URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Submission: On December 21 via api from US — Scanned from DE

Summary

This website contacted 30 IPs in 4 countries across 28 domains to perform 168 HTTP transactions. The main IP is 23.100.35.118, located in San Jose, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is www.secureworks.com.
TLS certificate: Issued by Thawte RSA CA 2018 on August 16th 2021. Valid for: a year.
This is the only time www.secureworks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 23.100.35.118 8075 (MICROSOFT...)
43 2a02:26f0:64:... 20940 (AKAMAI-ASN1)
2 2620:12a:8001::2 54113 (FASTLY)
2 104.111.234.67 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 192.28.144.124 15224 (OMNITURE)
1 2001:4de0:ac1... 20446 (HIGHWINDS3)
7 104.111.233.140 16625 (AKAMAI-AS)
5 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
1 142.250.186.162 15169 (GOOGLE)
4 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
62 143.204.209.46 16509 (AMAZON-02)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 151.101.14.109 54113 (FASTLY)
1 151.101.193.131 54113 (FASTLY)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 37.252.173.22 29990 (ASN-APPNEX)
1 2600:9000:211... 16509 (AMAZON-02)
1 206.19.49.24 17225 (ATT-CERFN...)
1 2a00:1450:400... 15169 (GOOGLE)
1 65.9.64.81 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 18.195.108.243 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
4 54.147.21.139 14618 (AMAZON-AES)
2 34.193.113.164 14618 (AMAZON-AES)
1 143.204.209.78 16509 (AMAZON-02)
168 30
Domain Requested by
62 js.driftt.com www.secureworks.com
js.driftt.com
43 content.secureworks.com www.secureworks.com
content.secureworks.com
5 b.6sc.co
5 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
5 www.secureworks.com www.secureworks.com
content.secureworks.com
4 metrics.api.drift.com js.driftt.com
4 script.crazyegg.com www.googletagmanager.com
script.crazyegg.com
3 secure.adnxs.com 2 redirects j.6sc.co
3 bat.bing.com www.googletagmanager.com
bat.bing.com
3 cdn.cookielaw.org www.googletagmanager.com
cdn.cookielaw.org
2 bootstrap.api.drift.com js.driftt.com
2 www.google.com
2 epsilon.6sense.com j.6sc.co
2 stats.g.doubleclick.net www.google-analytics.com
2 www.googletagmanager.com www.secureworks.com
www.googletagmanager.com
2 munchkin.marketo.net www.secureworks.com
munchkin.marketo.net
2 scwx.annuitas.io www.secureworks.com
content.secureworks.com
1 embeds.driftcdn.com js.driftt.com
1 c.6sc.co j.6sc.co
1 assets.ubembed.com f47fc87cb1114490b08a513d8c97555c.js.ubembed.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 apt.techtarget.com
1 attr.ml-api.io
1 s.ml-attr.com 1 redirects
1 f47fc87cb1114490b08a513d8c97555c.js.ubembed.com www.googletagmanager.com
1 extend.vimeocdn.com www.googletagmanager.com
1 snap.licdn.com www.secureworks.com
1 trk.techtarget.com www.secureworks.com
1 www.googleadservices.com www.googletagmanager.com
1 j.6sc.co www.secureworks.com
1 code.jquery.com cdn.cookielaw.org
1 725-smc-563.mktoresp.com munchkin.marketo.net
0 c.clarity.ms Failed
0 f.clarity.ms Failed bat.bing.com
0 www.google.de Failed
0 px4.ads.linkedin.com Failed
168 36
Subject Issuer Validity Valid
www.secureworks.com
Thawte RSA CA 2018
2021-08-16 -
2022-09-16
a year crt.sh
cert00029-azurecdn.akamaized.net
R3
2021-12-09 -
2022-03-09
3 months crt.sh
scwx.annuitas.io
R3
2021-11-27 -
2022-02-25
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2021-03-29 -
2022-04-06
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2021-06-01 -
2022-05-31
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2021-07-14 -
2022-08-14
a year crt.sh
*.6sc.co
DigiCert SHA2 Secure Server CA
2021-03-09 -
2022-03-16
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2021-09-30 -
2022-03-30
6 months crt.sh
www.googleadservices.com
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-05-09 -
2022-05-08
a year crt.sh
drift.com
Amazon
2021-09-08 -
2022-10-07
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2021-07-15 -
2022-07-20
a year crt.sh
*.vimeocdn.com
GlobalSign Atlas R3 DV TLS CA 2020
2021-05-18 -
2022-06-19
a year crt.sh
*.js.ubembed.com
GlobalSign Atlas R3 DV TLS CA 2020
2021-03-22 -
2022-04-23
a year crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-13 -
2022-11-12
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh
assets.ubembed.com
Amazon
2021-03-06 -
2022-04-04
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.6sense.com
Amazon
2021-06-30 -
2022-07-29
a year crt.sh
www.google.com
GTS CA 1C3
2021-11-29 -
2022-02-21
3 months crt.sh
*.driftcdn.com
Amazon
2021-03-12 -
2022-04-10
a year crt.sh

This page contains 3 frames:

Primary Page: https://www.secureworks.com/research/threat-profiles/gold-heron
Frame ID: 1DD0AD152C0FCF90AD4B7E167FD8E2AA
Requests: 99 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Frame ID: 7AEA35EE19D03D4156165A04422B6CBA
Requests: 33 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Frame ID: 53DA7BFBEE9C3A9484B422F6DF8C7E8C
Requests: 32 HTTP requests in this frame

Screenshot

Page Title

GOLD HERON | Secureworks

Detected technologies

Overall confidence: 100%
Detected patterns
  • ubembed\.com

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

168
Requests

96 %
HTTPS

47 %
IPv6

28
Domains

36
Subdomains

30
IPs

4
Countries

1821 kB
Transfer

5296 kB
Size

34
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.secureworks.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.secureworks.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.secureworks.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=www.secureworks.com&pId=761986291958991756
Request Chain 70
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2386324%26time%3D1640048439561%26url%3Dhttps%253A%252F%252Fwww.secureworks.com%252Fresearch%252Fthreat-profiles%252Fgold-heron%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true HTTP 0
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true&e_ipv6=AQL7kwdQG7dfRAAAAX3agTJq0QHP2ZhCzsVPvLoJn6317Ng5I8DyKZEitUzrDKNzTQKIkKI

