URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Submission: On August 31 via api from US — Scanned from DE

Summary

This website contacted 45 IPs in 5 countries across 35 domains to perform 141 HTTP transactions. The main IP is 104.198.136.223, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is redcanary.com. The Cisco Umbrella rank of the primary domain is 439602.
TLS certificate: Issued by R3 on July 24th 2023. Valid for: 3 months.
This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
23 104.198.136.223 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.17.70.206 13335 (CLOUDFLAR...)
5 152.195.15.58 15133 (EDGECAST)
6 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
8 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.92.225.224 16509 (AMAZON-02)
2 23.197.137.224 16625 (AKAMAI-AS)
11 23.53.43.58 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:1:c... 15169 (GOOGLE)
1 192.28.147.68 15224 (OMNITURE)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 146.75.116.157 54113 (FASTLY)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 2a04:4e42:200... 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a03:2880:f08... 32934 (FACEBOOK)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 37.252.171.52 29990 (ASN-APPNEX)
1 2600:9000:225... 16509 (AMAZON-02)
18 2a04:4e42:8d:... 54113 (FASTLY)
1 151.101.193.140 54113 (FASTLY)
1 104.244.42.197 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 2a04:4e42:8d:... 54113 (FASTLY)
3 2a02:26f0:280... 20940 (AKAMAI-ASN1)
2 2a00:1450:400... 15169 (GOOGLE)
2 2600:1901:0:5... 15169 (GOOGLE)
1 2600:9000:20e... 16509 (AMAZON-02)
4 4 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
2 2a03:2880:f17... 32934 (FACEBOOK)
8 2600:1901:1:81:: 15169 (GOOGLE)
1 52.18.119.10 16509 (AMAZON-02)
2 2a02:26f0:480... 20940 (AKAMAI-ASN1)
1 52.204.253.158 14618 (AMAZON-AES)
1 35.186.247.156 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
2 52.58.204.254 16509 (AMAZON-02)
2 54.231.233.242 16509 (AMAZON-02)
141 45
Apex Domain
Subdomains
Transfer
24 redcanary.com
redcanary.com — Cisco Umbrella Rank: 439602
resource.redcanary.com — Cisco Umbrella Rank: 731005
2 MB
18 spotifycdn.com
embed-cdn.spotifycdn.com — Cisco Umbrella Rank: 13792
543 KB
13 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5691
c.6sc.co — Cisco Umbrella Rank: 8562
ipv6.6sc.co — Cisco Umbrella Rank: 5947
b.6sc.co — Cisco Umbrella Rank: 3992
35 KB
12 spotify.com
open.spotify.com — Cisco Umbrella Rank: 3592
apresolve.spotify.com — Cisco Umbrella Rank: 898
gew4-spclient.spotify.com — Cisco Umbrella Rank: 9281
6 KB
9 qualified.com
js.qualified.com — Cisco Umbrella Rank: 20853
app.qualified.com — Cisco Umbrella Rank: 21652
assets.qualified.com — Cisco Umbrella Rank: 22975
832 KB
7 crazyegg.com
script.crazyegg.com — Cisco Umbrella Rank: 2237
tracking.crazyegg.com — Cisco Umbrella Rank: 4119
75 KB
5 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 365
www.linkedin.com — Cisco Umbrella Rank: 625
px4.ads.linkedin.com — Cisco Umbrella Rank: 6371
5 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
69 KB
4 scdn.co
i.scdn.co — Cisco Umbrella Rank: 1328
encore.scdn.co — Cisco Umbrella Rank: 6604
288 KB
4 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 6623
26 KB
3 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 450
2 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 374
13 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6457
625 B
3 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 87
googleads.g.doubleclick.net — Cisco Umbrella Rank: 40
2 KB
3 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 3238
www.google.com — Cisco Umbrella Rank: 2
814 B
3 amazonaws.com
s3-us-west-2.amazonaws.com
qualified-production.s3.us-east-1.amazonaws.com — Cisco Umbrella Rank: 29787
67 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 9384
592 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 109
255 B
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 169
87 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 760
6 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3330
6 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
34 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 47
189 KB
2 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 368
fonts.googleapis.com — Cisco Umbrella Rank: 41
32 KB
1 sentry.io
sentry.io — Cisco Umbrella Rank: 177
324 B
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 12180
203 B
1 oribi.io
cdn.linkedin.oribi.io — Cisco Umbrella Rank: 881
375 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 742
394 B
1 t.co
t.co — Cisco Umbrella Rank: 577
