www.cyberhaven.com Open in urlscan Pro
18.102.16.191  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 57

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQIHNfA9RK0FoQAAAZQ_7Xtkbq1nIKvll01HC9kLotWOq2mLM4jgV8wQyCR-fXQg76fVGA

Request Chain 109

• https://rp.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=1d8a3ed7-f3d0-45ea-9ad6-842ffb8e7f4f HTTP 302
• https://rp4.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=1d8a3ed7-f3d0-45ea-9ad6-842ffb8e7f4f&i6=MjAwMTphYzg6MjQ6NDQ6OjE3

116 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Show response www.cyberhaven.com/engineering-blog/	85 KB 28 KB	275ms 88ms	Document text/html	18.102.16.191 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 18.102.16.191 Milan, Italy, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-102-16-191.eu-south-1.compute.amazonaws.com Software / Resource Hash 374b4e4c2967d68612369715d8fdfa2d67e501672dd421ea0c920b554d7c014b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 344796 alt-svc h3=":443"; ma=86400 cf-cache-status HIT cf-ray 8fe2a6c578bdeea5-MXP content-encoding gzip content-type text/html date Tue, 07 Jan 2025 08:41:54 GMT last-modified Fri, 03 Jan 2025 08:54:38 GMT surrogate-control max-age=432000 surrogate-key www.cyberhaven.com 64deefeac57fbbefc32df53d pageId:659f33bed6ad85bae1aa7e8e 659f33bed6ad85bae1aa7fe2 659f33bed6ad85bae1aa7e5e vary Accept-Encoding x-cluster-name eu-south-1-prod-hosting-red x-lambda-id 3d3d8f3d-397e-4aed-92cb-855b77169a14
GET H3	200	cyberhaven-2-0.86aed3ac6.min.css cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/	295 KB 55 KB	97ms 50ms	Stylesheet text/css	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 022b3ae6836331aad99fe7188dc82318a16e4b805e61415ff5e0b69b71a61e64 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT etag "200c4bd891e0f5960d86e75969e05382" x-amz-version-id bQRBeOFZBEAeokUm.onkoSshbRRsmWHE age 494292 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:54 GMT content-type text/css last-modified Wed, 01 Jan 2025 15:17:34 GMT vary Accept-Encoding priority u=0,i=?0 x-amz-id-2 /fiSwiYp/TZ9xjmZwPYTwxY4oQU1D1fo1cHfkJ+J3Go3I+7UWutM+oWZH+V/gfjYlcOpUWgG9ps= cache-control public, max-age=31536000, immutable x-amz-request-id 4FZ97WFC0T35CWE9 cf-ray 8fe2a6c64ac4dbce-FRA accept-ranges bytes access-control-allow-origin * content-length 56247 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	fs-cc.js Show response cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/	29 KB 11 KB	87ms 33ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bdeed7650697bd478a6b0591a9ea29664b04a6681a4f9f7c4c2d3d10cdae42a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"73ae-nwFPCwd3UXiTZ7YuAXjbCNGDpOw" age 6344 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f%2FRkswCgdAXSdNvff7ro1IEToQLlepkmWCoWyd45Gy5VklLx1j2w3Ro%2B9347xX5Op8%2B5CzpcK%2BU3NqqeYOiiyoo%2Bssn9isDRCsHI5ItayS0gKTgJI%2ByMyi8%2F1WZwNMXcBdkfH64c2%2BefSesPoVU%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:54 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230135-FRA, cache-lga21946-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c64999eea9-MXP accept-ranges bytes access-control-allow-origin * content-length 10845 server cloudflare x-jsd-version 1.15.0
GET H2	200	js.cookie.min.js Show response cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/	2 KB 2 KB	84ms 31ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/js.cookie.min.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"6c3-1s0eec7oePdhcVrYEdKeoGY3QW4" age 1043419 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=00RjYleZ7CBRZd9agXp1%2BhVYkMFSZdxvb%2FfmOgAD0dup5eVmPxYuevw%2Bxh%2BeFX0N1p3TVDpUV3FwcqQ04kXJX%2FVN6PNpGEv7tRSVcaqix3ZAVnia3ryAnCIQ5VnVMFcwo0vLCZ9mlgbSy4DQ4wg%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:54 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230030-FRA, cache-lga21946-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c64995eea9-MXP accept-ranges bytes access-control-allow-origin * content-length 860 server cloudflare x-jsd-version 3.0.5
GET H2	200	readtime.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/	4 KB 2 KB	33ms 32ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/readtime.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 164406864a5606d7181ae4c6f6b48c19478bbc7377178b51c0f53c68a28fe58d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"f7c-CEGEZn4mJhUtZe0HPZGxMFBlZeE" age 2825 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jCDkq6YQ3NivM0K0SNm96uHGBN%2BcDP2Kg2oGCQvVanPSfiZiZf3qJ0xv%2FBgypTMuPQ6XhEDlEWbFQM4Y23o3ee9yLHYS32kRtao6eg2kdLUUiF1kiKt4vcAMUJ5OwEnUO2dc5u88wcZjTnwVIlY%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230158-FRA, cache-lga21954-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c71b09eea9-MXP accept-ranges bytes access-control-allow-origin * content-length 1918 server cloudflare x-jsd-version 1.2.3
GET H2	200	richtext.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/	8 KB 4 KB	33ms 32ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"2147-I41v+oq443LPQB6aPqMil27q9QY" age 6287 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LZI2nU%2FSB%2Bon450w4SkU7RW2MPiGRQQqp14ClUGXhk6uxzL0VQVnAPmHkwqstAO0u5%2Bns1fHjuD7vJpghk5HMS08UliriCUf0wyPMfCvHPgqIZALvljbLjcbv%2BeVjDuLLzX7Qp5gqrab5Q6%2B1r0%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230147-FRA, cache-lga21959-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c71b0beea9-MXP accept-ranges bytes access-control-allow-origin * content-length 3918 server cloudflare x-jsd-version 1.10.2
GET H2	200	socialshare.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/	9 KB 4 KB	39ms 38ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/socialshare.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eafd7e17be354753ca120ef03d28aa45a37c423e89e9f2602e8fd5a24400f150 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"2385-rwl9CAsmlk954AGumYBzecK5wJE" age 777 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aTQeFIC3G2ELzFPud%2BpdLEVY4GyvrIjVuakxg5OfolsCH2EIogMpW4xJg71IStSQeIELFweVZaEa8264SGMEgVDjRst5CTBuTj8JQ4PErpySCtU6unkzSsCd9Pb5uOapS7LNNPGq4s6mH4aLIIM%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220106-FRA, cache-lga21920-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c71b0ceea9-MXP accept-ranges bytes access-control-allow-origin * content-length 3619 server cloudflare x-jsd-version 1.3.1
GET H2	200	codehighlight.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/	4 KB 3 KB	33ms 33ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1254f8919b622330bce321d396d373e92655485778b03d3d1a04d493d44431ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"1182-meaOv3e3adqfyT4jIRjTa76pxz4" age 6193 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BpTstwvL%2BAXR33HrPRgBEM%2BoM9Mf8SA0kN3vEZ%2BCQUPTg54swdwgC%2F5TlU4Uk3WJ2kUjPcdRkrrzfBpYBBkkezeavn1huwqhemRq8PjkN5oRLG5dlUCuwXMd2N9ZwqQ2FpdLyUGcSwGAJLcWaVo%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230089-FRA, cache-lga21972-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c71b0deea9-MXP accept-ranges bytes access-control-allow-origin * content-length 2031 server cloudflare x-jsd-version 1.5.2
GET H2	200	toc.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/	22 KB 9 KB	31ms 30ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8f3080c9459e76305ed52789a727b30786b4d8e27da652424db04a22f42ad83d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"57aa-2Zkk0AqSUYYUIrrzTHESzGgsbdg" age 5135 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M4R1H%2FX8IjcN4xA1%2BZOf%2F2AdEBQIkqpXrqU0wmNGeRB8DY1eOdb%2FEd4PYsl1lx%2FHLyrw4ILC5KgLC%2F5RMIFc84hltChCXRPDgN3axV5OntdMp9wo0CddSMIiWCZN14OWXnDSoPrIf3%2F8drQ1MvM%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220054-FRA, cache-lga21947-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c71b0eeea9-MXP accept-ranges bytes access-control-allow-origin * content-length 8646 server cloudflare x-jsd-version 1.2.4
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 32 KB	158ms 50ms	Script application/javascript	52.222.232.47 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64deefeac57fbbefc32df53d Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.232.47 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-232-47.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" age 69556 access-control-allow-methods GET x-cache Hit from cloudfront x-amz-cf-id N4hXFBLcoambK3nqRow0Mu-6tNQcffC6mBxeRCSREPbieJRJN_XmDA== date Mon, 06 Jan 2025 13:22:40 GMT content-type application/javascript last-modified Mon, 20 Jul 2020 17:53:02 GMT vary accept-encoding cache-control max-age=84600, must-revalidate via 1.1 387adc951beb5181d840dfb5d1f09488.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P4 server AmazonS3
GET H3	200	cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Show response cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/	708 KB 173 KB	156ms 120ms	Script text/javascript	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9c433a9098a5976b8d58b4371e89daafba4e0e9a05f5c880fe821355ba88684 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br cf-cache-status HIT etag W/"9792b65f944e5a2e92eae714f7201221" x-amz-version-id _GYyTxRjAFzEvmpHerpKKUquAFj9B32p age 782782 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:54 GMT content-type text/javascript last-modified Fri, 13 Dec 2024 17:48:45 GMT vary Accept-Encoding priority u=1,i=?0 x-amz-id-2 D2bsWaHyprSXvd87ue+PCwKZfSPnhiTzdxn/fJRHpvBk4DuC/lSOIvxw1bB0R4bnXgY2+4840u4CG7QbHlql0JpGqdVm0wnB cache-control public, max-age=31536000, immutable x-amz-request-id 289MC3GK1EGQP97Z cf-ray 8fe2a6c64ac6dbce-FRA access-control-allow-origin * server cloudflare x-amz-server-side-encryption AES256