168 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request gold-heron
www.secureworks.com/research/threat-profiles/
124 KB
28 KB
Document
General
Full URL
https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.100.35.118 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
94a7d3a4cb33f56365a6142b12ed5fb150de97df502611eb2a74ec3372c2e0a0
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'self' 'nonce-MTgwMGJhY2VjZjg2NDUxYWEwNzA2NWMxOWEwZDIzZmE=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com; img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com; frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
Content-Security-Policy
object-src 'none'; script-src 'self' 'nonce-MTgwMGJhY2VjZjg2NDUxYWEwNzA2NWMxOWEwZDIzZmE=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com; img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com; frame-ancestors 'none';
X-Frame-Options
DENY
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Referrer-Policy
no-referrer-when-downgrade
Date
Tue, 21 Dec 2021 01:00:37 GMT
Content-Length
24110
html5reset-1.6.1.css
content.secureworks.com/content/app/css/
1 KB
845 B
Stylesheet
General
Full URL
https://content.secureworks.com/content/app/css/html5reset-1.6.1.css?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
db61679243f9f3b5a03de90b1ad228130ad3e87b79b9d153ce1ca6afbdf9a2b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2227648
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
573
x-content-type-options
nosniff
western-typographies.css
content.secureworks.com/content/app/css/
2 KB
637 B
Stylesheet
General
Full URL
https://content.secureworks.com/content/app/css/western-typographies.css?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
fa85f97108080f24b26ca0450d471edf522d233337c1b73e41ab4a27d19ac94f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2227621
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
365
x-content-type-options
nosniff
main.css
content.secureworks.com/content/app/css/
573 KB
81 KB
Stylesheet
General
Full URL
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
3a5bdbd449317313bbe8d2551a1eaba58687aeaf5fb02943d1fa3e804c0c4e82
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 16 Dec 2021 19:40:22 GMT
server
Microsoft-IIS/10.0
etag
"ec9ea6c3b4f2d71:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2227671
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
82900
x-content-type-options
nosniff
jquery-3.6.0.min.js
content.secureworks.com/content/app/js/
87 KB
31 KB
Script
General
Full URL
https://content.secureworks.com/content/app/js/jquery-3.6.0.min.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227656
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
30954
x-content-type-options
nosniff
scripts.js
scwx.annuitas.io/wp-json/pdg/v1/
40 KB
14 KB
Script
General
Full URL
https://scwx.annuitas.io/wp-json/pdg/v1/scripts.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fd0fe4e495939fdf1eeb633dc45c30ceada009346ba0147c143ae29cc8c7b4b3
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
etag
W/"61ae8263-9ed2"
age
1221819
x-pantheon-styx-hostname
styx-fe2-b-85fb6f4cd-b8nbm
x-cache
HIT, HIT
content-length
14091
x-served-by
cache-mdw17334-MDW, cache-maa10248-MAA
last-modified
Mon, 06 Dec 2021 21:36:35 GMT
server
nginx
x-timer
S1640048439.878486,VS0,VE0
date
Tue, 21 Dec 2021 01:00:38 GMT
vary
Accept-Encoding
content-type
application/x-javascript
via
1.1 varnish, 1.1 varnish
expires
Wed, 07 Dec 2022 21:36:59 GMT
cache-control
max-age=31622400
accept-ranges
bytes
x-styx-req-id
a4cb9eed-56dc-11ec-95da-ce33e01b08a6
x-cache-hits
1, 4
marketo-from-custom.js
content.secureworks.com/content/app/js/
14 KB
3 KB
Script
General
Full URL
https://content.secureworks.com/content/app/js/marketo-from-custom.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
91bfe05478e9aa562a5b0f3fe991e6b7201d4282312c48d0fc71b3f5ae7f03ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227715
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
2849
x-content-type-options
nosniff
VisitorIdentification.js
www.secureworks.com/layouts/system/
2 KB
1 KB
Script
General
Full URL
https://www.secureworks.com/layouts/system/VisitorIdentification.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.100.35.118 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
7941c043b215ecc58d18e696d42abbd225eb0baa075cb5e31027725cc5312fce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 04 Jun 2018 06:06:48 GMT
Server
Microsoft-IIS/10.0
ETag
"04cdf38cafbd31:0"
Vary
Accept-Encoding
Content-Type
application/javascript
Date
Tue, 21 Dec 2021 01:00:37 GMT
Accept-Ranges
bytes
Content-Length
910
X-Content-Type-Options
nosniff
emergency-icon-02.ashx
content.secureworks.com/-/media/Images/Icons/
882 B
1 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Icons/emergency-icon-02.ashx?modified=20200713133031
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
d64e3512a14d94fc0807a70eccafd1ad6010aab4d91d552f8e3c4d310bff64ce
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 13 Jul 2020 13:30:31 GMT
server
Microsoft-IIS/10.0
etag
3c8ba49ec7994d569f5a624ba34bd1db
content-type
image/png
cache-control
public, max-age=1767490
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="emergency-icon-02.png"
accept-ranges
bytes
content-length
882
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 11:58:48 GMT
sw_logo_black.ashx
content.secureworks.com/-/media/Images/logos/
5 KB
5 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/logos/sw_logo_black.ashx?modified=20200805202625&la=en&hash=1D65C59935DD4F7FBE248940505D051A
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
b5ecd7807e3023d657d18fbe832848e8e65843843ebd748f7225e314b17d5221
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 05 Aug 2020 20:26:25 GMT
server
Microsoft-IIS/10.0
etag
33b882a931e84894a7c864998125bcce
content-type
image/svg+xml
cache-control
public, max-age=1767685
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="sw_logo_black.svg"
accept-ranges
bytes
content-length
4728
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 12:02:03 GMT
btn-arrow.svg
content.secureworks.com/content/rc/images/
2 KB
2 KB
Image
General
Full URL
https://content.secureworks.com/content/rc/images/btn-arrow.svg
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
11d5ce34f206afb82ddf5e90ac14a2572bf9ee7177623d3a22d961d14bbd71ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2255543
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
2096
x-content-type-options
nosniff
arrow-back.svg
content.secureworks.com/content/rc/images/
1 KB
1 KB
Image
General
Full URL
https://content.secureworks.com/content/rc/images/arrow-back.svg
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
0a8b1ef45e2622985d8d86e6317525253a50b84b7a37e92b14f2af14f430e10e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2064747
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
1025
x-content-type-options
nosniff
logo-blue-taegis.ashx
content.secureworks.com/-/media/Images/logos/
4 KB
4 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/logos/logo-blue-taegis.ashx?modified=20211110212248
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
24849b91ee6d5f169a67d0f0f316ec3d3e7b62454b4a87a3138eb5b87465676c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 10 Nov 2021 21:22:48 GMT
server
Microsoft-IIS/10.0
etag
886eba971f804121baa2dcc7e75813bf
content-type
image/png
cache-control
public, max-age=1456742
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="logo-blue-taegis.png"
accept-ranges
bytes
content-length
3947
x-content-type-options
nosniff
expires
Thu, 06 Jan 2022 21:39:40 GMT
emergency-response-red_360x190.ashx
content.secureworks.com/-/media/Images/Contact/Emergency%20Response/
41 KB
41 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Contact/Emergency%20Response/emergency-response-red_360x190.ashx?modified=20211201205934
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
b777ccbe9576f16bf6f9bc222c6c98fbff019365b13a1beee3571da3458657fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 01 Dec 2021 20:59:34 GMT
server
Microsoft-IIS/10.0
etag
93a5fb29056b48fab5b7be65e1cf3eb7
content-type
image/png
cache-control
public, max-age=997509
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="emergency-response-red_360x190.png"
accept-ranges
bytes
content-length
41708
x-content-type-options
nosniff
expires
Sat, 01 Jan 2022 14:05:47 GMT
why-secureworks-nav-promo_360x190.ashx
content.secureworks.com/-/media/Images/About/Why%20Secureworks/
42 KB
43 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/About/Why%20Secureworks/why-secureworks-nav-promo_360x190.ashx?modified=20211012194821
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
652693cf351da926038bb19decb41b5b58f439e786b26a1a32e9498b2390b9bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Oct 2021 19:48:21 GMT
server
Microsoft-IIS/10.0
etag
a6811fe9bdce4469b7f75a2dad09f6a8
content-type
image/png
cache-control
public, max-age=1338067
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="why-secureworks-nav-promo_360x190.png"
accept-ranges
bytes
content-length
43252
x-content-type-options
nosniff
expires
Wed, 05 Jan 2022 12:41:45 GMT
gpp_overview_image_partner-nav_360x190.ashx
content.secureworks.com/-/media/Images/About/Partners/2021/
15 KB
15 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/About/Partners/2021/gpp_overview_image_partner-nav_360x190.ashx?modified=20210204141446
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
aa974801b32114fee16b18ee57d0c14b8e23a8a690830f425c4054ca2b629ace
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 04 Feb 2021 14:14:46 GMT
server
Microsoft-IIS/10.0
etag
3bd4f02a48f64e39bdc89ac66e50b33f
content-type
image/jpeg
cache-control
public, max-age=2397724
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="gpp_overview_image_partner-nav_360x190.jpg"
accept-ranges
bytes
content-length
15086
x-content-type-options
nosniff
expires
Mon, 17 Jan 2022 19:02:42 GMT
adversary-software-coverage_360x190.ashx
content.secureworks.com/-/media/Images/Insights/Resources/Tools/Screens/
24 KB
25 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Insights/Resources/Tools/Screens/adversary-software-coverage_360x190.ashx?modified=20210521135420
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
690ffa4f3709f9f45b28bdab7637e0da04880aee1d2d4e9caf4af0a99782a2ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 21 May 2021 13:54:20 GMT
server
Microsoft-IIS/10.0
etag
7f320742388f4e31a683ff362b1425f6
content-type
image/jpeg
cache-control
public, max-age=1767151
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="adversary-software-coverage_360x190.jpg"
accept-ranges
bytes
content-length
24997
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 11:53:09 GMT
SEC03190_Forrester-Wave_Web-Banners_360x190_R1.ashx
content.secureworks.com/-/media/Images/Badges/
10 KB
10 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Badges/SEC03190_Forrester-Wave_Web-Banners_360x190_R1.ashx?modified=20210326185832
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
98eeaeae353fe37b4b82cafa82ebd450fb7aebcd9f8e98f776c75bdb895ac94a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 26 Mar 2021 18:58:32 GMT
server
Microsoft-IIS/10.0
etag
b2a16c99f331437db9655b67d9e9455e
content-type
image/jpeg
cache-control
public, max-age=1766001
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="SEC03190_Forrester-Wave_Web-Banners_360x190_R1.jpg"
accept-ranges
bytes
content-length
10238
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 11:33:59 GMT
react.production.min.js
content.secureworks.com/content/react/lib/
12 KB
5 KB
Script
General
Full URL
https://content.secureworks.com/content/react/lib/react.production.min.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
c9486f126615859fc61ac84840a02b2efc920d287a71d99d708c74b2947750fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2229664
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
4898
x-content-type-options
nosniff
react-dom.production.min.js
content.secureworks.com/content/react/lib/
116 KB
38 KB
Script
General
Full URL
https://content.secureworks.com/content/react/lib/react-dom.production.min.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
bc5b7797e8a595e365c1385b0d47683d3a85f3533c58d499659b771c48ec6d25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2229662
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
38049
x-content-type-options
nosniff
threatProfiles.js
content.secureworks.com/content/react/app/
48 KB
13 KB
Script
General
Full URL
https://content.secureworks.com/content/react/app/threatProfiles.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e824165ebfcdcdfa988ebb284b51336938d8e5b732e4a7967f845b7aa8c315f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2229683
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
12767
x-content-type-options
nosniff
linkedin.ashx
content.secureworks.com/-/media/Images/SharedElements/Footer/
966 B
1 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/SharedElements/Footer/linkedin.ashx?modified=20151001162233
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
5a9e4352db3a1f75caf77c79146fd0f059ba043d692bae117b2d291d0c4ac7ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 01 Oct 2015 16:22:33 GMT
server
Microsoft-IIS/10.0
etag
0381e34e4c5a42c49da29271c74c47a6
content-type
image/svg+xml
cache-control
public, max-age=1766042
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="linkedin.svg"
accept-ranges
bytes
content-length
966
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 11:34:40 GMT
twitter.ashx
content.secureworks.com/-/media/Images/SharedElements/Footer/
1 KB
2 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/SharedElements/Footer/twitter.ashx?modified=20151001162249
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e15a809168d9a16a22e0c2428da1fb9541e4288724ad734efd66ef6bafee52d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 01 Oct 2015 16:22:49 GMT
server
Microsoft-IIS/10.0
etag
ec6990570ccd41139b7ce0f297010c73
content-type
image/svg+xml
cache-control
public, max-age=1767837
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="twitter.svg"
accept-ranges
bytes
content-length
1339
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 12:04:35 GMT
facebook2.ashx
content.secureworks.com/-/media/Images/SharedElements/Footer/
587 B
901 B
Image
General
Full URL
https://content.secureworks.com/-/media/Images/SharedElements/Footer/facebook2.ashx?modified=20190116141121
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
42166c909b8db5b9d362bfc1c28a3f7e06f109aa449a70b3bd293a6e6bf62ac2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Jan 2019 14:11:21 GMT
server
Microsoft-IIS/10.0
etag
83a284c3f8dc4e0695cacbc73ba98d2f
content-type
image/svg+xml
cache-control
public, max-age=1767849
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="facebook2.svg"
accept-ranges
bytes
content-length
587
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 12:04:47 GMT
github.ashx
content.secureworks.com/-/media/Images/SharedElements/Footer/
1 KB
1 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/SharedElements/Footer/github.ashx?modified=20190116135435
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
1a914a4b01d30dc7a83ccf4407787ab02647c601e2e9b174f49cbd190de57313
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 16 Jan 2019 13:54:35 GMT
server
Microsoft-IIS/10.0
etag
1b7369e537844d1a9514570987ea7777
content-type
image/svg+xml
cache-control
public, max-age=1767694
date
Tue, 21 Dec 2021 01:00:38 GMT
content-disposition
inline; filename="github.svg"
accept-ranges
bytes
content-length
1129
x-content-type-options
nosniff
expires
Mon, 10 Jan 2022 12:02:12 GMT
dell-technologies.png
content.secureworks.com/content/app/img/
2 KB
3 KB
Image
General
Full URL
https://content.secureworks.com/content/app/img/dell-technologies.png
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
fe8d0e6533b5e64fe2af6c2740160c4776b6942e1a94cad2ef14afab2566447f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2282048
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
2543
x-content-type-options
nosniff
close.svg
www.secureworks.com/content/rc/images/
850 B
1 KB
Image
General
Full URL
https://www.secureworks.com/content/rc/images/close.svg
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.100.35.118 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
0049c42b57e92164c558905bff7c17441afe55dc569f0062162e77a532964b80
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Mon, 15 Jun 2020 08:15:26 GMT
Server
Microsoft-IIS/10.0
ETag
"023ab1fed42d61:0"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=2592000
Date
Tue, 21 Dec 2021 01:00:38 GMT
Accept-Ranges
bytes
Content-Length
850
X-Content-Type-Options
nosniff
libs.min.js
content.secureworks.com/content/app/js/
249 KB
66 KB
Script
General
Full URL
https://content.secureworks.com/content/app/js/libs.min.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
245afe5ee915709f5a6faef0469c2750a4879d364255f9a6a3132a2ce031793d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227699
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
67582
x-content-type-options
nosniff
main.js
content.secureworks.com/content/app/js/
72 KB
19 KB
Script
General
Full URL
https://content.secureworks.com/content/app/js/main.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
3048557217de68dd27ec528560891893511e16507054f9d07b7dde80b6a629e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227695
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
19020
x-content-type-options
nosniff
products.js
content.secureworks.com/content/rc/js/
44 KB
14 KB
Script
General
Full URL
https://content.secureworks.com/content/rc/js/products.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
9eb064a8d93265a1b1bb725f0db9c1d209a4efdae9eca7ddc67a094755c64b4f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227729
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
13755
x-content-type-options
nosniff
default.css
content.secureworks.com/content/app/css/highlighter/
1 KB
852 B
Stylesheet
General
Full URL
https://content.secureworks.com/content/app/css/highlighter/default.css?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
22494645cd5c6508829ef760cfafdf7292ddfbb824f23a323b6d3f3bd10a2538
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=2227632
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
580
x-content-type-options
nosniff
highlight.pack.js
content.secureworks.com/content/app/js/libs/
50 KB
20 KB
Script
General
Full URL
https://content.secureworks.com/content/app/js/libs/highlight.pack.js?v=12-16-2021-v4
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
154248124c7d6ba28a3d741311104b4d4a503dad23095470f663f2613532c733
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2227768
date
Tue, 21 Dec 2021 01:00:38 GMT
accept-ranges
bytes
content-length
20267
x-content-type-options
nosniff
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
gtm.js
www.googletagmanager.com/
230 KB
75 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
bb77875ac71ebda5ebf3ed5bcc84c99ee095bc61da3df9e909c037a29a2f5034
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
76665
x-xss-protection
0
last-modified
Tue, 21 Dec 2021 00:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 21 Dec 2021 01:00:39 GMT
visuelt-light.woff
content.secureworks.com/content/app/fonts/visuelt/
63 KB
64 KB
Font
General
Full URL
https://content.secureworks.com/content/app/fonts/visuelt/visuelt-light.woff
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
bb0a60a6f91d085789101283e6cab2782ab60f6182229a962695d408a3cd7ca3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=2005461
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
64920
x-content-type-options
nosniff
visuelt-medium.woff
content.secureworks.com/content/app/fonts/visuelt/
36 KB
36 KB
Font
General
Full URL
https://content.secureworks.com/content/app/fonts/visuelt/visuelt-medium.woff
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
30a584b184cc0bffda4f65106a5440dd18027f5d832d74b56ee5d219b3b48cd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=1924074
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
36448
x-content-type-options
nosniff
icomoon.ttf
content.secureworks.com/content/app/fonts/icomoon/
3 KB
3 KB
Font
General
Full URL
https://content.secureworks.com/content/app/fonts/icomoon/icomoon.ttf?3dz4z
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
50f6d5d4c63ae14f65d7a8a91f989edd305a348fdd279c1dd69b94403d64ac46
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
application/font-ttf
access-control-allow-origin
*
cache-control
public, max-age=1915358
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
2736
x-content-type-options
nosniff
icomoon.ttf
content.secureworks.com/content/app/fonts/icomoon-new/
3 KB
3 KB
Font
General
Full URL
https://content.secureworks.com/content/app/fonts/icomoon-new/icomoon.ttf?8und5p
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
c97d6fa5b4ad8db4c6110b5e4a13eb698c381f580cb44440813c04f369df0a56
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
application/font-ttf
access-control-allow-origin
*
cache-control
public, max-age=1932232
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
2904
x-content-type-options
nosniff
exact
www.secureworks.com/api/threatprofiles/
1 KB
6 KB
Fetch
General
Full URL
https://www.secureworks.com/api/threatprofiles/exact
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/react/app/threatProfiles.js?v=12-16-2021-v4
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.100.35.118 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
bee9791cbb65e28b631b3e221f6eabaf11048ac87b02a517df183298f667bee4
Security Headers
Name Value
Content-Security-Policy object-src 'none'; script-src 'self' 'nonce-N2NkOTI4ZTUzZWJkNDM3Y2I2YmRlODRiZDM3NGIxMzg=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com; img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com; frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
application/json