376 B
1 reddit.com
alb.reddit.com — Cisco Umbrella Rank: 1523
637 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 20509
235 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 16560
278 B
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1344
8 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 758
15 KB
1 mktoresp.com
003-yru-314.mktoresp.com
318 B
141 35
Domain Requested by
23 redcanary.com redcanary.com
18 embed-cdn.spotifycdn.com open.spotify.com
embed-cdn.spotifycdn.com
8 gew4-spclient.spotify.com embed-cdn.spotifycdn.com
7 assets.qualified.com redcanary.com
app.qualified.com
6 b.6sc.co
6 script.crazyegg.com redcanary.com
script.crazyegg.com
4 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
4 cdn.bizible.com redcanary.com
cdn.bizible.com
3 px.ads.linkedin.com 3 redirects
3 encore.scdn.co embed-cdn.spotifycdn.com
3 secure.adnxs.com 2 redirects cdn.bizible.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
redcanary.com
3 www.google.de redcanary.com
3 j.6sc.co redcanary.com
www.googletagmanager.com
j.6sc.co
2 qualified-production.s3.us-east-1.amazonaws.com
2 epsilon.6sense.com cdn.bizible.com
2 ipv6.6sc.co cdn.bizible.com
2 c.6sc.co cdn.bizible.com
2 www.facebook.com redcanary.com
2 apresolve.spotify.com embed-cdn.spotifycdn.com
2 www.google.com redcanary.com
2 connect.facebook.net redcanary.com
connect.facebook.net
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 stats.g.doubleclick.net www.googletagmanager.com
cdn.bizible.com
2 open.spotify.com redcanary.com
embed-cdn.spotifycdn.com
2 munchkin.marketo.net redcanary.com
munchkin.marketo.net
2 cdnjs.cloudflare.com redcanary.com
2 www.googletagmanager.com redcanary.com
1 sentry.io assets.qualified.com
1 app.qualified.com js.qualified.com
1 tracking.crazyegg.com script.crazyegg.com
1 cdn.bizibly.com redcanary.com
1 px4.ads.linkedin.com redcanary.com
1 www.linkedin.com 1 redirects
1 cdn.linkedin.oribi.io snap.licdn.com
1 i.scdn.co embed-cdn.spotifycdn.com
1 analytics.twitter.com redcanary.com
1 t.co redcanary.com
1 alb.reddit.com redcanary.com
1 attr.ml-api.io redcanary.com
1 s.ml-attr.com 1 redirects
1 googleads.g.doubleclick.net www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 region1.analytics.google.com www.googletagmanager.com
1 003-yru-314.mktoresp.com munchkin.marketo.net
1 fonts.googleapis.com redcanary.com
1 s3-us-west-2.amazonaws.com redcanary.com
1 js.qualified.com redcanary.com
1 resource.redcanary.com redcanary.com
1 ajax.googleapis.com redcanary.com
141 51
Subject Issuer Validity Valid
redcanary.com
R3
2023-07-24 -
2023-10-22
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
resource.redcanary.com
Cloudflare Inc ECC CA-3
2023-04-02 -
2024-04-01
a year crt.sh
io.bizible.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-06-01 -
2024-07-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-03-09 -
2024-03-08
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
*.s3-us-west-2.amazonaws.com
Amazon RSA 2048 M01
2023-04-11 -
2023-12-28
9 months crt.sh
*.marketo.net
DigiCert TLS RSA SHA256 2020 CA1
2023-02-06 -
2024-02-05
a year crt.sh
6sc.co
R3
2023-08-19 -
2023-11-17
3 months crt.sh
*.spotify.com
DigiCert TLS RSA SHA256 2020 CA1
2023-03-07 -
2024-03-06
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2022-10-05 -
2023-11-05
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
www.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-07-21 -
2024-07-19
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2023-02-01 -
2024-01-31
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-25 -
2024-02-21
6 months crt.sh
www.bing.com
Microsoft Azure TLS Issuing CA 05
2023-07-26 -
2024-01-22
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-06-10 -
2023-09-08
3 months crt.sh
*.spotifycdn.com
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2023-04-19 -
2023-10-15
6 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.scdn.co
GlobalSign Atlas R3 DV TLS CA 2023 Q2
2023-07-07 -
2024-08-07
a year crt.sh
www.google.com
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
linkedin.oribi.io
Amazon RSA 2048 M01
2023-06-08 -
2024-07-07
a year crt.sh
crazyegg.com
Amazon RSA 2048 M02
2023-06-23 -
2024-07-22
a year crt.sh
app.qualified.com
R3
2023-07-22 -
2023-10-20
3 months crt.sh
sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-08-08 -
2024-09-07
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
*.6sense.com
Amazon RSA 2048 M01
2023-05-01 -
2024-05-29
a year crt.sh
*.google.de
GTS CA 1C3
2023-08-07 -
2023-10-30
3 months crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01
2023-07-10 -
2024-06-21
a year crt.sh