GET H2	200	form-124.js Show response hubspotonwebflow.com/assets/js/	10 KB 3 KB	133ms 48ms	Script application/javascript	66.33.60.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/form-124.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"392ca1f460caa2aa9439969a89f31c13" age 4726235 x-matched-path /assets/js/form-124.js access-control-allow-origin * date Tue, 07 Jan 2025 08:41:54 GMT content-disposition inline; filename="form-124.js" content-type application/javascript; charset=utf-8 server Vercel last-modified Wed, 13 Nov 2024 15:18:09 GMT x-vercel-id fra1::wx59m-1736239314973-60d45bc7dc73
GET H2	200	gtm.js Show response www.googletagmanager.com/	412 KB 128 KB	175ms 81ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a119bcd5cbc420dd5fc5057dd30ee71ea0cbaf58cee5aca6425b7589dcdca7e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Tue, 07 Jan 2025 08:41:55 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Tue, 07 Jan 2025 06:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 129845 x-xss-protection 0 server Google Tag Manager
GET H3	200	676f447859d64b55526ac4ea_blog-hero-analysis.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	48 KB 49 KB	55ms 54ms	Image image/jpeg	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f447859d64b55526ac4ea_blog-hero-analysis.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02aaf64a14db538fd05ce260e97c3f59f34a811893d73928062a45e84de742e1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "1a76135b309733c2491985966d6d0560" x-amz-version-id NJizZKGhA87OUnTBSjxtYx7nz4yGTCP8 cf-cache-status HIT age 885917 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type image/jpeg last-modified Sat, 28 Dec 2024 00:21:14 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 Qy3zrnZgmFsE/4dsuHi7OyUUHumWdIC39Esjw//AtgIAtK9oKqYj3qjTQshKhoYU8pG3K79yI+z+X9RwgX6NnA== cache-control max-age=31536000, must-revalidate x-amz-request-id 48X8RF9W2YEP8VSP cf-ray 8fe2a6c72be1dbce-FRA accept-ranges bytes access-control-allow-origin * content-length 49457 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	85ms 84ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d04419609e6fa08a420ce68756b9bb81fc4ccde283575fb42ffc443e2caf3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "7017fb33ca20ea6252530f4175b595c6" x-amz-version-id nbgTfi_RoVFp7TQUfwt0fBsEIuZbE9lh age 2339133 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 gJhMn2Szeezt8PuGVLNAfz+oPTCXmHeCnPf6C14Hf6+WczXoQSvUeJv+ZErtYdEEW9GBl8NY4stVwvC3++0nIxMdwKCQXH9S1Eyr89nCsbk= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTCZ1ZWMJY9PQTZ cf-ray 8fe2a6c77e51bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 30936 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	121ms 120ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3edff1ede4f95fec11b4ad510397682faac14c622267b92fe314f6860f6eba12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "c74d82a73f65864871167b931348f7dd" x-amz-version-id 0K0YF9sKMHh27RzbO2HdYO7f4xfHi1Ni age 2339133 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 MCQEkNI9Skqtr9UHAlvblDXtXn39LUjYsuoQFWJpCnk8xjEAlGHCYc29sY+wKAKPHtqGdhoW3iD6nmRIMvp0B9f394igWsOQgIZcvgApZ8U= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTC6W8VNHM33H8W cf-ray 8fe2a6c77e52bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 30952 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf53f_TWKLausanne-300.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	29 KB 30 KB	157ms 157ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf53f_TWKLausanne-300.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43e196dea1bb50052e39bb72d5146ca65dcbeddbb56ca9f939d85c39e152f219 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "b6399e7dcfa3936c0f20e75e8ea070c7" x-amz-version-id ZBYM2pzvY3d3.LCU5xbdDaV6IOyUyQV. age 2344003 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 m6ydf77jwkKftQxQBU+1M7YG7wNfzAtOdtxHC2HwfIJKxLWi12d9A5YS1hbQnKJVPkvqhNiPYyo= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id S0D843DW7FKQQXYN cf-ray 8fe2a6c77e53bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 30152 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	190ms 190ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17e921e79da7db5200bf6306e57c9a561ff4dfa1215d250f15384aa0d23a1d23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "698fbe394f26b24fe5bda79219e312ea" x-amz-version-id IB8aQpEKbkqJmVgCCA4g6ZnSKyG9yt.w age 1556369 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 20:34:13 GMT x-amz-id-2 lWnJbBoYdD7v8nAlLgeBjKNMLGVzMxjjrSK0yEyJ4/DAyqXU6aLtiMepqs4AErNOc8hviv/0vj7qzy17gG6Az5fLNIwiAVP0CzNv3J3ZVNA= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id Q7X64X2SFZH10WMY cf-ray 8fe2a6c77e54bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 31088 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	31 KB 32 KB	192ms 192ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf477dd7f1f2598513f268e5d86db59f2bf78cf5608b6d2b3bbede1ae015749d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "1079ff010de8753eb2eea411463e0a91" x-amz-version-id OlnoJq_KD3p4L6Vhpcl.niE2c5DijABz age 2328731 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 CtRoGf0fu8vjwsk9g5jMaubzrfJ+qErHoNOnNfkVGIeVDyb1Y8ZOyc1MyU0EULHa/VVpuv19F0c= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id H0PJZEQK51F6QYXP cf-ray 8fe2a6c77e56bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 31836 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	231ms 231ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f80afcc11946f09caeaad7fdd4febb98bbb145a41e24bfd36bd482bdf70caa3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "a1659b77956f1919811ab7b82c2276d5" x-amz-version-id YuICHYP_D8aK2yDWMfwtWbNeUZaHyz29 age 2344003 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 P1Q3i9+ephkS6tkM7ppEHyk0CazjiDVvbQycOxzKRmlE4/0kfBKH/2djV9BYPTBYdHN/NH8ARZL9YS1fsmJ5/jrlxfmtwPWUEwihAsNp3hM= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVT0KJSYE65TYGV5 cf-ray 8fe2a6c77e58bbb3-FRA accept-ranges bytes access-control-allow-origin * content-length 30716 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f444c8108263f227e2659_Cyberhaven%20generic%20author.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	6 KB 7 KB	69ms 69ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f444c8108263f227e2659_Cyberhaven%20generic%20author.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68e2330e1344b9b74b1fe80c5762cd25dc38d48e4729a68e9efb08dbd871342c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "cc8175b9379835524077dbb651fc197f" x-amz-version-id Z7kNl.q4o2SWLNrLL6g88z625u7bIGzM age 885917 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:20:31 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ov4NQLfBHdAZF9TOgIKrXpnUY88Qs/dcrW9K7wQJQYQeYryhqSI9o+UwAWGTyn0dGTg5wChhLdoBEL/emH+7X5FadsBkGW3ZP6geHfvCP/k= cache-control max-age=31536000, must-revalidate x-amz-request-id 48XB49GWVZR1NZJE cf-ray 8fe2a6c73c08dbce-FRA accept-ranges bytes access-control-allow-origin * content-length 6596 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	68 KB 69 KB	70ms 68ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efd70a126766db0daeb2d0a39246bb00e2f5af423f2deceb8fb87febfe14970e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "811b488ff94f4f0b1f857afb7930bec9" x-amz-version-id C86hd2YZSjKZzA88LiOcRnpQygUaeudY age 4000 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 DDrxYC2qlrdEhexHdG6s7Z+R/3REuezcM6Md535traQY3vxFInROKTawEqk1ypTe1+C3Z9ETAcc= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZJ5HCF7J11Y25H cf-ray 8fe2a6c73c0adbce-FRA accept-ranges bytes access-control-allow-origin * content-length 70038 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	166 KB 167 KB	68ms 67ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38949f97e6770288dcf96195e601480f85bf502a50da7a2a6907a932092ffd34 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "ecb0956c5cf844c67d6066e1516c449a" x-amz-version-id w75.YwkqNAkX8P94nx3CfN3GO7XH6OWq age 3907 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type image/png last-modified Tue, 31 Dec 2024 21:58:05 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 CZ1dUPt4pSTTt5JWIdGVI179jysW5De1WMhdf8aL/9I9EFxzJ+rRxfnyDYs9SX/Gdur9h0AOhLI= cache-control max-age=84600, must-revalidate x-amz-request-id 12SSQKMM1T7CC4S3 cf-ray 8fe2a6c73c0bdbce-FRA accept-ranges bytes access-control-allow-origin * content-length 170083 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	highlight.min.js Show response cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/	113 KB 41 KB	31ms 31ms	Script application/javascript	2606:4700::6812:bb1f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bb1f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1828162a4978444dfe33f4cd1f977f17cd13cf7d0f413f8eb9bab9437239736d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"1c30f-0mStFr3znP7CsGwgIjuH/LN60ns" age 1238356 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gKLeuNQpVZ%2Fj2DKrUm1aisZeM8sapek5TqRjJNIKtDrxu62iYg8Qmrrx8kVoEtinPsNMpUJzWRESHJW9W5TrRgjOyivPhaNkJ0nio08BrjaiKxUR8sHxKGb6hwnvdWY5W9EqqKDS3vF%2FZJ5qc1s%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230041-FRA, cache-lga21992-LGA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c75b60eea9-MXP accept-ranges bytes access-control-allow-origin * content-length 41100 server cloudflare x-jsd-version 11.4.0