Response headers

Pragma
no-cache
Content-Security-Policy
object-src 'none'; script-src 'self' 'nonce-N2NkOTI4ZTUzZWJkNDM3Y2I2YmRlODRiZDM3NGIxMzg=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com; img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com; frame-ancestors 'none';
X-Content-Type-Options
nosniff
Server
Microsoft-IIS/10.0
Date
Tue, 21 Dec 2021 01:00:38 GMT
X-Frame-Options
DENY
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache, no-store
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Length
1407
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
Expires
-1
adversary-software-coverage_360x190.ashx
content.secureworks.com/-/media/Images/Insights/Resources/Tools/Screens/
24 KB
25 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Insights/Resources/Tools/Screens/adversary-software-coverage_360x190.ashx?modified=20210521135420&mw=300&hash=14BE32DFBF70C6596E6D48AE0D74857B
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
690ffa4f3709f9f45b28bdab7637e0da04880aee1d2d4e9caf4af0a99782a2ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 21 May 2021 13:54:20 GMT
server
Microsoft-IIS/10.0
etag
7f320742388f4e31a683ff362b1425f6
content-type
image/jpeg
cache-control
public, max-age=1833247
date
Tue, 21 Dec 2021 01:00:39 GMT
content-disposition
inline; filename="adversary-software-coverage_360x190.jpg"
accept-ranges
bytes
content-length
24997
x-content-type-options
nosniff
expires
Tue, 11 Jan 2022 06:14:46 GMT
arrow-sw-blue.svg
www.secureworks.com/content/app/img/svg/
2 KB
3 KB
Image
General
Full URL
https://www.secureworks.com/content/app/img/svg/arrow-sw-blue.svg
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.100.35.118 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
467bb909c30ea44082026b111eaab93bbae65920a13c353b57a22a1ca9d3c5bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Thu, 23 Jul 2020 01:56:28 GMT
Server
Microsoft-IIS/10.0
ETag
"02e767a9460d61:0"
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
public,max-age=2592000
Date
Tue, 21 Dec 2021 01:00:38 GMT
Accept-Ranges
bytes
Content-Length
2359
X-Content-Type-Options
nosniff
people_0082_laptop_phone_table_view_360x190.ashx
content.secureworks.com/-/media/Images/Insights/People/people_0082_laptop_phone_table_view/
11 KB
11 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Insights/People/people_0082_laptop_phone_table_view/people_0082_laptop_phone_table_view_360x190.ashx?modified=20161003161453&mw=300&hash=5192CA56BED2A0608A534C6FD0F7530B
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
f2312dc8d88304ad600ebd30d7efef5ae4bb993a42ab5b3bc2e46fbdb555ffa8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Mon, 03 Oct 2016 16:14:53 GMT
server
Microsoft-IIS/10.0
etag
d19c1b72598a4290b7469e3251d42b8c
content-type
image/jpeg
cache-control
public, max-age=1689312
date
Tue, 21 Dec 2021 01:00:39 GMT
content-disposition
inline; filename="people_0082_laptop_phone_table_view_360x190.jpg"
accept-ranges
bytes
content-length
11355
x-content-type-options
nosniff
expires
Sun, 09 Jan 2022 14:15:51 GMT
people_0030_designmtg_360x190.ashx
content.secureworks.com/-/media/Images/Insights/People/people_0030_designmtg/
20 KB
20 KB
Image
General
Full URL
https://content.secureworks.com/-/media/Images/Insights/People/people_0030_designmtg/people_0030_designmtg_360x190.ashx?modified=20151112005127&mw=300&hash=180B28943ADAFFBF51BDB5A2D31A1A28
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
c34d05b1272b1612fcc30172f3df490a796420184348f7470de362ed1dac65cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Thu, 12 Nov 2015 00:51:27 GMT
server
Microsoft-IIS/10.0
etag
b66ea7cd6bfc48078ac65d04fbffe586
content-type
image/jpeg
cache-control
public, max-age=1926880
date
Tue, 21 Dec 2021 01:00:39 GMT
content-disposition
inline; filename="people_0030_designmtg_360x190.jpg"
accept-ranges
bytes
content-length
20571
x-content-type-options
nosniff
expires
Wed, 12 Jan 2022 08:15:19 GMT
search.svg
content.secureworks.com/content/app/css/img/
2 KB
2 KB
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/search.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
c8b8289b5f0f768e8f11bf5a02974a0504d0b9fc5e3d6c4b8a08da6fcae6f066
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2234598
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
2025
x-content-type-options
nosniff
icon-download.svg
content.secureworks.com/content/app/css/img/
516 B
773 B
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/icon-download.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
cc2a9794277859f1880c675e842c54d125831b56d9dddf9098daf4ab74edee8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2362473
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
516
x-content-type-options
nosniff
icon-rss.svg
content.secureworks.com/content/app/css/img/
647 B
904 B
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/icon-rss.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
d55c7fe4252476e2f677b75fbbc35178892831145a018772559b155d398f8b1d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2367688
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
647
x-content-type-options
nosniff
icon-filter-opened.svg
content.secureworks.com/content/app/css/img/
442 B
699 B
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/icon-filter-opened.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
ee9fa9f4a587ff050190ee521613efec53f35086bc03ad1192d44bd91eadc57a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2345185
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
442
x-content-type-options
nosniff
AjaxLoader.gif
content.secureworks.com/content/app/css/img/
1 KB
2 KB
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/AjaxLoader.gif
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e1da1b5e724cd444319ab4c55e7637b99034b448955ddbe56150b24200a61cde
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=2322020
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
1517
x-content-type-options
nosniff
icon-angle.svg
content.secureworks.com/content/app/css/img/
363 B
620 B
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/icon-angle.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
2659dad8a9fb723f498b13cc3069e4f6db49b008d63002f4a218aa90ad751623
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Wed, 15 Dec 2021 17:01:00 GMT
server
Microsoft-IIS/10.0
etag
"0aec455d5f1d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=2366951
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
363
x-content-type-options
nosniff
visuelt-bold.woff
content.secureworks.com/content/app/fonts/visuelt/
35 KB
36 KB
Font
General
Full URL
https://content.secureworks.com/content/app/fonts/visuelt/visuelt-bold.woff
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
acc248ead4890c65f3e2792cfe555e4d98c961f4b564bc4a77e86270dd3051f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Fri, 12 Mar 2021 20:09:08 GMT
server
Microsoft-IIS/10.0
etag
"04a1a8f7b17d71:0"
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=1923837
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
36300
x-content-type-options
nosniff
track_event
scwx.annuitas.io/wp-json/pdg/v1/
2 B
559 B
XHR
General
Full URL
https://scwx.annuitas.io/wp-json/pdg/v1/track_event?url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/js/jquery-3.6.0.min.js?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-styx-req-id
6a50f35b-61f9-11ec-88af-d21622b8cdf3
age
0
x-cache
MISS, MISS
x-cache-hits
0, 0
strict-transport-security
max-age=300
content-length
22
via
1.1 varnish, 1.1 varnish
x-served-by
cache-mdw17361-MDW, cache-maa10243-MAA
access-control-allow-headers
Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
server
nginx
x-timer
S1640048440.882035,VS0,VE360
vary
Accept-Encoding
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
access-control-expose-headers
X-WP-Total, X-WP-TotalPages, Link
accept-ranges
bytes
x-robots-tag
noindex
link
<https://scwx.annuitas.io/wp-json/>; rel="https://api.w.org/"
x-pantheon-styx-hostname
styx-fe2-a-5477446c7c-2w72t
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Thu, 31 Mar 2022 01:00:39 GMT
112cf759-b07b-4df7-b9c1-b87dc63309fb.js
cdn.cookielaw.org/langswitch/
1 KB
1 KB
Script
General
Full URL
https://cdn.cookielaw.org/langswitch/112cf759-b07b-4df7-b9c1-b87dc63309fb.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5ca0ad73064122932dddb8b1a95ce78abd25cb76569bbb0c7381356bee1dd0e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
GZIP
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
F0Pi2/A0fvAQwKAiuhBzzA==
age
9101
vary
Accept-Encoding
content-length
669
x-ms-lease-status
unlocked
last-modified
Tue, 25 May 2021 19:11:12 GMT
server
cloudflare
etag
0x8D91FB0DC99F2D0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c109aeab-b01e-0044-1a6c-c4048a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6c0d2cb94ac34321-FRA
visitWebPage
725-smc-563.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://725-smc-563.mktoresp.com/webevents/visitWebPage?_mchNc=1640048439241&_mchCn=&_mchId=725-SMC-563&_mchTk=_mch-secureworks.com-1640048439240-37772&_mchHo=www.secureworks.com&_mchPo=&_mchRu=%2Fresearch%2Fthreat-profiles%2Fgold-heron&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
c2586201-af57-446b-890e-631edf2518b0
6d956ad9-8bc3-46c7-ab7b-880cb9ceb5a8.js
cdn.cookielaw.org/consent/
70 KB
17 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/6d956ad9-8bc3-46c7-ab7b-880cb9ceb5a8.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/langswitch/112cf759-b07b-4df7-b9c1-b87dc63309fb.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
931763386856012b8fe9f66d734a85f0baa25b4aa987fbad058686853d2dee5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
GZIP
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
29Jm71d8iKa0kRVlk+woHg==
age
9101
vary
Accept-Encoding
content-length
17499
x-ms-lease-status
unlocked
last-modified
Tue, 25 May 2021 19:11:22 GMT
server
cloudflare
etag
0x8D91FB0E2536BA0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e53390ab-b01e-006d-7c16-b672c8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6c0d2cb96ada4321-FRA
expires
Tue, 21 Dec 2021 05:00:39 GMT
optanon.css
cdn.cookielaw.org/skins/6.18.0/default_flat_top_two_button_black/v2/css/
23 KB
6 KB
Stylesheet
General
Full URL
https://cdn.cookielaw.org/skins/6.18.0/default_flat_top_two_button_black/v2/css/optanon.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/consent/6d956ad9-8bc3-46c7-ab7b-880cb9ceb5a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3ff5e46e97edbe794ecf0c917de78c1ebded3ffd180442254b8dcd670e7a43a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
kW5shvTE3AECENDpRuU76g==
age
9101
vary
Accept-Encoding
content-length
5551
x-ms-lease-status
unlocked
last-modified
Mon, 24 May 2021 01:24:45 GMT
server
cloudflare
etag
0x8D91E52B6EC4390
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
418615e2-a01e-0139-246c-c4de17000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6c0d2cb99b004321-FRA
jquery-3.3.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.3.1.min.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/consent/6d956ad9-8bc3-46c7-ab7b-880cb9ceb5a8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software
nginx /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Origin
https://www.secureworks.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
last-modified
Sat, 20 Jan 2018 17:26:44 GMT
server
nginx
etag
W/"5a637bd4-1538f"
vary
Accept-Encoding
x-hw
1640048439.dop015.ml1.t,1640048439.cds211.ml1.hn,1640048439.cds213.ml1.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30288
js
www.googletagmanager.com/gtag/
172 KB
63 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-15MK64YNN6&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b04c2932ff07e1cb8cf063d84905acc5598f680b1dbd3723d4e73f120b31fccf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
64042
x-xss-protection
0
expires
Tue, 21 Dec 2021 01:00:39 GMT
6si.min.js
j.6sc.co/
27 KB
9 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
8575
Pragma
no-cache
Last-Modified
Thu, 07 Oct 2021 17:17:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615f2bb7-6a5f"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Tue, 21 Dec 2021 01:00:39 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
5145
date
Mon, 20 Dec 2021 23:34:54 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 21 Dec 2021 01:34:54 GMT
bat.js
bat.bing.com/
36 KB
11 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
last-modified
Fri, 03 Dec 2021 01:53:50 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 258634D202C14EA7BC18EC126E854816 Ref B: FRAEDGE1409 Ref C: 2021-12-21T01:00:39Z
etag
"0cb09ee8e7d71:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
10468
conversion_async.js
www.googleadservices.com/pagead/
37 KB
14 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
cafe /
Resource Hash
9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14328
x-xss-protection
0
server
cafe
etag
12503521247758841375
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 21 Dec 2021 01:00:39 GMT
6279.js
script.crazyegg.com/pages/scripts/0097/
5 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0097/6279.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a290010dab515f65c01859cd6b0671ea03c3ac0b18605f840ac0d35be98edeb5

