dbc91dfbd56472194d73a2e1a6aed85e68a8e35a448231750f
2886dd451a7594ccfb0e42fcc41b9e1f674e7a323c7bb6aa9e6e52feea11f46a
291f14d7f8c590578ffb4b99e918aa672d5edd2121e6d1fffae8c8742d38b37a
293914cb953179d8dc5fcb8de2abc4c96947d445224c1e8fd578e4b8632453fb
2a2b1d84aeb89f7b5e7401962d65b5d973b5fbf73c0fdc428126f85163472e52
2cb6d99c8ba2262a4d0c6d0333a35b67be6d4db6c5a7d2c4a9cff74e5970e4f6
30c48eef4e305a1f7e77d50dcac4b5f7baf250b0d55dfbab468db645bfb13c65
369ae154eab37b7ada7776b934833183bb053ebd1d0255f70ef8944f65cabb0c
395121e5b9981325951ef88bec68d065d23087b16a70d4459109e1dd84a10936
3c1653d2241596010eb38c5586a6c4d38b7ce7537b1304862bec7acee4321b46
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3e501b5b3ed35e7d60d62881683a90fb3cd6c6ac2b307b57a7eeba646d935b67
3f1471c449f4069c6b7b63e0b34c6e18fea65406b18fbe2923735e2565685193
4099d721537d0ccf3989ea3352c1652a4314d05124540003980312de92fe9c03
42f679ba13b77c3f4ed99e4fdf01134b34688f874db52e55d59149008b4f5c3f
49129152a148d9d9b01aa274f237488ce89a0649a48fca094cea8ee1465ad6c1
4c8e1579aa7404b9625c0fc00902f78b726da2e5ffe42569f4a3f45298dafb55
50fe1014e82dd9acea2f5b26061c8f135cb11ea0aa5d5ad5985e6b265b7f50a8
55dc85197400fd84d3861297b615c45b4c99ba4586ef2298bf1d5a874afadbb5
6125eed92fe0627dd65adf1c932b4abbe8d265324594c7056ed8861f28edff33
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c4a06d4f782d24c9218dd38b1984a074e5669bc0d38e26ba9155991ed243d9b
6cc48538a4a10e1241d355778c77d333a40d37c3c447240167d6423d1d168bf4
765eb1dcd37c5d83c3df75654fda881374d5135474c7bb3029ae61bc9942515c
7ba9588f5501fa6f9bd65a6e698689f9e0d8b5fdb9d79fa7011ddf9ed983afe5
7e7e72eecf6a4fb2981627eb8d15b947d394398db4e67c7ca7705749cdb2f832
83b9c9675e2754f8b004c403581a8558c16f81cf746c57241b5fc8c101f6fb94
8f545431e89887d72de299c18b62a28a0cec08cde2d8e010f2560f2ebbbb73f0
9124a5c88305bdb315b7480560abdd5d814c23e2f026468568c4c527e9f5c70e
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9ad0d8bf9e4659eb773ec937a69b25c1e8869b17c43acd258f01e268f0194088
aabbd49e260bed02e16c62f62040090f98a885fca0e51f1530d9582371e65f10
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b715034010b1479e7a4a2e5d571689fd05142a6a765fa341fb8f61e9ce576329
b8493592356a9abf9a1f65e29133bfdad0916a3b59d3342d6f9d0695f13cdf64
baf94589b02ec4c06550ef6e1b73303943cf82dcb47705551e2e4702c415bc95
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc17aab3fc9b02ba142116a42c0cc5d0898e5dedf9d298b90c7fe38377a96a56
c0768972024b3cf4d8561b22d1d60eae9c35f447c319b3142238f4da73651650
c3eb98f65e4a84641eaa826018905207de425e06ed526fa2b7b8b9861fbeb42d
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c5cf43dc4abb60d3addc9541d4ea585937f1cc7357375e577e80390c35839a1e
cca60d3beeb7fae944cfb31e92bce126ac7ac3228a2bd580e51d9340b6c56535
d3037f42050da6c98f31f801c26a5fe3df7327240ce40314b805e5e25b052ea2
d8d7f71d80b95e2b5c71177e13e2a6c6eb13954ca4d1b0600eedf43fc38fbbf2
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9c9244f08810a7573b16fd89288d4587f617de4c005b3e4d74ee034b6dbf280
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f322afdaf7184e4ddd7fca589f89cdd7e2e2721dffbf8abed7cb1eca88b0915f
f3aba9db1978f53e330395a56c703f761f74d6d782c2a973baef6f457871f27e
fba31c2cd9699431dba47604216525f9bcc0cb1d5980fbae9b19c8b86454d2fc
ff43a448308aee8d41cda3e357b2e9af72980e5c7603779cbbf00faa4de2dd27

www.netcraft.com Open in urlscan Pro 2606:4700:310c::ac42:2cae Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

71 Requests

97 %HTTPS

59 %IPv6

16 Domains

22 Subdomains

22 IPs

2 Countries

1186 kBTransfer

3665 kBSize

4 Cookies

15 Outgoing links

Redirected requests

71 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.netcraft.com Open in urlscan Pro
2606:4700:310c::ac42:2cae Public Scan

Screenshot
Live screenshot

Full Image

71
Requests

97 %
HTTPS

59 %
IPv6

16
Domains

22
Subdomains

22
IPs

2
Countries

1186 kB
Transfer

3665 kB
Size

4
Cookies

71 HTTP transactions
1 data transactions