GET H3	200	github-dark.min.css cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/	1 KB 1 KB	51ms 50ms	Stylesheet text/css	104.18.187.31 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/github-dark.min.css Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.187.31 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f208d022102b1d0c7aebfecd8e42ca7997d5de636649d2b31ea63093d809019 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br cf-cache-status HIT etag W/"523-oe0DT1osdtatoK9R3LMOLlr5NqA" age 8869587 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Fq9%2FndYecY0qr3gqxD6xA5fLk0ZMOdAiP1rsz2P53VLJPoaRu%2FDKNNyAFr8rvl5pYiha0YWM%2BzJurfsQBqrWVRwX6%2FYh9s1q5CntN%2BLKUPGNnlBLC3jdg2bqg5OCrCE4udQ%3D"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443"; ma=86400 x-cache HIT, HIT server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-eddf8230039-FRA, cache-lga21967-LGA vary Accept-Encoding priority u=0,i=?0 strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8fe2a6c7fba6904e-FRA accept-ranges bytes access-control-allow-origin * content-length 619 server cloudflare x-jsd-version 11.4.0
GET H2	200	bda12b36-0455-47af-b8ba-9529bbb134fb.js Show response j.6sc.co/j/	4 KB 5 KB	477ms 365ms	Script application/javascript	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 73c5c9fb7e8e51a3af35769a05cac8b20493d7158c284c504f93eab13d0d53aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 cache-control private, max-age=1800 etag "2a619c6409aef52add1c19ae5d16a447" x-amz-version-id N26XcBiiU4KO8qPH4s3OdRIA551zYsKR expires Tue, 07 Jan 2025 09:11:55 GMT accept-ranges bytes content-length 4528 x-amz-cf-id PHSnhiN3vWMVHjYxmPQWV-UE20o4vqmK2oN4kC8Qe50JQagOOnW_xQ== date Tue, 07 Jan 2025 08:41:55 GMT last-modified Thu, 21 Sep 2023 21:57:20 GMT x-amz-cf-pop VIE50-C2 server AmazonS3 content-type application/javascript x-amz-meta-content-type application/json
POST H3	200	collect www.google.com/ccm/	0 0	111ms 43ms	Ping text/plain	142.250.185.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&scrsrc=www.googletagmanager.com&frm=0&rnd=1844795870.1736239315&auid=715833945.1736239315&navt=n&npa=1&gtm=45He4cc1v832240631za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1736239315355&tfd=777&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	422 KB 134 KB	65ms 65ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 78ede3195eab0a077cbd4a7fcd18880f771d8dc4c45c943c836668325f33a6cd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Tue, 07 Jan 2025 08:41:55 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136806 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	25 KB 9 KB	118ms 34ms	Script application/javascript	2a02:26f0:480:15::213:7e63 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=79222 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 9404 date Tue, 07 Jan 2025 08:41:55 GMT last-modified Mon, 06 Jan 2025 08:56:54 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	120ms 35ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Tue, 07 Jan 2025 08:41:55 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 20:04:45 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kcgs7200099-IAD, cache-fra-etou8220109-FRA x-amz-server-side-encryption AES256
GET H2	200	hotjar-3169094.js Show response static.hotjar.com/c/	13 KB 6 KB	152ms 69ms	Script application/javascript	18.66.102.53 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.53 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-53.fra56.r.cloudfront.net Software / Resource Hash ae19f83fb953b2fbc9e674924efca85967b5d4c01d78b33ba76a960d3388597e Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 content-encoding br etag W/1b6464d3a17257030fcc0318730406af cross-origin-resource-policy cross-origin x-content-type-options nosniff x-cache-hit 1 via 1.1 b9d2ce196c8a711fb15d92175d58476e.cloudfront.net (CloudFront) access-control-allow-origin * x-cache RefreshHit from cloudfront x-amz-cf-id NVmz28fScL-UjousKEyoelKMQ-iKM97P8PRob6nZ1d2NEmfMsf91GA== date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding x-amz-cf-pop FRA56-P2
GET H3	200	2985.js Show response script.crazyegg.com/pages/scripts/0115/	7 KB 3 KB	109ms 50ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0115/2985.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0d810efe03fa42a406546c8b52a2b9623d2625938f7e1048fba55a71f99eafa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 486 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript last-modified Tue, 07 Jan 2025 08:32:32 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fe2a6c98a4edc70-FRA accept-ranges bytes access-control-allow-origin * content-length 2480 ce-version 11.5.340 server cloudflare
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	85ms 24ms	Script application/javascript	2a04:4e42::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Tue, 07 Jan 2025 08:41:55 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	74ms 36ms	Script application/x-javascript	157.240.0.6 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra3.fbcdn.net Software / Resource Hash 4b851bd9af5635c2682387427eb718d453b8e7aeefdbb01c8521ab32a49004b3 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-CTn146EV' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-CTn146EV' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=34, rtx=0, c=23, mss=1232, tbw=4493, tp=9, tpl=0, uplat=1, ullat=-1 pragma public x-fb-debug JxcpljY7N2QVn/g+A8rs9XCht25EMnA75XjyfA2fseD5eox1VlpPg4Z9SqV5gN6ojWNBQJ3X1/ogRbpDc6U7UQ== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62279 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	116ms 36ms	Script text/javascript	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip age 2224 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],} x-content-type-options nosniff expires Tue, 07 Jan 2025 10:04:51 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:04:51 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 17168 server Golfe2
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/	16 KB 5 KB	293ms 210ms	Script application/javascript	2600:9000:2670:6600:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2670:6600:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Clearbit / Resource Hash 11e852bb791058078812ff8c0780eee92054fbaad4e03ca2f4263576ee487ac7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip etag W/"baf7329e47c04b0ab497040e04f53af5" x-envoy-response-flags - x-content-type-options nosniff via 1.1 129f13101f12370407d42127c62b1bd8.cloudfront.net (CloudFront) x-cache Miss from cloudfront x-amz-cf-id AFCIrJruySg-yWkPvuLweBe6sS85REIdT5-L30XYVQfpZ_dZKRg_-A== date Tue, 07 Jan 2025 08:41:54 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit x-amz-cf-pop FRA56-P9
GET H3	200	62febdf93e32fb008eef5596 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	356ms 307ms	Script text/javascript	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62febdf93e32fb008eef5596 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash cc6f75e6d9ea73d0799129de3d0ab931372ac20f027c591fcb816aea85599b13 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript vary Accept-Encoding priority u=3,i=?0 access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url access-control-allow-credentials true via 1.1 google cf-ray 8fe2a6c9ff783764-FRA access-control-allow-origin * x-powered-by Express server cloudflare
GET H3	200	warmly.js Show response opps-widget.getwarmly.com/	1 KB 2 KB	133ms 77ms	Script text/javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 854515f13a032302be50faa83c7033319558bda07e7c22cb0befe1af42ecc015 Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status BYPASS etag W/"b12c9bbe9dbabc368ad6370931d3a9cd83071e17ad3929182123e049cbad032b-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kUH69x9x54fXdtndaO%2B0AT164j4NX8Vsgu2vSVEaqnEbb6ZhtP3O5zL7KhaxQGBbrDDIytBfX53Ri5ewMI%2FSXmASkfzJVS1guQAMn648m8KoafFIxElmWBIQ5jMK%2BVYElIEfvh7B1EzL8R4N"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache MISS server-timing cfL4;desc="?proto=QUIC&rtt=39459&min_rtt=39307&rtt_var=14849&sent=12&recv=7&lost=0&retrans=0&sent_bytes=4158&recv_bytes=4271&delivery_rate=81151&cwnd=12000&unsent_bytes=0&cid=e9be9bef980b410a&ts=81&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 03 Jan 2025 16:48:06 GMT x-served-by cache-fra-eddf8230078-FRA x-cache-hits 0 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=3,i=?0 x-timer S1736239316.558018,VS0,VE26 referrer-policy origin-when-cross-origin cf-ray 8fe2a6ca2f6dd34d-FRA access-control-allow-origin * server cloudflare