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
cf-cache-status
HIT
age
4456
cf-polished
origSize=4899
cf-ray
6c0d2cbaf94f6937-FRA
ce-version
11.1.376
last-modified
Mon, 20 Dec 2021 23:46:23 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-bgj
minify
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:15c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 15 Oct 2021 14:31:37 GMT
server
cloudflare
age
9
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Tue, 21 Dec 2021 01:10:30 GMT
cache-control
max-age=1200
cf-ray
6c0d2cbb0c52d6c1-FRA
cf-bgj
minify
2mnfp3myy8iz.js
js.driftt.com/include/1640048700000/
218 KB
62 KB
Script
General
Full URL
https://js.driftt.com/include/1640048700000/2mnfp3myy8iz.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
8884e6f751be61d27e2ffc3a05b2d48f57ec0b7abcb1900b9c07477d716bdad3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:42:43 GMT
server
nginx
etag
W/"0f0ed1ee9d5ca2e016e9f69bd7ce7ede"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
tVJBt5ptWREYRQgJqB0IbHaxeSsC9vC_
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
no-cache
access-control-allow-credentials
true
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
kuimA0mVFjbnjdygnl19_9kpeU7H0S3ZPqwkOYm4NJrAv4J4Vs84vQ==
insight.min.js
snap.licdn.com/li.lms-analytics/
5 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.secureworks.com
URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Content-Encoding
gzip
Last-Modified
Wed, 29 Sep 2021 19:17:49 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=59274
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2036
40514862.js
extend.vimeocdn.com/ga/
17 KB
6 KB
Script
General
Full URL
https://extend.vimeocdn.com/ga/40514862.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
b2b2ad1d953b1341442dca10555ebf44343c74fa9755492be52bf521f61dab11

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
age
46394681
x-cache
HIT
x-cache-hits
300137
content-length
5672
x-served-by
cache-fra19156-FRA
x-vimeo-dc
ge
last-modified
Mon, 29 Jun 2020 23:08:13 GMT
server
Apache
x-timer
S1640048440.507359,VS0,VE0
etag
"43cc-5a94122101140"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
via
1.1 varnish
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 30 Jun 2030 01:35:50 GMT
/
f47fc87cb1114490b08a513d8c97555c.js.ubembed.com/
482 B
763 B
Script
General
Full URL
https://f47fc87cb1114490b08a513d8c97555c.js.ubembed.com/
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-P6Z7M2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9d9178dd267bc8b16f83652c0b66b509534d3cf42710c17ff769b34dea04b68d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
br
x-backend-region
eu_west_1
age
1990
etag
c08aa9a6054a06fa204fbaea76ba2e2f-v0.179.1
vary
Accept-Encoding, Referer
x-cache
Miss from cloudfront, HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate
x-amz-cf-pop
FRA50-C1
accept-ranges
none
x-amz-apigw-id
KrHZsFVDDoEFRFg=
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.secureworks.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dwww.secureworks.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dwww.secureworks.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=www.secureworks.com&pId=761986291958991756
0
243 B
Image
General
Full URL
https://attr.ml-api.io/?domain=www.secureworks.com&pId=761986291958991756
Protocol
H2
Server
2600:9000:211e:ea00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
via
1.1 84f381696dd33e92960b92250106e465.cloudfront.net (CloudFront)
apigw-requestid
KrMQzhWXIAMEVmw=
x-amz-cf-pop
FRA56-C2
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
-m3JReyKTqwYgWMhFWmiB0f8AIbtq_c6zlvBhSI7omOflEtvuX-UCg==

Redirect headers

Pragma
no-cache
Date
Tue, 21 Dec 2021 01:00:39 GMT
X-Proxy-Origin
91.199.118.78; 91.199.118.78; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
13816b6f-7a18-4a82-a846-3ad39624a736
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=www.secureworks.com&pId=761986291958991756
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
icon-cybercrime-white.svg
content.secureworks.com/content/app/css/img/
575 B
832 B
Image
General
Full URL
https://content.secureworks.com/content/app/css/img/icon-cybercrime-white.svg
Requested by
Host: content.secureworks.com
URL: https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:64::210:6bb9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
132a5ffb9f182f9331a6ec924337f0f891d072cee728a3aaa16befe653a34d22
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://content.secureworks.com/content/app/css/main.css?v=12-16-2021-v4
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
referrer-policy
no-referrer-when-downgrade
last-modified
Sun, 14 Nov 2021 13:13:16 GMT
server
Microsoft-IIS/10.0
etag
"07e956259d9d71:0"
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=635548
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ranges
bytes
content-length
575
x-content-type-options
nosniff
collect
www.google-analytics.com/g/
0
17 B
Ping
General
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-15MK64YNN6&gtm=2oec10&_p=1586330102&sr=1600x1200&ul=en-us&cid=1625606336.1640048440&_s=1&dl=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&dt=GOLD%20HERON%20%7C%20Secureworks&sid=1640048439&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-15MK64YNN6&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.secureworks.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2386324%26time%3D1640048439561%26url%3Dhttps%253A%252F%252Fwww.secureworks.com%25...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true&e_ipv6=AQL7kwdQG7dfRAAAAX3...
0
0

collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1586330102&t=pageview&_s=1&dl=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&ul=en-us&de=UTF-8&dt=GOLD%20HERON%20%7C%20Secureworks&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=367731014&gjid=1510657615&cid=1625606336.1640048440&tid=UA-1042506-1&_gid=1757709989.1640048440&_r=1&gtm=2wgc10P6Z7M2&z=28897240
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.secureworks.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/j/
1 B
21 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1586330102&t=pageview&_s=1&dl=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&ul=en-us&de=UTF-8&dt=GOLD%20HERON%20%7C%20Secureworks&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=1462524956&gjid=1203119076&cid=1625606336.1640048440&tid=UA-1281488-1&_gid=1757709989.1640048440&_r=1&gtm=2wgc10P6Z7M2&z=325345929
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.secureworks.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
6279.json
script.crazyegg.com/pages/data-scripts/0097/
12 KB
3 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0097/6279.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0097/6279.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3311f71e72f9cc998f576a3034d64fe8e564647c3a777fa28b151dddd946ad93

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
cf-cache-status
HIT
age
4455
ce-version
11.1.376
content-length
2703
timing-allow-origin
*
last-modified
Mon, 20 Dec 2021 23:46:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
6c0d2cbbdd2a68ec-FRA
activity.gif
apt.techtarget.com/activity/
43 B
464 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=17588164&version=2.1.1&ref=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&r=1640048439640
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:40 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
ETag
"2b-5850384029cff"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=41
Content-Length
43
56073499.js
bat.bing.com/p/action/
730 B
749 B
Script
General
Full URL
https://bat.bing.com/p/action/56073499.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
cb9f19a2c0e0851aec99b21840e8c6b28ac86b768d67ac6c8a83e96657dcbcec

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E023C5E5C3684107A8A194EC26182CD9 Ref B: FRAEDGE1409 Ref C: 2021-12-21T01:00:39Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-store,no-cache
content-length
600
0
bat.bing.com/action/
0
150 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=56073499&Ver=2&mid=e72e9840-28f5-4d44-9e58-6569752631f8&sid=6a19958061f911ec9bdd8babd25bb6c8&vid=6a19d80061f911ec911bbffc044e52b4&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=GOLD%20HERON%20%7C%20Secureworks&p=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&r=&lt=2227&evt=pageLoad&msclkid=N&sv=1&rn=264476
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F41165A8F0194D94B8B0D58905E69B7B Ref B: FRAEDGE1409 Ref C: 2021-12-21T01:00:39Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/648366107/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/648366107/?random=1640048439651&cv=9&fst=1640048439651&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc10&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&tiba=GOLD%20HERON%20%7C%20Secureworks&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a9d053e8a44d4464be31fdc290e04a12f874dedaa68fd0d19e21f30989b440d6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1030
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bundle.js
assets.ubembed.com/universalscript/releases/v0.179.1/
173 KB
47 KB
Script
General
Full URL
https://assets.ubembed.com/universalscript/releases/v0.179.1/bundle.js
Requested by
Host: f47fc87cb1114490b08a513d8c97555c.js.ubembed.com
URL: https://f47fc87cb1114490b08a513d8c97555c.js.ubembed.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.64.81 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-64-81.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b1ccb8141195307117c737c7f49f99de131fb55290a5f4c1431cc74ca93119dc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 03 Aug 2021 16:54:54 GMT
content-encoding
gzip
last-modified
Fri, 30 Jul 2021 19:19:04 GMT
server
AmazonS3
age
12038746
etag
W/"4d21402425377bf4a0f3a4f7ab8db2ad"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 47a7b8b932d91b0edbfc42f1ba94ebc1.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
x1dcpCPfIg2DgI7UjAQo0VTzaQINBOnJ0JbVsJ8qYYPB7qzhpYIlFg==
getuidj
secure.adnxs.com/
11 B
693 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 21 Dec 2021 01:00:39 GMT
X-Proxy-Origin
91.199.118.78; 91.199.118.78; 536.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid
b24af2c0-0f74-49d0-aa54-7f971990224a
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.secureworks.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
375 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4e6a0c3b30c3207e61d872d82eb3873721da9c52b29a81d6048ba8d81c1396c6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.secureworks.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
collect
stats.g.doubleclick.net/j/
2 B
443 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-1042506-1&cid=1625606336.1640048440&jid=367731014&gjid=1510657615&_gid=1757709989.1640048440&_u=YADAAEAAAAAAAC~&z=990402793
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 21 Dec 2021 01:00:39 GMT
content-type
text/plain
access-control-allow-origin
https://www.secureworks.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
11.1.376.js
script.crazyegg.com/pages/versioned/commontransformations-scripts/
111 KB
36 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/commontransformations-scripts/11.1.376.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0097/6279.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c08df6d21ef789b95b5568caca9f958aa0f62ce532df3e6d14e267c616b8c934

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 01 Dec 2021 14:25:18 GMT
server
cloudflare
age
908015
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
cf-ray
6c0d2cbbfab46937-FRA
content-length
37109
core
js.driftt.com/ Frame 7AEA
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1640048700000/2mnfp3myy8iz.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
6add6eb72c9eb18bf2441abbfaab1b8a2edd989ba7a3de59f2101d5d2ee929a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Wed, 15 Dec 2021 21:42:24 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
KuHz2KehDayL5o7IbBYRvBQVu4KOSbEO
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Tue, 21 Dec 2021 01:00:39 GMT
cache-control
no-cache
etag
W/"cef4e11652b25654f63c569ea46d0498"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
aZzxR2jzFrqvyDwClxCBtb0sdKfq5FN7wxKgzHjAksROTM_5bz312Q==
chat
js.driftt.com/core/ Frame 53DA
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1640048700000/2mnfp3myy8iz.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
6add6eb72c9eb18bf2441abbfaab1b8a2edd989ba7a3de59f2101d5d2ee929a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron

Response headers

content-type
text/html; charset=utf-8
server
nginx
last-modified
Wed, 15 Dec 2021 21:42:24 GMT
x-amz-server-side-encryption
AES256
x-amz-version-id
KuHz2KehDayL5o7IbBYRvBQVu4KOSbEO
access-control-allow-origin
*
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Tue, 21 Dec 2021 01:00:39 GMT
cache-control
no-cache
etag
W/"cef4e11652b25654f63c569ea46d0498"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
oWnGUW-8WUSEUFztMVNbtqQIu1yPElFopPYTW-8iuwMIef_TIVCbJA==
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=null&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A39%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:39 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.108.243 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-108-243.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,epsiloncookie
Origin
https://www.secureworks.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
server
nginx
access-control-allow-origin
https://www.secureworks.com
access-control-allow-credentials
true
access-control-max-age
1800
access-control-allow-methods
OPTIONS,GET
access-control-allow-headers
authorization,epsiloncookie
details
epsilon.6sense.com/v3/company/
1 KB
763 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.108.243 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-108-243.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
78f781138afd0668e2e12aef6cdf5220e9d2807ede821717cd2b7bf39b993f03

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
Authorization
Token b4a903896ae895a1a6279c68225fd93c979be1d7
EpsilonCookie
64bb1002144200003727c161fc010000bc7b0100

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.secureworks.com
access-control-allow-credentials
true
content-length
575
ga-audiences
www.google.com/ads/
42 B
501 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-1042506-1&cid=1625606336.1640048440&jid=367731014&_u=YADAAEAAAAAAAC~&z=1655091719
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/648366107/
42 B
154 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/648366107/?random=1640048439651&cv=9&fst=1640048400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc10&sendb=1&frm=0&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&tiba=GOLD%20HERON%20%7C%20Secureworks&async=1&fmt=3&is_vtc=1&random=2133419145&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 21 Dec 2021 01:00:39 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/648366107/
0
0

6279.json
script.crazyegg.com/pages/sampling-data-scripts/0097/
164 B
217 B
XHR
General
Full URL
https://script.crazyegg.com/pages/sampling-data-scripts/0097/6279.json?t=455569
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/commontransformations-scripts/11.1.376.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02552266447954c4c9dd5f10d2c7f69ac49af0efcbd550d614f80bf195af1df9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:39 GMT
content-encoding
gzip
cf-cache-status
HIT
age
4455
ce-version
11.1.376
content-length
152
timing-allow-origin
*
last-modified
Mon, 20 Dec 2021 23:46:24 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
cf-ray
6c0d2cbc6de068ec-FRA
collect
stats.g.doubleclick.net/j/
1 B
22 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=%5Bobject%20Object%5D&cid=1625606336.1640048440&jid=556203182&gjid=1276703862&_gid=1757709989.1640048440&_u=aCDAgEABAAAAAG~&z=1353080699
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c06::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 21 Dec 2021 01:00:39 GMT
content-type
text/plain
access-control-allow-origin
https://www.secureworks.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=1586330102&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&ul=en-us&de=UTF-8&dt=GOLD%20HERON%20%7C%20Secureworks&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aCDAgEABAAAAAC~&jid=556203182&gjid=1276703862&cid=1625606336.1640048440&tid=%5Bobject%20Object%5D&_gid=1757709989.1640048440&gtm=2wgc10P6Z7M2&cd1=Credit%20Suisse&cd2=Financial%20Services&cd3=XDR%20Decision%20Purchase%20w%20Suppression%2CVDR%20Decision%20Purchase%20w%20Suppression&cd4=Decision&cd5=Strong&cd6=Purchase&cd7=Strong&z=2094115884
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 20 Dec 2021 03:12:40 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
78479
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
clarity.js
f.clarity.ms/s/0.6.31/
0
0