GET H2	200	5298086.js Show response js-na1.hs-scripts.com/	2 KB 1 KB	87ms 36ms	Script application/javascript	2606:4700::6810:89d1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/5298086.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8c7ee2f1c3c108a83ad4093f6b1dbf6468a9574cbe093db002f25a51e7ca5671 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3600 content-encoding gzip cf-cache-status HIT age 736 x-content-type-options nosniff date Tue, 07 Jan 2025 08:41:55 GMT x-hubspot-correlation-id 1207d221-1592-49e0-baae-050c840ccbbe content-type application/javascript;charset=utf-8 vary origin, Accept-Encoding last-modified Tue, 07 Jan 2025 07:52:50 GMT access-control-allow-credentials true cf-ray 8fe2a6ca1829ed2d-MXP accept-ranges bytes access-control-allow-origin https://www.cyberhaven.com content-length 655 server cloudflare
GET H2	200	array.js Show response us-assets.i.posthog.com/static/	176 KB 62 KB	89ms 36ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/array.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2bf4e078345423decaacc91d08fe3dacbb7c75212cb8fac0714f9183352aab73 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 age 287 cf-cache-status HIT referrer-policy same-origin x-content-type-options nosniff cf-ray 8fe2a6ca2d560e43-MXP access-control-allow-origin * date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 22:35:11 GMT vary Accept-Encoding server cloudflare
GET H2	200	web gtm-server.cyberhaven.com/measurement/	35 B 386 B	281ms 218ms	Image image/gif	34.8.125.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://gtm-server.cyberhaven.com/measurement/web?event_name=page_view&event_id=1736240217627_17362401611851&page_location=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension%3Ffbclid%3Dnull%26li_fat_id%3Dnull Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.8.125.141 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.125.8.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires Thu, 01 Jan 1970 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT content-type image/gif server Google Frontend
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/5160/ Frame 17D9	0 0	114ms 37ms	Document text/html	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/5160/sw_iframe.html?origin=https%3A%2F%2Fwww.cyberhaven.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 45201 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Mon, 06 Jan 2025 20:08:34 GMT expires Tue, 06 Jan 2026 20:08:34 GMT last-modified Mon, 06 Jan 2025 09:38:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_kk14jgkb/	3 B 124 B	82ms 26ms	XHR application/json	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_kk14jgkb/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json
GET H2	200	t2_kk14jgkb_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	80ms 31ms	XHR application/json	2a04:4e42::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_kk14jgkb_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	191ms 126ms	Image image/gif	151.101.65.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1736239315451&id=t2_kk14jgkb&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=68cf4be5-6437-4ac3-82c0-d12d4aa77e84&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Tue, 07 Jan 2025 08:41:55 GMT content-type image/gif server Varnish
POST H2	204	collect region1.analytics.google.com/g/	0 0	124ms 45ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-WLE78NS0JZ&gtm=45je4cc1v890707664z8832240631za200zb832240631&_p=1736239315039&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=377940759.1736239315&ul=it-it&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1736239315&sct=1&seg=0&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clean_url=www.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.clean_path=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.level1=engineering-blog&ep.level2=cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tfd=918 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 557 B	142ms 45ms	Ping text/plain	2a00:1450:400c:c1f::9a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WLE78NS0JZ&cid=377940759.1736239315&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c1f::9a Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT content-type text/plain server Golfe2
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	137ms 51ms	Image image/gif	2a00:1450:4001:801::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-WLE78NS0JZ&cid=377940759.1736239315&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=2080823695 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Tue, 07 Jan 2025 08:41:55 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/site/	5 KB 2 KB	107ms 63ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/site/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a847106a1e15febbca530642206207743e1e3cd270991f503aed807bb52f290 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 563 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json last-modified Tue, 07 Jan 2025 08:32:32 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fe2a6ca5a0803f8-FRA accept-ranges bytes access-control-allow-origin * content-length 1779 ce-version 11.5.340 server cloudflare
GET H3	200	321517546861767 Show response connect.facebook.net/signals/config/	69 KB 14 KB	36ms 36ms	Script application/x-javascript	157.240.0.6 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/321517546861767?v=2.9.179&r=stable&domain=www.cyberhaven.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra3.fbcdn.net Software / Resource Hash eb24f0f3a43ff4aac43ed08c045e810d847652a5393b3db67de9f6c055deebc5 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-3kja6Snv' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-3kja6Snv' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=34, rtx=0, c=77, mss=1232, tbw=70509, tp=65, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug +zWlmb9+LXkSc0tyO4Pvf1qFVDsPwRRygPgp5D24juPI4wLHQ29YxVzUdPnjm2TGbImrHLPryJLyyhf5GJjjYA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 14228 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	38ms 37ms	Script application/javascript	2a02:26f0:480:15::213:7e63 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:15::213:7e63 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=85225 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Tue, 07 Jan 2025 08:41:55 GMT last-modified Mon, 02 Dec 2024 10:13:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	adsct t.co/1/i/	43 B 630 B	315ms 227ms	Image image/gif	162.159.140.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=80638611-f861-42d8-bae3-b4b029821ee3&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=fda0cc8b-5d55-4dfd-8901-cbc6100425d1&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=0 x-transaction-id ec4897fb4e3285dc cache-control no-cache, no-store, max-age=0 x-connection-hash b2d3e7f58f329a305e4393d0f1fed463b6ad14663cfc83584fc3bb1ad458b68f cf-cache-status DYNAMIC cf-ray 8fe2a6cae88d913c-FRA x-response-time 173 content-length 43 date Tue, 07 Jan 2025 08:41:55 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 726 B	301ms 214ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=80638611-f861-42d8-bae3-b4b029821ee3&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=fda0cc8b-5d55-4dfd-8901-cbc6100425d1&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 531dc06620066b68 cache-control no-cache, no-store, max-age=0 x-connection-hash 8ec627b579ebed3aef8e72c48e00bdd010199f1374aeefe683618b363de8557f x-response-time 175 content-length 43 date Tue, 07 Jan 2025 08:41:55 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 410 B	44ms 44ms	Image image/gif	2a00:1450:4001:810::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1568866663&utmhn=www.cyberhaven.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=it-it&utmje=0&utmfl=-&utmhid=410912298&utmr=-&utmp=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&utmht=1736239315523&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D154243370.377940759.1736239315.1736239316.1736239316.1%3B%2B__utmz%3D154243370.1736239316.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1981695836&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],} x-content-type-options nosniff content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0 expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:55 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif server Golfe2
GET H2	200	modules.60031afbf51fb3e88a5b.js Show response script.hotjar.com/	223 KB 56 KB	140ms 48ms	Script application/javascript	13.33.187.92 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.33.187.92 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-187-92.fra60.r.cloudfront.net Software / Resource Hash e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b4a1a7933e55e780894c3f39b1aca0b4" age 1716648 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id xuyUzVCdWppbZ4tDXE8n4CzYzTl_4sF2mGG8b6D1WliObII6duqLAA== date Wed, 18 Dec 2024 11:51:07 GMT content-type application/javascript; charset=utf-8 last-modified Wed, 18 Dec 2024 11:50:24 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 2ad26f5878b778b17955978bf962dc9a.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56408 x-amz-cf-pop FRA60-P9