c.gif
c.clarity.ms/
0
0

runtime~main.1ab6a2b8.js
js.driftt.com/core/assets/js/ Frame 7AEA
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2d7884df4b39d8da35a9fc64df37414510e6d4e38d5458de61591ba7231b6c71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:33 GMT
server
nginx
etag
W/"f3db12840a51a19506ee848124318024"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
uagwtyNAcsmvUX.mnySRtPtld_0xwT8U
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
GlIAskF6jAORJSn2DxXtyeafCLHXAmfr4Mc4hmGdjMB1O6f4a4zmgw==
4.a93e53d9.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 07 Dec 2021 01:16:19 GMT
content-encoding
gzip
age
1208660
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 06 Dec 2021 20:35:32 GMT
server
nginx
etag
W/"fce0b3daf28dfa888be2818f43b06ef0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
sY6bhb_QdenMWUGz8OxGM6tP17Ju8.Yl
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
QRgYaGGoo7sqgTmZ1maLAdjGzgb63S9vWelhKMS_l9iWNWuGOl04Eg==
main~493df0b3.580db5ef.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 06:03:57 GMT
content-encoding
gzip
age
4906602
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:07:00 GMT
server
nginx
etag
W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0wD5iLjW5-AuzvQ9Q0IJQQNf5GfoCMwcbyTQ7aPV2kTG9rkmhTSBSw==
runtime~main.1ab6a2b8.js
js.driftt.com/core/assets/js/ Frame 53DA
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2d7884df4b39d8da35a9fc64df37414510e6d4e38d5458de61591ba7231b6c71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:33 GMT
server
nginx
etag
W/"f3db12840a51a19506ee848124318024"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
uagwtyNAcsmvUX.mnySRtPtld_0xwT8U
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fKI1iqtIfeDTv1IpcGC79gp-WwzcRuckPKEiy-GSFroqMrWtBDCyzg==
4.a93e53d9.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
58 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 07 Dec 2021 01:16:19 GMT
content-encoding
gzip
age
1208660
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 06 Dec 2021 20:35:32 GMT
server
nginx
etag
W/"fce0b3daf28dfa888be2818f43b06ef0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
sY6bhb_QdenMWUGz8OxGM6tP17Ju8.Yl
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TAxYs1zOysRPl9xJzahjgHtVYV6YXywLbFtFK_-PawnxHoxtkCLJlw==
main~493df0b3.580db5ef.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
Origin
https://js.driftt.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 06:03:57 GMT
content-encoding
gzip
age
4906602
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:07:00 GMT
server
nginx
etag
W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
CvHITYl0PgljX-fe-sDZJ1R2YcpHKvbw2pQwGfeUvvg4zWZUhgHIDA==
42.3b1c2441.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
4313141
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:08 GMT
server
nginx
etag
W/"62fe06940598a98760a9eae46800ff59"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EdlEzttRyfgWoyj4roGET6BR_vgIRwuXIlNwgvzQ5PahVEDwr5NeKQ==
17.cce21c2a.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
4313141
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"565bf690dc82ce7e1f45c9647d892490"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MCr-tqghnxw3ABMogzqPcH3FtwYZ1xuzcVzp3hpwoxglZO7piV3ddw==
35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:08:30 GMT
content-encoding
gzip
age
4258329
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:57 GMT
server
nginx
etag
W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KfofLwvG14tKBpk6tXvFAfICf2R3Oaes
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
oSmqOvM9sbZdqYX0cjdhBILiumDbMvBndofpfj4C-Od9mcGk2iMp5A==
15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 06:18:05 GMT
content-encoding
gzip
age
9139354
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:32 GMT
server
nginx
etag
W/"db60664de2c8d54d23e359c94e68f6ce"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0TjgvSXstzsm-s5J-OLdm3jpnKRjJWmooPPY62b7CjdfaZAHL7TGqQ==
19.5937a5b2.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
4313135
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"08aceb94bd26b0e431ca437d628e3c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
IuuN84EirUbdjZ7WlrNuuSiNJxsl3uZnMTuk_23VlU6sYdh5wjFw9A==
32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
juigjv2.842khaDjrzqiMoucoadLCjYk
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ZNKuXVNPHZrZvXSc1s7-9ByCSqSUXsHOz7y0jQ0xjHMzNYszhvX_5Q==
23.a53d721f.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 01:41:23 GMT
content-encoding
gzip
age
1811955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:10 GMT
server
nginx
etag
W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Bes4ojoExyGtogevsaG2vPPgIGz3MINt
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tiJJ1v-bvaS_bai5rys3SDPoan0UpjvBG4kfHxr08yhiD97QrfOFPA==
10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:47:44 GMT
content-encoding
gzip
age
6927174
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 01 Oct 2021 18:06:47 GMT
server
nginx
etag
W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3x5Twlgw02FG-9cmiGlBcMmpSHASMOp41KEntAjHOL4YO4MtudUdnw==
9.cea5327f.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
24 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:01:38 GMT
content-encoding
gzip
age
1763941
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:12 GMT
server
nginx
etag
W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
kAcq_ZkjqKN77g8-CMgNPlqdKZtrW1gkwGniaNkw_hmq2v-1wtAj9g==
13.c2156fc2.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"b94404e76324bd4454531b2e0a54f7bb"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fdgbLn0u5mcQ2QmtV_naxJBxcAS8oa30RFgj1R0pyDVzDPv1upBBOw==
40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:59 GMT
server
nginx
etag
W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
awAA-49HIaUjaQnWS2fJKMGp4fauSPt8NkDevSO2WjfZ7ZNMASrwLw==
33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 03:18:04 GMT
content-encoding
gzip
age
2324555
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
bXdSjY9CDnekLor1Q.RFbiIDqi7ulpJa
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
GE3X96MMjuTnPlJcwQabCzaPnX-7F2QD_FmQcfYqwp06THsZSoe5Nw==
25.b7a0bf53.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 03:18:04 GMT
content-encoding
gzip
age
2324555
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"808f7c7829001881a39cef6846a36ce0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_tCWHnSTw-vPp3X41QGoVJcfHy2T_PnXJaoeFAtTdRUv8OaUQjUXzw==
16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Thu, 04 Nov 2021 16:58:47 GMT
content-encoding
gzip
age
4003312
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 03 Nov 2021 13:47:23 GMT
server
nginx
etag
W/"b451093ecfaa012f364641010ed13346"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
khbVXTc2Ki74brt-SAarDPCLwtBfwcfXbjrFjWnPTD1b1ldNSfR6pQ==
7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame 7AEA
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/7.30af169a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:28:20 GMT
content-encoding
gzip
age
4257139
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:54 GMT
server
nginx
etag
W/"bd798c00af88b7523deb5a8065993250"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RIKw4lFeetxP9uRwqRRdThvm7KjxE3ea41_TM4X7yMT7YBxgeWqnCg==
7.de0073cd.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
69 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/7.de0073cd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d02bd6bea2616e91bc1a8727f0a3ecbfe12dc4bede41a3a46e7e800852879216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:32 GMT
server
nginx
etag
W/"de0f374222414228e38b2c0ac8a86c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5nEHMC7lRNXoyHh4ejPvv48MRmYA4LqZ
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
btdFa7Xktea2XQXHH_fZTdhpKQEOL59LzpNTYVb3o7g8WS0kd61idg==
14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 7AEA
24 B
666 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
age
11770101
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Fri, 06 Aug 2021 18:47:22 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
aX_UKPPWycmepz7XooS_px7ks6cLLQVhD0jsYRQcczkmtAdd6LgRVg==
14.807fe395.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
74 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.807fe395.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9672dbb3bf065e2814d3c7aa0e3d2e74536e2a4ce37b062f31487a1c36e688c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:30 GMT
server
nginx
etag
W/"75a43a7bca7194613f807d29ac3d074c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
jZ418GrnPZWp.Rmpz87oGj4FWIurEvsW
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Nrfyn50dZn657i2IHZB57jUX5ubUqGWEH1VXDwdHCZ3SSIn8eNJ5cA==
20.12e08c2a.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.12e08c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:31 GMT
server
nginx
etag
W/"61892b29d94d646e4fe4c955206e953e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
YWs4_7Z5RQFczzNCHJBWyq0qUaPuRJnt
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zY_QnU8UPhvjKikb0jb71B9na_bue3EbPe3phOrexYfqGmcMPL_K0Q==
12.e4c0464f.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
41 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.e4c0464f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4b105b1d1b7cf4dfb641cb01b96fb40489b082656bbc831e034f74ed7783373d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:30 GMT
server
nginx
etag
W/"eacb0d57a642a57246ad92c107eb7b87"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
CfoW0kqOG5RkuRy7GoeZlZSKhkWayLkb
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xRzQeJQlzKPECIily0hKIJU73sUtZHNpSCxCaBfc7hFnVREH0Rs-rg==
42.3b1c2441.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
4313141
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:08 GMT
server
nginx
etag
W/"62fe06940598a98760a9eae46800ff59"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mh-1QKxaGwvMFoZkjI6dGEUKpTtrmrph2VGraYS88ftm8ZGVMa8hjA==
17.cce21c2a.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:54:58 GMT
content-encoding
gzip
age
4313141
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"565bf690dc82ce7e1f45c9647d892490"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EfAv4yvDxEwDhvZlVSBjlUB7uPzw8kzVgYGBavHp6LV7WpsROImQhg==
35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:08:30 GMT
content-encoding
gzip
age
4258329
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:57 GMT
server
nginx
etag
W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KfofLwvG14tKBpk6tXvFAfICf2R3Oaes
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pZZY9r_tP_4043c-RRQNJ9ShgJQCkIbz4jdKH9ZaAXAak6qt7xM_9Q==
15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 06 Sep 2021 06:18:05 GMT
content-encoding
gzip
age
9139354
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 03 Sep 2021 14:38:32 GMT
server
nginx
etag
W/"db60664de2c8d54d23e359c94e68f6ce"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_6mp75ynL4OUb8-bm_R-iGpX798XNDztwfitPubamNJJECPLCKCSAQ==
19.5937a5b2.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
72 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
4313135
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:07 GMT
server
nginx
etag
W/"08aceb94bd26b0e431ca437d628e3c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
SCyN2bh8BrNrKjxL4bnii-0U_xNQ-JpGXzmraeaUX6Pj-OJCdQyA-w==
32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
16 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
juigjv2.842khaDjrzqiMoucoadLCjYk
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0wNsD7unAxZkJlUw79rZsJNY1kTzqQWguP9taSlONftSl7CvYhBG8Q==
23.a53d721f.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 01:41:23 GMT
content-encoding
gzip
age
1811955
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:10 GMT
server
nginx
etag
W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Bes4ojoExyGtogevsaG2vPPgIGz3MINt
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TeHFVohiFDhBy6qMi8yPctBuPC66_L_24ycauB384hXW049_UnD04Q==
10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 01 Oct 2021 20:47:44 GMT
content-encoding
gzip
age
6927174
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 01 Oct 2021 18:06:47 GMT
server
nginx
etag
W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
o4S1zZCKcBdfx45an_CwGkivQgGeq92sYdJq74Xb4ZwJKTD2aEUOgQ==
9.cea5327f.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
24 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 30 Nov 2021 15:01:38 GMT
content-encoding
gzip
age
1763941
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 29 Nov 2021 22:20:12 GMT
server
nginx
etag
W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
cpeoMfnIPH_wtjjx4NQsXbdC7BseiZ6sAo-97-xVxN3D8hk_FPm1wA==
13.c2156fc2.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:58 GMT
server
nginx
etag
W/"b94404e76324bd4454531b2e0a54f7bb"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
nnuoWD2dvD7CfYB1GXfEPolqrnAKCzUBAirKwFaGCm1IVK6eDJQudg==
40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:21 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:59 GMT
server
nginx
etag
W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KIwGILa7Kc4iYTF6SUfa3Kx-FmnALjC80gWojJRj8MWbmtn2Go8EjQ==
33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 03:18:04 GMT
content-encoding
gzip
age
2324555
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
bXdSjY9CDnekLor1Q.RFbiIDqi7ulpJa
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
HA50FusQDwdk7MCn532uFwdRQdtMYzY3TxiMrvERbwK1Uo2MQpHcvA==
25.b7a0bf53.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 03:18:04 GMT
content-encoding
gzip
age
2324555
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:19 GMT
server
nginx
etag
W/"808f7c7829001881a39cef6846a36ce0"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pvij5j5Wx8w017Yxv3AIo0u9mTomYE3kk2gc9D1O4NmI9pAiC793gg==
16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Thu, 04 Nov 2021 16:58:47 GMT
content-encoding
gzip
age
4003312
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 03 Nov 2021 13:47:23 GMT
server
nginx
etag
W/"b451093ecfaa012f364641010ed13346"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Oqs0F2taC-SFNCY7ENEyaYnKGbaLC0-TsQRmQwArmoRaqwcBvvcdlg==
7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/7.30af169a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 18:28:20 GMT
content-encoding
gzip
age
4257139
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 01 Nov 2021 17:24:54 GMT
server
nginx
etag
W/"bd798c00af88b7523deb5a8065993250"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
cQLyei05kPoDWL8XHnOn1lh0o6LTqJNAwzUEjO11JzlMxYDYVfrt7g==
7.de0073cd.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
69 KB
21 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/7.de0073cd.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d02bd6bea2616e91bc1a8727f0a3ecbfe12dc4bede41a3a46e7e800852879216
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:32 GMT
server
nginx
etag
W/"de0f374222414228e38b2c0ac8a86c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5nEHMC7lRNXoyHh4ejPvv48MRmYA4LqZ
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vaGZyrAilmq7cNyjnAfAtTwTQRoO1YujeE-9h6tQGPLAuNtN4s_Agg==
14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 19:32:17 GMT
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
age
11770101
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Fri, 06 Aug 2021 18:47:22 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Mz8rvLXgagUN4Kq3V4IsD5GUjicp38tGhlBd_kzy6sYHIJPyLHTLag==
14.807fe395.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
74 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/14.807fe395.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9672dbb3bf065e2814d3c7aa0e3d2e74536e2a4ce37b062f31487a1c36e688c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:30 GMT
server
nginx
etag
W/"75a43a7bca7194613f807d29ac3d074c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
jZ418GrnPZWp.Rmpz87oGj4FWIurEvsW
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LP2oEtWWh3wjwYwIIlz-d6PIyt8FVxI8gtECceL4eB5W4CHCmzPObA==
20.12e08c2a.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
47 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.12e08c2a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:31 GMT
server
nginx
etag
W/"61892b29d94d646e4fe4c955206e953e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
YWs4_7Z5RQFczzNCHJBWyq0qUaPuRJnt
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ZymkHIoEPMdgtdl8hc7kPV8FcO2U_G_AL6WqlBTGOOlwBGKmZHsL3w==
12.e4c0464f.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
41 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/12.e4c0464f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4b105b1d1b7cf4dfb641cb01b96fb40489b082656bbc831e034f74ed7783373d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:30 GMT
server
nginx
etag
W/"eacb0d57a642a57246ad92c107eb7b87"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
CfoW0kqOG5RkuRy7GoeZlZSKhkWayLkb
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wGlVvidcBFbohCy_tjcqcRleJBFRYIe02C_e7OSjtvH65e_tyT-prw==
22.e10510b6.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
42 KB
12 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.e10510b6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sun, 05 Dec 2021 03:00:11 GMT
content-encoding
gzip
age
1375228
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 02 Dec 2021 19:39:10 GMT
server
nginx
etag
W/"a99459752bee496e4af7c45277fd9c26"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
.p1WPnsH8XGSlb.mHBXCMu26rOKTD1WF
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ggATrektCvNKKH4ZMu1odRMjiIEX_7FMQx2nWxDV_725C_cO7riu9Q==
24.49c6961c.chunk.css
js.driftt.com/core/assets/css/ Frame 7AEA
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/24.49c6961c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 18 Oct 2021 07:58:46 GMT
content-encoding
gzip
age
5504513
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 15 Oct 2021 18:19:47 GMT
server
nginx
etag
W/"f80cd64e339375567091159cb077b941"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
t3wd1L70.jr_F45fRiZ9jDIt4M2lflSx
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RvvLF0GVYZDp9O9c5db1nAX_mJiR7an_XvLHyFM4Tm4cB1zdxdXk8w==
24.a557fbd6.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.a557fbd6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4d85222516f652c200ef03b89b4b755c6a54210c75ca599fb53e0a05d677e197
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:31 GMT
server
nginx
etag
W/"04cf8ee37950ab9133d56182ac42f2d5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
zlEPlIdbOgMuBLYRnHr8Y8oFPnOH1I49
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tJAIHFhAVGCpFIHlUA6rsA_OjbOqV81VFcLsR-ICBO8uVPeLgcAPQQ==
18.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 7AEA
365 B
1007 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/18.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 27 Sep 2021 18:05:58 GMT
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
age
7282481
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Mon, 27 Sep 2021 17:53:27 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
2nl84_Ynkb7J4eflOi4MBL9RG1iL8udX
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bVuFq4s7-nEa7iUwy2T1yVi9nGPKR-tvRO49258QMEkMR2Z9VFKzGg==
18.bcdc875a.chunk.js
js.driftt.com/core/assets/js/ Frame 7AEA
84 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.bcdc875a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d61bed847a1b1ac4dc945aec27f3b7fd7617c63a6397bb5f9442643865a52cfb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=2mnfp3myy8iz&region=US&forceShow=false&skipCampaigns=false&sessionId=4e87d2b2-dc63-423c-b84b-5d02f2baa057&sessionStarted=1640048439.691&campaignRefreshToken=cb8b2d1b-2a68-49d2-a7be-154eed491dd2&hideController=false&pageLoadStartTime=1640048438200&mode=CHAT&driftEnableLog=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:31 GMT
server
nginx
etag
W/"f333661975e2663674d8c3268595010b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
WGGQItX.QTqfwGA_o1qW_QMFO22mzJbX
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ITxr5i5dJNVZcGIcqIigIuAgUnjpMkL0CoCJJu-RAtA9CongV8Q0gA==
30.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/30.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 24 Nov 2021 03:18:04 GMT
content-encoding
gzip
age
2324556
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 22 Nov 2021 19:33:17 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
KnMWR4.IVw6c9whvXizXK7OlyztwKK5T
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WEFNplyK0sHJ2lJR84CUtDfkEdaJV8ERVXgN35tP5xQcZpX7uk1E4w==
30.0383f092.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/30.0383f092.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a5e4d82414a2ca26ea7d94c8586c3c32363073ecb1214c884d302439f420913c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 06 Dec 2021 16:07:51 GMT
content-encoding
gzip
age
1241569
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 06 Dec 2021 15:09:52 GMT
server
nginx
etag
W/"62187322b72b1fa76d14e19526c132b8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
z3aE86SV2XLkllCr6fKLzNFXHsnbcDpg
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
UeAdN9HQtzZgko7D2gKgNCz_UBWABclRKIYWKkccsxZ0ul0g5fgtrg==
1.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 01 Nov 2021 02:55:04 GMT
content-encoding
gzip
age
4313136
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 29 Oct 2021 20:21:04 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
K9l0WdnhS0.sb1iJQdTJni3xfVGcn633
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
_2Y-x34xXZZKnTkUhylNdsqNjhOJwmyFoe_6gWSJLEvBnGg4S3sDFg==
1.187c50a5.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
54 KB
16 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.187c50a5.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Mon, 25 Oct 2021 09:53:22 GMT
content-encoding
gzip
age
4892838
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 22 Oct 2021 17:06:57 GMT
server
nginx
etag
W/"eeccccb655ee3b6bcb8b1a9b1da4fd30"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
T4NYA9GFrw0AOH7iks5Owut4YT_Q7yUg
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ClMG3MoABCL_monbE-i9sKaXiVPUOaRymPgRp62Qu0C7IXCXiXhH0g==
0.ee2abab8.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
44 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/0.ee2abab8.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbbdc87055e3735446865635b4678301f3e2a1a8796c5c8f9e6708aee679592
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 14 Dec 2021 14:21:26 GMT
content-encoding
gzip
age
556754
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Mon, 13 Dec 2021 22:15:51 GMT
server
nginx
etag
W/"c00b54e499f71a56923e5c2db3c1ebfc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
68ABimk3FXgiFdH1qEDL3xdLWSNdRuPT
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
h9IdFsY02pMWJhcs7GzV9v3PXhKUU4ac71IFEEODYAUfx-mwom6qsg==
0.9bdf0d5a.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
70 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.9bdf0d5a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7072e71c4451255d76dd060fa22d2372b336662caa03dad732c3e8c495e3722b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:30 GMT
server
nginx
etag
W/"2d1fa187641adb5aa5b2cb4ccf569a19"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
uvezfoFNFXg1JFwXTJz2vp2G6IK.FxaR
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
7r3xsB7Cj9YPe-qt8fIEoQd3bAnIaLZxfcLc1UD4xYz-DR0VOhjKsA==
29.a4eacd1c.chunk.css
js.driftt.com/core/assets/css/ Frame 53DA
11 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/29.a4eacd1c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 17 Nov 2021 20:12:40 GMT
content-encoding
gzip
age
2868480
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 17 Nov 2021 19:25:04 GMT
server
nginx
etag
W/"5fcabdf983fd5bbf7cb199063137d146"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
k82F8FaNpkIB_WK109g86MbRHlA8U_6q
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
O22ariJb87noCbClVpQZ-9gKRJCWMsG56x79EnS0a2cNjbcNLYBxWw==
29.53419916.chunk.js
js.driftt.com/core/assets/js/ Frame 53DA
11 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/29.53419916.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1ab6a2b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b3e92729562bf7aa805f612b4f909f640cdcfe2ccdc9ee6cf78f710491208e78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1640048438200
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Wed, 15 Dec 2021 21:42:23 GMT
content-encoding
gzip
age
443897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 15 Dec 2021 21:37:31 GMT
server
nginx
etag
W/"72171f9c0b9a4cd90bdf2440c1e572de"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
YNPTQIKY2ZyKApUq3KLoPLuIK9xcf5uv
via
1.1 8b5bc0831e6dab612582614c3009efa7.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA53-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
u5-SXUfspPvzEDxtfEPPFu1oD3geF96Lx_sCRsr56EUUukv_bLSUiQ==
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 7AEA
25 B
123 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
server
istio-envoy
requestid
2a278b5df9bd6f66
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
14
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drifteee78964cc0a1671b028bf679e0
content-length
13
x-envoy-upstream-service-time
0
server
istio-envoy
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 7AEA
126 B
222 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
4b275cc1f0b00b80ea4cfaea94ad959cd55496b2805d17aa98a3c6662aa3ecb9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
server
istio-envoy
requestid
5443c66f0b978c9
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
126
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 21 Dec 2021 01:00:40 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drift1faf5d244ae8b395425d71bd267
content-length
13
x-envoy-upstream-service-time
0
server
istio-envoy
2mnfp3myy8iz.json
embeds.driftcdn.com/embeds/ Frame 7AEA
39 KB
8 KB
XHR
General
Full URL
https://embeds.driftcdn.com/embeds/2mnfp3myy8iz.json
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.209.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-209-78.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ed0e94527c13e5abb4368b1ce7fe948a7611c629c8357ab1c89900ed656bae12

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Tue, 21 Dec 2021 01:00:41 GMT
content-encoding
gzip
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
access-control-max-age
3000
access-control-allow-origin
*
last-modified
Thu, 16 Dec 2021 22:55:03 GMT
server
AmazonS3
etag
W/"d9fdafca98ce74e80d0c014b8b37c809"
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/json; charset=UTF-8
via
1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
cache-control
public, max-age=30
x-amz-cf-id
Aa-X6POM6lEQT0IFEPdH3D38GvU17CIfH788GAEhEF-zx5zeeRfvdg==
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=64bb1002144200003727c161fc010000bc7b0100&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A39%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:40 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=64bb1002144200003727c161fc010000bc7b0100&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A40%20GMT%22%2C%22timeSpent%22%3A%221009%22%2C%22totalTimeSpent%22%3A%222011%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:41 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 7AEA
25 B
89 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 21 Dec 2021 01:00:42 GMT
server
istio-envoy
requestid
590b4733c57c9e38
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
11
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.147.21.139 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-147-21-139.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://js.driftt.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

date
Tue, 21 Dec 2021 01:00:42 GMT
access-control-allow-origin
*
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials
true
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age
1209600
strict-transport-security
max-age=31536000; includeSubDomains
content-type
text/plain
allow
POST,OPTIONS
requestid
drift29795094ca4944c07b849985e5c
content-length
13
x-envoy-upstream-service-time
28
server
istio-envoy
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=64bb1002144200003727c161fc010000bc7b0100&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A41%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223012%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:42 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=64bb1002144200003727c161fc010000bc7b0100&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A42%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224013%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-233-140.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.secureworks.com/research/threat-profiles/gold-heron
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date
Tue, 21 Dec 2021 01:00:43 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
px4.ads.linkedin.com
URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true&e_ipv6=AQL7kwdQG7dfRAAAAX3agTJq0QHP2ZhCzsVPvLoJn6317Ng5I8DyKZEitUzrDKNzTQKIkKI
Domain
www.google.de
URL
https://www.google.de/pagead/1p-user-list/648366107/?random=1640048439651&cv=9&fst=1640048400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc10&sendb=1&frm=0&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&tiba=GOLD%20HERON%20%7C%20Secureworks&async=1&fmt=3&is_vtc=1&random=2133419145&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Domain
f.clarity.ms
URL
https://f.clarity.ms/s/0.6.31/clarity.js
Domain
c.clarity.ms
URL
https://c.clarity.ms/c.gif
Domain
b.6sc.co
URL
https://b.6sc.co/v1/beacon/img.gif?token=db8067e51eb58581f03147464f6063b2&svisitor=64bb1002144200003727c161fc010000bc7b0100&session=f2a4ca0d-bb33-47da-889d-c5d789f1a0d1&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2021%20Dec%202021%2001%3A00%3A43%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225014%22%7D&isIframe=false&m=%7B%22description%22%3Anull%2C%22keywords%22%3Anull%2C%22title%22%3A%22GOLD%20HERON%20%7C%20Secureworks%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&pageViewId=e0d23be3-378d-45c2-8959-612241de0432&an_uid=0

Verdicts & Comments Add Verdict or Comment

144 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| NREUM object| newrelic function| __nr_require function| $ function| jQuery function| SimpleDTO function| set_elq_quiz_codes object| PDGData object| PDG object| EloquaData object| Eloqua object| Fulfillment object| MarketoCleanup object| MarketoErrors object| MarketoData object| Marketo object| MarketoForm object| MarketoOversight object| MIT object| MITMap object| MITData function| Cookies object| dataLayer function| subscribeEvent function| unsubscribeEvent function| startActivityHandler function| placeCheckerRequest function| placeCssAspxRequest function| timeoutSleep function| getMetatagContent function| Carousel object| core object| __core-js_shared__ function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill function| IScroll function| lity function| Url function| $clamp function| initScrollMore function| initLoadMore function| initHeaderPanel function| initCarousel function| initSameHeight function| initRetinaCover function| openExpandedFooterSitemap function| closeExpandedFooterSitemap function| share object| DSW function| SearchResultType boolean| nav_hover number| scrollTop function| preloadImages number| cofset number| win function| countUp object| Vimeo boolean| VimeoPlayerResizeEmbeds_ object| AOS object| hljs object| React object| ReactDOM function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| postscribe object| google_tag_manager_external object| google_tag_manager object| MunchkinTracker object| OneTrust string| containerName string| languageSwitcherFileName string| useDocumentLanguage string| languageSwitcherFilePathPart string| languageSwitcherURL function| getLanguageSwitcherScriptPath function| isLanguageSwitcherFile function| OptanonWrapper undefined| a undefined| c function| jsonFeed object| Optanon string| OnetrustActiveGroups string| OptanonActiveGroups object| google_tag_data function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si string| GoogleAnalyticsObject function| ga object| techtargetic function| drift undefined| driftt string| _linkedin_partner_id object| _linkedin_data_partner_ids object| uetq object| gaGlobal function| onYouTubeIframeAPIReady function| lintrk boolean| _already_called_lintrk object| gaplugins object| gaData function| __vimeoRefresh boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_DATA_URL function| UET function| UET_init function| UET_push object| ueto_0b99c10af0 function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id boolean| _storagePopulated object| CE2BH function| CE_URL_FINGERPRINT string| __INDIVIDUAL_ONE_VERSION_ev-store_ENFORCE_SINGLETON undefined| __INDIVIDUAL_ONE_VERSION_ev-store object| ube function| clarity

34 Cookies

Domain/Path Name / Value
www.secureworks.com/ Name: ASP.NET_SessionId
Value: jcspx5u5wvk2gyi4iikjo2fh
www.secureworks.com/ Name: SC_ANALYTICS_GLOBAL_COOKIE
Value: e3b48d295047419da070714f64e734f8|False
.www.secureworks.com/ Name: ApplicationGatewayAffinity
Value: 324eae91ff21aeb30e33c21363d7e7070cea41b85ecb475862c8f50aedf97aa4
.www.secureworks.com/ Name: ApplicationGatewayAffinityCORS
Value: 324eae91ff21aeb30e33c21363d7e7070cea41b85ecb475862c8f50aedf97aa4
.secureworks.com/ Name: _mkto_trk
Value: id:725-SMC-563&token:_mch-secureworks.com-1640048439240-37772
.secureworks.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Tue+Dec+21+2021+01%3A00%3A39+GMT%2B0000+(GMT)&version=6.18.0&landingPath=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&groups=0_288081%3A1%2C0_288078%3A1%2C0_270850%3A1%2C0_288138%3A1%2C1%3A1%2C0_227367%3A1%2C0_227365%3A1%2C0_288077%3A1%2C0_288083%3A1%2C2%3A1%2C0_227370%3A1%2C3%3A1%2C0_270866%3A1%2C0_288080%3A1%2C4%3A1%2C0_288082%3A1%2C0_227355%3A1%2C0_297683%3A1%2C0_301142%3A1%2C0_301144%3A1
.secureworks.com/ Name: _gcl_au
Value: 1.1.1088044849.1640048439
.6sc.co/ Name: 6suuid
Value: 64bb1002144200003727c161fc010000bc7b0100
.bing.com/ Name: MUID
Value: 23B2480B7462662920DB591F750967A2
.secureworks.com/ Name: _ga_15MK64YNN6
Value: GS1.1.1640048439.1.0.1640048439.0
.techtarget.com/ Name: __cf_bm
Value: 4b3BZ8ym7P0_GHDXy46N5G7yZP.e7Q_XeKrcCYpziO4-1640048439-0-ATpjlLSVubFsZUSRSZYQcSHW2kf1ObMivXQnV0Jk1sRR9R5RSXRlAFFUaxE6urwr5taK9+hBRQp3/RlfV0SeCQY=
.secureworks.com/ Name: _ga
Value: GA1.2.1625606336.1640048440
.secureworks.com/ Name: _gid
Value: GA1.2.1757709989.1640048440
.secureworks.com/ Name: _gat_UA-1042506-1
Value: 1
.secureworks.com/ Name: _gat_UA-1281488-1
Value: 1
.secureworks.com/ Name: _uetsid
Value: 6a19958061f911ec9bdd8babd25bb6c8
.secureworks.com/ Name: _uetvid
Value: 6a19d80061f911ec911bbffc044e52b4
www.secureworks.com/ Name: drift_campaign_refresh
Value: cb8b2d1b-2a68-49d2-a7be-154eed491dd2
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
www.secureworks.com/ Name: _an_uid
Value: 0
www.secureworks.com/ Name: _gd_visitor
Value: 5091d468-f3a6-48ed-866c-0242d6fe7fdb
www.secureworks.com/ Name: _gd_session
Value: f2a4ca0d-bb33-47da-889d-c5d789f1a0d1
www.secureworks.com/ Name: _gd_svisitor
Value: 64bb1002144200003727c161fc010000bc7b0100
.linkedin.com/ Name: UserMatchHistory
Value: AQIlIeV5MwfX7QAAAX3agTGE1Sd7qmQiNv0G0gaGdlcEawQ8FVeWJ-ftBmhMoij4tUWb2elfuCIngw
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLIxIjIytUhJgAAAX3agTGEUmYBheGm8-thykJaTp1uG_qey1nsGwICF07FIEJdqQUFr4kaVPAaxdAEFcEXrw
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&9f903dfb-7c3e-437d-8e7a-727fad780ea0"
.linkedin.com/ Name: lidc
Value: "b=VGST00:s=V:r=V:a=V:p=V:g=2597:u=1:x=1:i=1640048439:t=1640134839:v=2:sig=AQFYWmASyyqYmfZgF9NesfSDJFaRov5U"
.secureworks.com/ Name: _dc_gtm_objectObject
Value: 1
.adnxs.com/ Name: uuid2
Value: 761986291958991756
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&202112210100391366f399-c3d9-42d7-8aa6-d89a1dbaf170AQFFJNE-mS9YxaP_WL-MS9C8nPz_f5Bb"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NDAwNDg0Mzk7MjswMjEOR817VMVeprE7TkhekEuXAx+RkQAy0Skqv331eYwpFA==
apt.techtarget.com/ Name: TS01fac3f6
Value: 012c6646599215054fee27a92215fd6de7e4bfc24a1998b51867a81c70af1942f99678ac363aadcc3f9f625c8329aa59185fdfca28

5 Console Messages

Source Level URL
Text
security error URL: https://www.secureworks.com/research/threat-profiles/gold-heron(Line 6)
Message:
Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-MTgwMGJhY2VjZjg2NDUxYWEwNzA2NWMxOWEwZDIzZmE=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com". Either the 'unsafe-inline' keyword, a hash ('sha256-VYEiGWX8EObDRAQ/dVWoQArf2XotFXWUXCjlpYNbTW4='), or a nonce ('nonce-...') is required to enable inline execution.
security error URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Message:
Refused to load the image 'https://www.google.de/pagead/1p-user-list/648366107/?random=1640048439651&cv=9&fst=1640048400000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgc10&sendb=1&frm=0&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&tiba=GOLD%20HERON%20%7C%20Secureworks&async=1&fmt=3&is_vtc=1&random=2133419145&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y' because it violates the following Content Security Policy directive: "img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com".
security error URL: https://bat.bing.com/p/action/56073499.js
Message:
Refused to load the script 'https://f.clarity.ms/s/0.6.31/clarity.js' because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-MTgwMGJhY2VjZjg2NDUxYWEwNzA2NWMxOWEwZDIzZmE=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
security error URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Message:
Refused to load the image 'https://c.clarity.ms/c.gif' because it violates the following Content Security Policy directive: "img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com".
security error URL: https://www.secureworks.com/research/threat-profiles/gold-heron
Message:
Refused to load the image 'https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2386324&time=1640048439561&url=https%3A%2F%2Fwww.secureworks.com%2Fresearch%2Fthreat-profiles%2Fgold-heron&liSync=true&e_ipv6=AQL7kwdQG7dfRAAAAX3agTJq0QHP2ZhCzsVPvLoJn6317Ng5I8DyKZEitUzrDKNzTQKIkKI' because it violates the following Content Security Policy directive: "img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com".