GET H3	200	/ www.facebook.com/tr/	0 16 B	74ms 37ms	Image text/plain	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1736239315556&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1736239315555.711569101418970648&ler=empty&cdl=API_unavailable&it=1736239315510&coo=false&eid=1736240217627_17362401611851&tm=1&rqm=GET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=35, rtx=0, c=23, mss=1232, tbw=4537, tp=10, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Tue, 07 Jan 2025 08:41:55 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 201 B	183ms 157ms	Image image/png	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1736239315556&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1736239315555.711569101418970648&ler=empty&cdl=API_unavailable&it=1736239315510&coo=false&eid=1736240217627_17362401611851&tm=1&rqm=FGET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7457091077566658479"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x388744eefc87a3b9","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["5988309531205427"]},"debug_reporting":true,"debug_key":"4529880373013120833"} date Tue, 07 Jan 2025 08:41:55 GMT content-type image/png vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7457091077566658479", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-debug 2NJhY162WCGFqJjhT1J3my0mJbKnzzQ4p1XWpb6fAQ69G6fRSKEdJ9ibcxGwFwp/YF3IJXhDZrKH9CJy+nCW7A== cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=35, rtx=0, c=23, mss=1232, tbw=4905, tp=13, tpl=0, uplat=121, ullat=0 pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1 KB	260ms 201ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1962740&time=1736239315567&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.cyberhaven.com/ Response headers content-encoding gzip x-li-fabric prod-lor1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} access-control-allow-methods GET, OPTIONS x-li-proto http/2 x-cache CONFIG_NOCACHE date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json access-control-allow-headers * x-li-pop afd-prod-lor1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-fs-uuid 00062b19b7a8a2821462e36d22f0d9bc x-msedge-ref Ref A: 5797B3B3999148C08F512804021E02FE Ref B: ZRHEDGE1614 Ref C: 2025-01-07T08:41:55Z x-restli-protocol-version 1.0.0 x-li-uuid AAYrGbeoooIUYuNtIvDZvA== access-control-allow-origin *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recen...	0 267 B	243ms 193ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQIHNfA9RK0FoQAAAZQ_7Xtkbq1nIKvll01HC9kLotWOq2mLM4jgV8wQyCR-fXQg76fVGA Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 6C2F4159B1FF48F1B016DB7FD56037B7 Ref B: MIL30EDGE1321 Ref C: 2025-01-07T08:41:55Z x-li-fabric prod-lor1 x-li-uuid AAYrGbetmiNX8PRQzJqQ0w== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lor1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736239315567&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQIHNfA9RK0FoQAAAZQ_7Xtkbq1nIKvll01HC9kLotWOq2mLM4jgV8wQyCR-fXQg76fVGA x-msedge-ref Ref A: 9DBA9D351CF8472998A5619A8504570A Ref B: ZRHEDGE1106 Ref C: 2025-01-07T08:41:55Z x-li-fabric prod-lor1 x-li-uuid AAYrGbep5popFiLG0OCknQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 07 Jan 2025 08:41:55 GMT
GET H2	200	config.js Show response us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/	963 B 756 B	35ms 34ms	Script application/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/config.js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224f0faed26a56018f3d6f3d5e8fe2dda990c262ca0903c723145d2b47d1b108 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 286 x-content-type-options nosniff date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript vary Origin, Referer, Accept-Encoding last-modified Tue, 07 Jan 2025 08:37:09 GMT x-frame-options SAMEORIGIN cache-control max-age=300 cross-origin-opener-policy same-origin x-envoy-upstream-service-time 14 referrer-policy same-origin allow GET, HEAD, OPTIONS cf-ray 8fe2a6ca8d900e43-MXP accept-ranges bytes access-control-allow-origin * content-length 562 server cloudflare
POST H2	200	/ Show response us.i.posthog.com/decide/	861 B 836 B	364ms 120ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/decide/?v=3&ip=1&_=1736239315595&ver=1.204.0&compression=base64 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash c28e2af4e14aafdc9b247281d5aa398e81f6c95a1543caa0fdc786ffe4552856 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/x-www-form-urlencoded Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
POST H2	200	/ Show response us.i.posthog.com/e/	13 B 415 B	360ms 119ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/e/?ip=1&_=1736239315599&ver=1.204.0&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 5 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H3	200	4905af20a771527fdcc240cf8ab4172a.js Show response script.crazyegg.com/pages/versioned/common-scripts/	107 KB 37 KB	47ms 47ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f17058a6ac8f171e452a0ed24075c6e592834eef8dc12e343ade35adc73c4cc Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 1047443 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:04 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8fe2a6cabc0cdc70-FRA accept-ranges bytes access-control-allow-origin * content-length 37122 server cloudflare
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/sampling/	160 B 393 B	53ms 53ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/sampling/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2386d4252ee34c93978a4c8e21f0260559e558797bd1995170d862b0c89a6eaf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 563 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json last-modified Tue, 07 Jan 2025 08:32:32 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fe2a6cb9ad103f8-FRA accept-ranges bytes access-control-allow-origin * content-length 149 ce-version 11.5.340 server cloudflare
POST H2	200	/ Show response content.hotjar.io/	56 B 171 B	269ms 123ms	XHR application/json	52.30.150.114 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://content.hotjar.io/?site_id=3169094&gzip=1 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.30.150.114 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-30-150-114.eu-west-1.compute.amazonaws.com Software / Resource Hash 00886e3ae104c47e6772504dc42952b1d0f4d56804553885a6a231c45007dd74 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain; charset=UTF-8 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 86400 access-control-allow-origin * content-length 56 date Tue, 07 Jan 2025 08:41:56 GMT content-type application/json
OPTIONS H2	204	clock tracking.crazyegg.com/ Frame	0 0	196ms 75ms	Preflight	34.255.108.56 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1736239315825&tk=8278c3be49784fffa4a1b15f884798b8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.255.108.56 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-255-108-56.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods access-control-allow-methods * access-control-allow-origin * access-control-max-age 86400 cache-control public, max-age=86400 date Tue, 07 Jan 2025 08:41:55 GMT server awselb/2.0 vary Access-Control-Request-Headers, Origin, Access-Control-Request-Method
GET		97f4143e-d6d3-4c9b-8c53-b57590c0a983 https://www.cyberhaven.com/ Frame	0 0
POST H2	200	clock Show response tracking.crazyegg.com/	41 B 147 B	85ms 83ms	XHR text/plain	34.255.108.56 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1736239315825&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.255.108.56 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-34-255-108-56.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash ee407c1adc69ff82515d74f568999f63675f74a8d42d25ead2dfec2cfd8c46d5 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers cache-control no-store access-control-allow-origin * content-length 41 date Tue, 07 Jan 2025 08:41:56 GMT content-type text/plain server awselb/2.0
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/	19 B 460 B	126ms 36ms	XHR application/json	13.35.58.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.128 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-128.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 9163561 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id H-TuPkk35VomvaeRW3CK8Y8SBoB8dKWLrYq7srQDMMbPXefht5aREw== date Mon, 23 Sep 2024 07:15:55 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 192147d605f496db0417cf30a0012092.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P10 server AmazonS3
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/	19 B 462 B	159ms 45ms	XHR application/json	18.66.122.45 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.45 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-45.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 9678578 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id WiIyZXvL7ZsS0RiVOrv1kktyqIsAlBb3_05Dt7EAAVCrmeJ1enlOdQ== date Tue, 17 Sep 2024 08:12:17 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 1662abbf731d8832e73c83b2467e7f38.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P2 server AmazonS3
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	45ms 44ms	Script application/javascript	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 91c20c70d36b608cf919e894b0ac9e32298d6b3ac3ca59c45a85e7c44161d170 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "6763d39f-1110f" x-content-type-options nosniff expires Tue, 07 Jan 2025 11:41:55 GMT accept-ranges bytes content-length 18919 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 19 Dec 2024 08:04:47 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	0 172 B	314ms 212ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 x-envoy-response-flags - x-content-type-options nosniff content-length 0 date Tue, 07 Jan 2025 08:41:55 GMT content-type application/javascript;charset=utf-8 server Clearbit