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy object-src 'none'; script-src 'self' 'nonce-MTgwMGJhY2VjZjg2NDUxYWEwNzA2NWMxOWEwZDIzZmE=' 'sha256-wY8ZJu7Uu8c5AFYGRuoE7SNBraw8IAkl5Yz+glnnte8=' 'sha256-UGfgrQ+GKJogDAQthuGt5lpepOeF3ypbYTr2PPxcBdU=' 'sha256-hUiPqjPAx0BTYk+HP/Ohq7cZFW+CFLUDreW74sIBUJk=' 'sha256-MWnKpq2mO4B+C/F7fLTeifs05WkVCc8Hkl+SzXGUmtI=' 'sha256-QiHtJSgKkeO/qh+2A9GCUt3xk8ONLQAa6uua+j+nHLg=' 'sha256-7+1sMW/o6RcIncEOmuvZbRThB6NRZLwQjvsqQAGehKA=' 'sha256-tYinntSHdpRdg0LwZuBycjWqxaMdCzBdOnOGsSZH2Ho=' 'sha256-DP0AJIADL+tS8s/bg6t7xbMHunrd17JCuOgpyNjxt/M=' 'sha256-sqwbnK0D7p9u3WG0lgAYLYmp/byKS9zlT2eFORz1SDY=' 'sha256-L436NBsgbW4nnr2zz6geY9aouLDwQiH+458+ny7TeJ8=' 'sha256-t21JzuoP0AGVdHYfaGtWzFviQ1hj34OuECR3Ur2P1Dk=' 'sha256-kmGPVWtzfwq6b9fEOy1NmWxrKyxreHZU5tKvRxQpDMA=' 'sha256-SAqGhA/G1eraYlnHKoGwPlIvGfOo45eq5hoyKq2LnUY=' 'sha256-+08d4MzO/if2DlZslM+0a0gvpYaPHK7ilzV9yUXHxRo=' 'sha256-5RKybv4IYG3Rt1CcIXoS1OAD7D0vjWLop/a6KVpWxM0=' 'sha256-N/Mk5WIdXnJRlsc5rmMcLJsovC5ozGJ5BmVdRxKOeNc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-sdKFLBOaDq01ySztbW/n0JnIwsMIlCr7AaMAznJOqA0=' 'sha256-7pyFNQ34QDbIyjfqF4dboUBH/FqtGtJgw7KPgC+aKY8=' 'sha256-yYGe3YxZ1stILsg6s+TKQ7ACovlrQ/V7H5hpGiko1EI=' 'sha256-JcTUCZru8bIzmyUfGjmyP1Nwn0ccUuwLyJA5/jgV2jI=' 'sha256-zEF/ALwwDYV2nZ+rdYGh2XpjU1lbO3oZ2osZayOlmpw=' 'sha256-ErdS+5vyua60ApoR4T4MK5hMhAxO8I75iqTuR4st0lk=' 'sha256-dgOinhXczUSm4ADnOKjecy4HqoIpihiWY1xMUGi3KiE=' 'sha256-bAZaADjFxXYURQUP9Z4p4eiIim+gCGst1ZWemjLGJxo=' 'sha256-x3E2vOOOHY24kNAmZOQxorAyW5o6cX3R7J5Jg+RTqZY=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-mvYU2m+aQi6xWWVpxauZ/UaXg+HkwxCv4r/qVBDAm3A=' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-Ov0LRI92VqZTYbOhyIvK8iFCm9rBs/HXaYLwlDMrra0=' 'sha256-HjgaVwCCuGQHih00gvN/PUGZuGwVIWd/6sThgUEi83E=' 'sha256-7oEVqsTDSU0XTGoiH3B7bXM3sMDjv58JCTndWi8pUKw=' https://code.jquery.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://pcdnscwx001.azureedge.net https://live-scwx-pe.pantheonsite.io https://marketo-scwx-pe.pantheonsite.io https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://sjs.bizographics.com https://*.vimeo.com https://*.vimeocdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://scwx.annuitas.io https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://trk.techtarget.com https://api.rollbar.com https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://widgets.ziftsolutions.com https://hammock.hotprofile.biz https://transfertool.hotprofile.biz/production/ https://m-store-hammock.hot-profile.com/hot-profile/ https://wa2.hot-profile.com https://*.on24.com https://*.ceros.com https://*.js.ubembed.com https://assets.ubembed.com; img-src 'self' https://*.vimeo.com https://*.vimeocdn.com content.secureworks.com pcdnscwx001.azureedge.net id.rlcdn.com www.googletagmanager.com cdn.cookielaw.org fonts.gstatic.com optanon.blob.core.windows.net web.secureworks.com attr.ml-api.io bat.bing.com www.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.ubembed.com; frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

725-smc-563.mktoresp.com
apt.techtarget.com
assets.ubembed.com
attr.ml-api.io
b.6sc.co
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.clarity.ms
cdn.cookielaw.org
code.jquery.com
content.secureworks.com
embeds.driftcdn.com
epsilon.6sense.com
extend.vimeocdn.com
f.clarity.ms
f47fc87cb1114490b08a513d8c97555c.js.ubembed.com
googleads.g.doubleclick.net
j.6sc.co
js.driftt.com
metrics.api.drift.com
munchkin.marketo.net
px4.ads.linkedin.com
s.ml-attr.com
script.crazyegg.com
scwx.annuitas.io
secure.adnxs.com
snap.licdn.com
stats.g.doubleclick.net
trk.techtarget.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.secureworks.com
b.6sc.co
c.clarity.ms
f.clarity.ms
px4.ads.linkedin.com
www.google.de
104.111.233.140
104.111.234.67
142.250.186.162
143.204.209.46
143.204.209.78
151.101.14.109
151.101.193.131
18.195.108.243
192.28.144.124
2001:4de0:ac18::1:a:3b
206.19.49.24
23.100.35.118
2600:9000:211e:ea00:12:3734:2a40:93a1
2606:4700::6810:9540
2606:4700::6812:15c
2606:4700::6813:9308
2620:12a:8001::2
2620:1ec:c11::200
2a00:1450:4001:801::2008
2a00:1450:4001:80f::200e
2a00:1450:4001:812::2004
2a00:1450:4001:82f::2002
2a00:1450:400c:c06::9d
2a02:26f0:64::210:6bb9
2a02:26f0:6c00::210:ba20
34.193.113.164
37.252.173.22
54.147.21.139
65.9.64.81
68.67.153.60
0049c42b57e92164c558905bff7c17441afe55dc569f0062162e77a532964b80
02552266447954c4c9dd5f10d2c7f69ac49af0efcbd550d614f80bf195af1df9
0a8b1ef45e2622985d8d86e6317525253a50b84b7a37e92b14f2af14f430e10e
11d5ce34f206afb82ddf5e90ac14a2572bf9ee7177623d3a22d961d14bbd71ae
132a5ffb9f182f9331a6ec924337f0f891d072cee728a3aaa16befe653a34d22
154248124c7d6ba28a3d741311104b4d4a503dad23095470f663f2613532c733
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
1a914a4b01d30dc7a83ccf4407787ab02647c601e2e9b174f49cbd190de57313
22494645cd5c6508829ef760cfafdf7292ddfbb824f23a323b6d3f3bd10a2538
245afe5ee915709f5a6faef0469c2750a4879d364255f9a6a3132a2ce031793d
24849b91ee6d5f169a67d0f0f316ec3d3e7b62454b4a87a3138eb5b87465676c
2659dad8a9fb723f498b13cc3069e4f6db49b008d63002f4a218aa90ad751623
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
2d7884df4b39d8da35a9fc64df37414510e6d4e38d5458de61591ba7231b6c71
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
3048557217de68dd27ec528560891893511e16507054f9d07b7dde80b6a629e2
30a584b184cc0bffda4f65106a5440dd18027f5d832d74b56ee5d219b3b48cd6
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3311f71e72f9cc998f576a3034d64fe8e564647c3a777fa28b151dddd946ad93
3a5bdbd449317313bbe8d2551a1eaba58687aeaf5fb02943d1fa3e804c0c4e82
3ff5e46e97edbe794ecf0c917de78c1ebded3ffd180442254b8dcd670e7a43a5
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
42166c909b8db5b9d362bfc1c28a3f7e06f109aa449a70b3bd293a6e6bf62ac2
467bb909c30ea44082026b111eaab93bbae65920a13c353b57a22a1ca9d3c5bf
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
4b105b1d1b7cf4dfb641cb01b96fb40489b082656bbc831e034f74ed7783373d
4b275cc1f0b00b80ea4cfaea94ad959cd55496b2805d17aa98a3c6662aa3ecb9
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4d85222516f652c200ef03b89b4b755c6a54210c75ca599fb53e0a05d677e197
4e6a0c3b30c3207e61d872d82eb3873721da9c52b29a81d6048ba8d81c1396c6
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
50f6d5d4c63ae14f65d7a8a91f989edd305a348fdd279c1dd69b94403d64ac46
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
5a9e4352db3a1f75caf77c79146fd0f059ba043d692bae117b2d291d0c4ac7ad
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5dbbdc87055e3735446865635b4678301f3e2a1a8796c5c8f9e6708aee679592
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
652693cf351da926038bb19decb41b5b58f439e786b26a1a32e9498b2390b9bc
690ffa4f3709f9f45b28bdab7637e0da04880aee1d2d4e9caf4af0a99782a2ac
6add6eb72c9eb18bf2441abbfaab1b8a2edd989ba7a3de59f2101d5d2ee929a4
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7072e71c4451255d76dd060fa22d2372b336662caa03dad732c3e8c495e3722b
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
78f781138afd0668e2e12aef6cdf5220e9d2807ede821717cd2b7bf39b993f03
7941c043b215ecc58d18e696d42abbd225eb0baa075cb5e31027725cc5312fce
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8884e6f751be61d27e2ffc3a05b2d48f57ec0b7abcb1900b9c07477d716bdad3
91bfe05478e9aa562a5b0f3fe991e6b7201d4282312c48d0fc71b3f5ae7f03ca
931763386856012b8fe9f66d734a85f0baa25b4aa987fbad058686853d2dee5e
94a7d3a4cb33f56365a6142b12ed5fb150de97df502611eb2a74ec3372c2e0a0
9672dbb3bf065e2814d3c7aa0e3d2e74536e2a4ce37b062f31487a1c36e688c3
98eeaeae353fe37b4b82cafa82ebd450fb7aebcd9f8e98f776c75bdb895ac94a
9d9178dd267bc8b16f83652c0b66b509534d3cf42710c17ff769b34dea04b68d
9eb064a8d93265a1b1bb725f0db9c1d209a4efdae9eca7ddc67a094755c64b4f
9f4922667f15ec47709504b75c4433e7145f96078261bc9a11e386ca52fa18bb
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a290010dab515f65c01859cd6b0671ea03c3ac0b18605f840ac0d35be98edeb5
a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4
a5e4d82414a2ca26ea7d94c8586c3c32363073ecb1214c884d302439f420913c
a9d053e8a44d4464be31fdc290e04a12f874dedaa68fd0d19e21f30989b440d6
aa974801b32114fee16b18ee57d0c14b8e23a8a690830f425c4054ca2b629ace
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75
acc248ead4890c65f3e2792cfe555e4d98c961f4b564bc4a77e86270dd3051f7
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd
b04c2932ff07e1cb8cf063d84905acc5598f680b1dbd3723d4e73f120b31fccf
b1ccb8141195307117c737c7f49f99de131fb55290a5f4c1431cc74ca93119dc
b2b2ad1d953b1341442dca10555ebf44343c74fa9755492be52bf521f61dab11
b3e92729562bf7aa805f612b4f909f640cdcfe2ccdc9ee6cf78f710491208e78
b5ecd7807e3023d657d18fbe832848e8e65843843ebd748f7225e314b17d5221
b777ccbe9576f16bf6f9bc222c6c98fbff019365b13a1beee3571da3458657fb
bb0a60a6f91d085789101283e6cab2782ab60f6182229a962695d408a3cd7ca3
bb77875ac71ebda5ebf3ed5bcc84c99ee095bc61da3df9e909c037a29a2f5034
bc5b7797e8a595e365c1385b0d47683d3a85f3533c58d499659b771c48ec6d25
bee9791cbb65e28b631b3e221f6eabaf11048ac87b02a517df183298f667bee4
c08df6d21ef789b95b5568caca9f958aa0f62ce532df3e6d14e267c616b8c934
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
c34d05b1272b1612fcc30172f3df490a796420184348f7470de362ed1dac65cf
c5ca0ad73064122932dddb8b1a95ce78abd25cb76569bbb0c7381356bee1dd0e
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
c8b8289b5f0f768e8f11bf5a02974a0504d0b9fc5e3d6c4b8a08da6fcae6f066
c9486f126615859fc61ac84840a02b2efc920d287a71d99d708c74b2947750fe
c97d6fa5b4ad8db4c6110b5e4a13eb698c381f580cb44440813c04f369df0a56
cb9f19a2c0e0851aec99b21840e8c6b28ac86b768d67ac6c8a83e96657dcbcec
cc2a9794277859f1880c675e842c54d125831b56d9dddf9098daf4ab74edee8c
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
d02bd6bea2616e91bc1a8727f0a3ecbfe12dc4bede41a3a46e7e800852879216
d55c7fe4252476e2f677b75fbbc35178892831145a018772559b155d398f8b1d
d61bed847a1b1ac4dc945aec27f3b7fd7617c63a6397bb5f9442643865a52cfb
d64e3512a14d94fc0807a70eccafd1ad6010aab4d91d552f8e3c4d310bff64ce
db61679243f9f3b5a03de90b1ad228130ad3e87b79b9d153ce1ca6afbdf9a2b0
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994
e15a809168d9a16a22e0c2428da1fb9541e4288724ad734efd66ef6bafee52d9
e1da1b5e724cd444319ab4c55e7637b99034b448955ddbe56150b24200a61cde
e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e824165ebfcdcdfa988ebb284b51336938d8e5b732e4a7967f845b7aa8c315f0
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ed0e94527c13e5abb4368b1ce7fe948a7611c629c8357ab1c89900ed656bae12
ee9fa9f4a587ff050190ee521613efec53f35086bc03ad1192d44bd91eadc57a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2312dc8d88304ad600ebd30d7efef5ae4bb993a42ab5b3bc2e46fbdb555ffa8
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
fa85f97108080f24b26ca0450d471edf522d233337c1b73e41ab4a27d19ac94f
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
fd0fe4e495939fdf1eeb633dc45c30ceada009346ba0147c143ae29cc8c7b4b3
fe8d0e6533b5e64fe2af6c2740160c4776b6942e1a94cad2ef14afab2566447f
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3