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	168 KB 45 KB	361ms 259ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash 9be0e78d405feaf2f28eaa33d8f8b0c298c5385a546d825fba34e81aed740be0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip x-envoy-response-flags - x-content-type-options nosniff date Tue, 07 Jan 2025 08:41:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit
GET H2	200	conversations-embed.js Show response js.usemessages.com/	94 KB 27 KB	92ms 33ms	Script application/javascript	2606:4700::6810:4c8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4c8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d2b03470a7d1ae7aba4f78432a23655d3e5092f63312f3dcc3bd1f3e2ed7ec5 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all x-request-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-encoding gzip cf-cache-status HIT etag W/"4dfe3f6f9786f2063afe9a04ac031914" x-amz-version-id fDaori16DhigsoRwsdU7m4W4sxmAcg6S cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod age 247 x-content-type-options nosniff x-cache Hit from cloudfront x-hs-cache-status HIT x-amz-cf-id j-SnkIpB8dxYR4_xkUb1_co81133geiWWU2BVr0S_m3zvz2sOR5wuw== date Tue, 07 Jan 2025 08:41:55 GMT x-hubspot-correlation-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-type application/javascript; charset=utf-8 last-modified Tue, 17 Dec 2024 16:16:40 UTC vary accept-encoding x-evy-trace-listener listener_https x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-mglm2 x-envoy-upstream-service-time 0 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19372/bundles/project.js&cfRay=8f76c22c89cd8fd6-FRA via 1.1 b77313059f3d50280ced20238b151620.cloudfront.net (CloudFront) cf-ray 8fe2a6cc68b8bb11-MXP x-evy-trace-route-configuration listener_https/all x-hs-target-asset conversations-embed/static-1.19372/bundles/project.js x-amz-cf-pop IAD12-P3 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	5298086.js Show response js.hs-analytics.net/analytics/1736236200000/	68 KB 25 KB	86ms 35ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1736236200000/5298086.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash deff21bdd3cf5ec27f508fe5d3e13bcd67ffb7dda68e07d97582cddc6ab4e7f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 x-request-id 2c587936-fe3a-48b8-a89f-0e7e3e5c574d content-encoding gzip cf-cache-status HIT etag W/"db94dc959471013f74dd433982c87807" x-amz-version-id null age 285 expires Tue, 07 Jan 2025 08:39:45 GMT x-evy-trace-listener listener_https date Tue, 07 Jan 2025 08:41:55 GMT x-hubspot-correlation-id 2c587936-fe3a-48b8-a89f-0e7e3e5c574d content-type text/javascript last-modified Wed, 06 Nov 2024 18:35:26 GMT vary origin, Accept-Encoding x-amz-id-2 9zik9He0daCtV26ZsP+ooCEgg+tu63yp+OtVgAEJAveU6nHRtZ//iCoBAp1jBsTmBAzaDdn3Jyg= x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-dwvmr x-envoy-upstream-service-time 41 access-control-allow-credentials false x-amz-request-id 8RAWF0SCN8MCPTTB cf-ray 8fe2a6cc5b41edcb-MXP x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	70 KB 25 KB	196ms 144ms	Script application/javascript	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers x-request-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-encoding gzip cf-cache-status EXPIRED x-amz-version-id 8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_ etag W/"ceb8bcb73e5536d8416735a3977d227a" cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-content-type-options nosniff x-cache Hit from cloudfront x-evy-trace-listener listener_https x-amz-cf-id 8WfkRX3JAvexG5l-W6G4VtYiAK3XggMdfy0nlP-0JfveLJ71QnecPQ== x-hubspot-correlation-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-type application/javascript; charset=utf-8 last-modified Mon, 09 Dec 2024 13:03:17 UTC x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-4w2hc x-envoy-upstream-service-time 5 x-hs-target-asset collected-forms-embed-js/static-1.1112/bundles/project.js server cloudflare x-evy-trace-virtual-host all x-amz-server-side-encryption AES256 access-control-max-age 3000 access-control-allow-methods GET x-hs-cache-status MISS date Tue, 07 Jan 2025 08:41:56 GMT vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8ef5bfb0bfdeedcb-FRA via 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront) cf-ray 8fe2a6cc5fa7baf1-MXP access-control-allow-origin * x-evy-trace-route-configuration listener_https/all x-amz-cf-pop IAD12-P3
GET H2	200	banner.js Show response js.hs-banner.com/v2/5298086/	71 KB 26 KB	87ms 36ms	Script text/javascript	2606:4700:4400::6812:28f0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/5298086/banner.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1f5bfd29b1b65351bdeec611c0f02131e5a8a7336e2d87075b15dff2b7f3f8f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all access-control-max-age 604800 x-request-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing content-encoding gzip cf-cache-status HIT etag W/"70c5670e6d77885ece19beb74afe4af5" x-amz-version-id GcEt1rgO1vU4WsJ6afMIGzER7IXMa_OI age 285 access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD expires Tue, 07 Jan 2025 08:42:10 GMT x-evy-trace-listener listener_https date Tue, 07 Jan 2025 08:41:55 GMT x-hubspot-correlation-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea content-type text/javascript; charset=UTF-8 last-modified Thu, 24 Oct 2024 19:19:32 GMT vary origin, Accept-Encoding x-amz-id-2 MQCYBvG4V5+djwpG0cU2tMuf/xfG+OQ3887eGE3FR+ewuikvYiayuXnhJbexmo5WsCK+SjZoz4I= access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public timing-allow-origin * x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-85276 x-envoy-upstream-service-time 156 access-control-allow-credentials true x-amz-request-id 6NB4N8W9R5GSAPVD cf-ray 8fe2a6cc5abbbb03-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-amz-server-side-encryption AES256
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 706 B	116ms 38ms	XHR application/json	37.252.171.53 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 192.145.127.215; 192.145.127.215; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://www.cyberhaven.com an-x-request-uuid 9e3ebb5d-264e-4381-9b5c-26486309eb22 content-length 11 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Tue, 07 Jan 2025 08:41:55 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H2	200	/ Show response c.6sc.co/	7 B 196 B	111ms 91ms	XHR text/html	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://www.cyberhaven.com content-length 7 date Tue, 07 Jan 2025 08:41:55 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	18 B 312 B	169ms 70ms	XHR text/html	2a02:26f0:7100::5f64:87f1 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::5f64:87f1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 7c1a5f682648a72bbb85e721f07412653b9c0c71413f677d224e3f06cd2d22fd Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:24:44::17 expires Tue, 07 Jan 2025 08:41:56 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1736239315971_1600423917_1194502018_27_1667_38_68_219";dur=1 access-control-allow-origin https://www.cyberhaven.com content-length 18 date Tue, 07 Jan 2025 08:41:56 GMT content-type text/html vary Origin
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	297 B 933 B	269ms 269ms	XHR application/json	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=c60192ea8e0e44e9858d3f07283d2777&traceId=c60192ea8e0e44e9858d3f07283d2777 Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 16a0077ab1bdc221748940273edcf258f6241f4f0a745c4e0021d15ae18cab38 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 X-HubSpot-Messages-Uri https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vcOUS%2F1c9feA3J8sRiQr7ThMpdiZBJIt8O9WXagVob4tsDuVG%2BGeQhDtrlRFxe5R2ACev1UklRTW6kiF6X8gDkdeO9nqcKLWuI7VS8Jwa2qTpBSa6Xh8LNPwdnAW85BNhQoaRSrLNsLr5WV8gg%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff date Tue, 07 Jan 2025 08:41:56 GMT x-hubspot-correlation-id fc1f9522-4eb2-4f54-887a-a03603df2755 content-type application/json;charset=utf-8 vary origin, Accept-Encoding access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials false cf-ray 8fe2a6ce1d310e8b-MXP access-control-allow-origin https://www.cyberhaven.com content-length 236 server cloudflare
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	221ms 157ms	Preflight text/plain	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=c60192ea8e0e44e9858d3f07283d2777&traceId=c60192ea8e0e44e9858d3f07283d2777 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://www.cyberhaven.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8fe2a6cd1c8f0e8b-MXP content-length 18 content-type text/plain; charset=utf-8 date Tue, 07 Jan 2025 08:41:56 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5L9q6b8aL6cUD8H79i0qOZONRETLbwkRoGilBiGSBsQamawEUaMq7GYwQn4VpXNkF21p7PQ6lHTf3lWh%2BVzLwPmdwRZiiMhquYQU2nqhuCxZxkJw%2FnbfyxV1qBxPMI4Yo57mDpT7nU5Upj7kA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-hubspot-correlation-id f6fea765-ad81-4140-840d-f07c0658b57f
GET H2	200	recorder.js Show response us-assets.i.posthog.com/static/	112 KB 40 KB	31ms 31ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/recorder.js?v=1.204.0 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ec3f8ef2aa975a22f11d5d3592111d857a5917287a00ca6cf191d72859354d75 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 age 287 cf-cache-status HIT referrer-policy same-origin x-content-type-options nosniff cf-ray 8fe2a6ccdec40e43-MXP access-control-allow-origin * date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 22:35:11 GMT vary Accept-Encoding server cloudflare
GET H2	200	dead-clicks-autocapture.js Show response us-assets.i.posthog.com/static/	14 KB 5 KB	133ms 133ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.204.0 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6efafe07fd29b04ec60906d17ea4e89d6c0601d49ff2f160e06d709060bbcee2 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=14400 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8fe2a6ccdec60e43-MXP access-control-allow-origin * date Tue, 07 Jan 2025 08:41:56 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 22:35:11 GMT vary Accept-Encoding server cloudflare
GET H2	200	web-vitals.js Show response us-assets.i.posthog.com/static/	10 KB 4 KB	33ms 33ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/web-vitals.js?v=1.204.0 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7196c8f501e096262228f56c988d4fb9e4b2e3e331e411f40c30e6889f282fb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 age 287 cf-cache-status HIT referrer-policy same-origin x-content-type-options nosniff cf-ray 8fe2a6ccdec70e43-MXP access-control-allow-origin * date Tue, 07 Jan 2025 08:41:55 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 22:35:11 GMT vary Accept-Encoding server cloudflare
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	189ms 174ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:56 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:56 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	183ms 168ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22218d4ca0f0d30c4801ecd3d056a7fae0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22555171e6d4c91ba269d673d31c487f9d31fe33c9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22bda12b36-0455-47af-b8ba-9529bbb134fb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:56 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:56 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 656 B	151ms 74ms	XHR application/json	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash f4a34c3d3a257c60a880889233ebb2169035f172404bc1aad871d90b18170839 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Tue, 07 Jan 2025 08:41:56 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	119ms 38ms	Preflight	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Tue, 07 Jan 2025 08:41:56 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	133 B 639 B	131ms 131ms	XHR application/json	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=5298086&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51cde42c03bdfd44328fe282089cbd8e3ee5185c09d38ac0814480d824de684a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, */* Referer https://www.cyberhaven.com/ Response headers x-robots-tag none access-control-max-age 180 x-request-id 66089329-23e4-4adf-9112-5b6b8993966b content-encoding br cf-cache-status DYNAMIC access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff x-evy-trace-listener listener_https date Tue, 07 Jan 2025 08:41:56 GMT x-hubspot-correlation-id 66089329-23e4-4adf-9112-5b6b8993966b content-type application/json;charset=utf-8 vary Accept-Encoding access-control-allow-headers * x-evy-trace-route-service-name envoyset-translator cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-qg2kv x-envoy-upstream-service-time 3 cf-ray 8fe2a6cd784ebaf1-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	164ms 164ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A17%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:56 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:56 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET		ae3865f6-d12f-4966-89d9-4ba4404f68cf https://www.cyberhaven.com/ Frame	0 0
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	288ms 202ms	XHR application/json	18.158.205.16 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.158.205.16 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-158-205-16.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload access-control-max-age 7200 access-control-expose-headers content-encoding gzip x-envoy-response-flags - access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; x-content-type-options nosniff access-control-allow-origin https://www.cyberhaven.com date Tue, 07 Jan 2025 08:41:55 GMT content-type application/json vary Accept-Encoding, Origin server Clearbit
GET H2	200	blockedDomains.json Show response hubspotonwebflow.com/assets/js/	98 KB 23 KB	192ms 191ms	Fetch application/json	66.33.60.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/blockedDomains.json Requested by Host: hubspotonwebflow.com URL: https://hubspotonwebflow.com/assets/js/form-124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"04708d47dd194d37b8231a65de7a66f1" age 7643080 x-matched-path /assets/js/blockedDomains.json access-control-allow-origin * date Tue, 07 Jan 2025 08:41:56 GMT content-disposition inline; filename="blockedDomains.json" content-type application/json; charset=utf-8 server Vercel last-modified Thu, 10 Oct 2024 20:46:42 GMT x-vercel-id fra1::vl5z5-1736239316286-45ac3ef1404c
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	214ms 163ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=151041951&v=1.1&a=5298086&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&cts=1736239316249&vi=b215874e12b8e68d94ae4706032da8a5&nc=true&u=208653005.b215874e12b8e68d94ae4706032da8a5.1736239316247.1736239316247.1736239316247.1&b=208653005.1.1736239316247&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none x-request-id 994e918f-0ee3-4578-86b3-6614d822a74b cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9Hhi4GICxpA0jSjf1TSSo2s%2FxrhbdZXFEa8m3m6kppoplReiMDQiYOxm3bVq6fPcjIzdeC2i2oTXAsWfEc2X%2Ffd2ZykqIHSi91ogj8dk6fJbOFPNNL4WdwEA%2FyDreaL4z%2B0FiAqAEq60Vt85Cbp"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-evy-trace-listener listener_https p3p CP="NOI CUR ADM OUR NOR STA NID" date Tue, 07 Jan 2025 08:41:56 GMT x-hubspot-correlation-id 994e918f-0ee3-4578-86b3-6614d822a74b content-type image/gif vary origin, Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator cache-control no-cache, no-store, no-transform nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-cvxr8 x-envoy-upstream-service-time 7 access-control-allow-credentials false cf-ray 8fe2a6cefc0c4c52-MXP x-evy-trace-route-configuration listener_https/all content-length 45 server cloudflare x-evy-trace-virtual-host all
GET H3	200	6515e83924723987bacc4b6b_favicon.png cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	2 KB 2 KB	50ms 49ms	Other image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/6515e83924723987bacc4b6b_favicon.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35f594c6250e4f6beb23551ea8b2128ca0faa451998403ac7859bc51873b3cf2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "7f9532364c9c4bd7e55de7b330a315d7" x-amz-version-id 2PFNNcwh85NMJaJS3FT9RI.EWY5iSVaq age 1946615 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 07 Jan 2025 08:41:56 GMT content-type image/png last-modified Thu, 28 Sep 2023 20:55:22 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 DXBM/QZjP7VP0udFWwQW1Ne7Ln2t4YKWVp1eFwUKXXpTzGxa2UJL/gJOzqOckRkg147HE3WbLM62S9LLMIF80Un+8HW3s9kvXNDcEiWLLzw= cache-control max-age=31536000, must-revalidate x-amz-request-id RFQT0G6005M45KPE cf-ray 8fe2a6cebff1dbce-FRA accept-ranges bytes access-control-allow-origin * content-length 1946 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	widget-X-lC0KIY.js Show response opps-widget.getwarmly.com/	599 KB 183 KB	78ms 43ms	Script text/javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e205d249d21cce1b88ce4e38ad4652f44215f09667880d8defb90545f21b35f9 Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"be5996212d89bfb98baee4c1309c1a500adb16cbcd30f1dbea66589d5c04b685-br" age 2748 x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r9UJtK%2B4g5P452qrcrlH1qyCIIF9xoOIS8%2FNzn2%2BZ0iT80GKyB1lG0fNhPIuMGkFGVOwAguVraTV2WFcmvYW5jLoVLl0a0IxlHCyTUFx74he0kUqMoNo5G%2Bc02cdnTzRN9ZD%2F0%2FP76h2ywEi"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache HIT server-timing cfL4;desc="?proto=QUIC&rtt=32356&min_rtt=32353&rtt_var=12137&sent=9&recv=6&lost=0&retrans=0&sent_bytes=2157&recv_bytes=4073&delivery_rate=42166&cwnd=12000&unsent_bytes=0&cid=db833ab70af3697c&ts=44&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 07 Jan 2025 08:41:56 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 03 Jan 2025 16:48:06 GMT x-served-by cache-fra-eddf8230030-FRA x-cache-hits 103 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=1,i=?0 x-timer S1735923638.204211,VS0,VE0 referrer-policy origin-when-cross-origin cf-ray 8fe2a6cf690dd2f6-FRA access-control-allow-origin * server cloudflare
POST H3	200	sessions.createSession Show response opps-api.getwarmly.com/api/sessions/trpc/	2 KB 2 KB	258ms 209ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 803743bfe5abd64d87ce5247e4e02020761a126fce0fb526251ad39865f0fff2 Request headers x-warmly-user-identifier x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 939f8cff-c041-4d6a-bae3-bdacebf9ef16 X-Warmly-Target session-server User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2116 date Tue, 07 Jan 2025 08:41:57 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	sessions.createSession opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	257ms 158ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 07 Jan 2025 08:41:56 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	190ms 190ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:57 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:57 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	204	sessions.trackScriptAdded opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	160ms 159ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 07 Jan 2025 08:41:57 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		cs a.usbrowserspeed.com/	0 0
GET H2	200	did-008f.min.js Show response d-code.liadm.com/	136 KB 46 KB	137ms 43ms	Script application/javascript	2600:9000:2156:ac00:1c:2afd:fb00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d-code.liadm.com/did-008f.min.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:ac00:1c:2afd:fb00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 4e74df57357b9705a6880964b39f7951b0c2be130d14fe7cadd8a9e4f85147d2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public,max-age=86400 content-encoding gzip age 54011 via 1.1 5ad96647558bd4911f05189f8afefd98.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id EoH8LqySQK_tVqag8IboRVbEMD-aZyPZEg2p3kgjsWr1gu-CSiiDBA== date Mon, 06 Jan 2025 17:41:46 GMT content-type application/javascript vary Accept-Encoding x-amz-cf-pop FRA50-C1
POST H3	200	sessions.trackScriptAdded Show response opps-api.getwarmly.com/api/sessions/trpc/	65 B 82 B	163ms 162ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 939f8cff-c041-4d6a-bae3-bdacebf9ef16 content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Tue, 07 Jan 2025 08:41:57 GMT content-type application/json; charset=utf-8 vary Origin
GET H3	200	chat.getMessages Show response opps-api.getwarmly.com/api/sessions/trpc/	31 B 47 B	161ms 160ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%228f60e755-3996-46b9-9cc5-bf3d7bf83671%22%7D%7D Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 2485e74dd82a729476c358bb9ad59c0322ee42bfeeac9805606cb9da39a47f98 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 939f8cff-c041-4d6a-bae3-bdacebf9ef16 content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 date Tue, 07 Jan 2025 08:41:57 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	chat.getMessages opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	160ms 159ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%228f60e755-3996-46b9-9cc5-bf3d7bf83671%22%7D%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 07 Jan 2025 08:41:57 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	204	any Show response idx.liadm.com/idex/did-008f/	0 375 B	375ms 122ms	XHR text/plain	34.194.178.247 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://idx.liadm.com/idex/did-008f/any?duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&did=did-008f&cd=.cyberhaven.com&pu=https%3A%2F%2Fwww.cyberhaven.com%2F&pv=1d8a3ed7-f3d0-45ea-9ad6-842ffb8e7f4f&resolve=md5&resolve=sha2&resolve=age&resolve=gender Requested by Host: d-code.liadm.com URL: https://d-code.liadm.com/did-008f.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.194.178.247 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-194-178-247.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains cache-control max-age=3599, private trace-id b4e15720a2762563 request-time 1 access-control-allow-credentials true expires Tue, 07 Jan 2025 09:41:57 GMT access-control-allow-origin https://www.cyberhaven.com date Tue, 07 Jan 2025 08:41:57 GMT vary Origin
POST H3	200	sessions.captureLiveIntent Show response opps-api.getwarmly.com/api/trpc/	65 B 81 B	154ms 153ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/trpc/sessions.captureLiveIntent Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-session-id 8f60e755-3996-46b9-9cc5-bf3d7bf83671 x-warmly-user-identifier 7d4d6078-782e-48c8-b0f9-001913e3c233 x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 939f8cff-c041-4d6a-bae3-bdacebf9ef16 x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Tue, 07 Jan 2025 08:41:57 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.captureLiveIntent opps-api.getwarmly.com/api/trpc/ Frame	0 0	151ms 150ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/trpc/sessions.captureLiveIntent Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 07 Jan 2025 08:41:57 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	157ms 157ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A56%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:58 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:58 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	j Show response rp4.liadm.com/ Redirect Chain https://rp.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-prelimin... https://rp4.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-prelimi...	13 B 370 B	420ms 121ms	XHR application/json	34.231.172.117 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rp4.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=1d8a3ed7-f3d0-45ea-9ad6-842ffb8e7f4f&i6=MjAwMTphYzg6MjQ6NDQ6OjE3 Protocol H2 Server 34.231.172.117 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-172-117.compute-1.amazonaws.com Software / Resource Hash efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-pixel-event-id a8585945-23bb-4891-bdcb-e40bfb1cef32 access-control-max-age 86400 access-control-expose-headers * access-control-allow-credentials true access-control-allow-methods GET access-control-allow-origin null content-length 13 date Tue, 07 Jan 2025 08:41:59 GMT content-type application/json Redirect headers access-control-max-age 86400 access-control-expose-headers * location https://rp4.liadm.com/j?dtstmp=1736239318307&did=did-008f&se=e30&duid=5b1202958f69--01jgzyv09tqpj0rm91s6zka7z0&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=1d8a3ed7-f3d0-45ea-9ad6-842ffb8e7f4f&i6=MjAwMTphYzg6MjQ6NDQ6OjE3 access-control-allow-credentials true access-control-allow-methods GET access-control-allow-origin https://www.cyberhaven.com content-length 0 date Tue, 07 Jan 2025 08:41:58 GMT
POST H3	200	sessions.updateHubspotUserToken Show response opps-api.getwarmly.com/api/sessions/trpc/	33 B 49 B	156ms 155ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash ded6935dc09c7888de1b41c8ab7cebf82223c044f9eced4628c8236962fec3c5 Request headers x-warmly-session-id 8f60e755-3996-46b9-9cc5-bf3d7bf83671 x-warmly-user-identifier 7d4d6078-782e-48c8-b0f9-001913e3c233 x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 939f8cff-c041-4d6a-bae3-bdacebf9ef16 X-Warmly-Target session-server x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33 date Tue, 07 Jan 2025 08:41:58 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.updateHubspotUserToken opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	151ms 151ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 07 Jan 2025 08:41:58 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
POST H2	200	/ Show response us.i.posthog.com/s/	15 B 248 B	835ms 824ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/s/?ip=1&_=1736239318595&ver=1.204.0&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash 0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers x-envoy-upstream-service-time 491 access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 15 date Tue, 07 Jan 2025 08:41:59 GMT content-type application/json vary origin, access-control-request-method, access-control-request-headers server envoy
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	161ms 161ms	Image image/gif	95.101.75.151 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A57%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.75.151 Vienna, Austria, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-75-151.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Tue, 07 Jan 2025 08:41:59 GMT accept-ranges bytes content-length 43 date Tue, 07 Jan 2025 08:41:59 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/97f4143e-d6d3-4c9b-8c53-b57590c0a983

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/ae3865f6-d12f-4966-89d9-4ba4404f68cf

Domain

a.usbrowserspeed.com

URL

https://a.usbrowserspeed.com/cs?pid=4dd5c5fae59ce3249cf6f13469fbc883b27c8135ce5092e6a3b38092dc07d387&puid=8f60e755-3996-46b9-9cc5-bf3d7bf83671&r=%0A%20%20%20%20https%3A%2F%2Fapi.immagnify.com%2Fv1%2Fintegrations%2Ffxf%2Fwebhook%2FkhlFEhkHvc%3Fhem%3D%24%7BHEM_SHA256_LOWERCASE%7D%26up_id%3D%24%7BUP_ID%7D%26puid%3D8f60e755-3996-46b9-9cc5-bf3d7bf83671%26ip%3D%24%7BIP%7D%0A%20%20

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=91af506d-5828-46e8-8c6b-07045b2ae4bb&session=aebe7b62-5382-4cad-8f99-cb186a6abcb8&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2007%20Jan%202025%2008%3A41%3A58%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=00d4e595-e9b0-48b0-81c4-a16354a78eac&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A17&v=1.1.31