This page contains 5 frames:

Primary Page: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Frame ID: 8B0E4A371F371288303FE20D9D574B7E
Requests: 95 HTTP requests in this frame

Frame: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Frame ID: BBFE458836123E14F86019C659ED7308
Requests: 31 HTTP requests in this frame

Frame: https://tracking.crazyegg.com/clock?t=1693506538042&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=a34cd20d322f1161d7047dac0035938e31e7d904&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Frame ID: 2D0EA6E7AF2B98A37A3D70EF710A2B20
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 510D09D1F44766F56C9C98D96179942E
Requests: 1 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Frame ID: E3B7B9535DE2C9A549D0B760A40121D6
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Windows Management Instrumentation - Red Canary Threat Report

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • /(?:([\d.])+/)?highlight(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

141
Requests

96 %
HTTPS

59 %
IPv6

35
Domains

51
Subdomains

45
IPs

5
Countries

3915 kB
Transfer

14008 kB
Size

45
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 37
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=redcanary.com&pId=6209931020623666948
Request Chain 70
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693506537289%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthreat-detection-report%252Ftechniques%252Fwindows-management-instrumentation%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLRnQ5toqKLwgAAAYpM2wsdRUmSIxMr-xWRE2PhRmzuP2AxZ6c9h8oaeoLB6oA0yZcFaz3KWV7j

141 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
359 KB
64 KB
Document
General
Full URL
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
8635f631a35b170f9809857bc49f5c1cbedaa732e0916f4af99573e9e939d8d5
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=600, must-revalidate
content-encoding
br
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Thu, 31 Aug 2023 18:28:56 GMT
feature-policy
microphone 'none'; geolocation 'none'
link
<https://redcanary.com/?p=33541>; rel=shortlink
referrer-policy
strict-origin-when-cross-origin
server
nginx
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
vary
Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding
x-cache
HIT: 15
x-cache-group
normal
x-cacheable
SHORT
x-content-type-options
nosniff
x-frame-options
deny
x-permitted-cross-domain-policies
master-only
x-powered-by
WP Engine
x-wpe-request-id
7c3b528ad784b3dbaf735c303019f540
x-xss-protection
1; mode=block
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.1/
88 KB
31 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Tue, 29 Aug 2023 18:39:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
172171
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
31100
x-xss-protection
0
last-modified
Thu, 08 Sep 2022 18:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 28 Aug 2024 18:39:25 GMT
forms2.min.js
resource.redcanary.com/js/forms2/js/
208 KB
70 KB
Script
General
Full URL
https://resource.redcanary.com/js/forms2/js/forms2.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.70.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Thu, 13 Jul 2023 18:50:22 GMT
server
cloudflare
age
1256
etag
"3340a86-34099-60062cdee3780"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7ff7560e5cfd5b44-FRA
expires
Thu, 31 Aug 2023 22:28:56 GMT
bizible.js
cdn.bizible.com/scripts/
67 KB
25 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
last-modified
Wed, 30 Aug 2023 15:35:31 GMT
server
ECS (frb/67D4)
age
51508
etag
"b215169c57dbd91:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
25470
9416.js
script.crazyegg.com/pages/scripts/0096/
6 KB
2 KB
Script
General
Full URL
https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
cf-cache-status
HIT
age
44
cf-polished
origSize=6004
ce-version
11.5.121
cf-bgj
minify
last-modified
Thu, 31 Aug 2023 18:28:12 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
timing-allow-origin
*
cf-ray
7ff7560f1a948ffe-FRA
js
www.googletagmanager.com/gtag/
301 KB
94 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
92511de80aeff7994b5d8d947cf375ed5d9f8f319bfb452874fdd8dfc2b9293f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
96162
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 31 Aug 2023 18:28:56 GMT
qualified.js
js.qualified.com/
329 KB
95 KB
Script
General
Full URL
https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
via
1.1 spaces-router (devel)
strict-transport-security
max-age=63072000; includeSubDomains
cf-cache-status
MISS
x-content-type-options
nosniff
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
8131ffa1-91a4-295b-c913-1382853ba21f
pragma
no-cache
x-runtime
0.024092
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
etag
W/"d3cffae0a07184a7f41e99ed86654a87"
x-download-options
noopen
vary
Accept,Accept-Encoding
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
7ff7560f4f00bbb5-FRA
expires
Thu, 31 Aug 2023 22:28:57 GMT
highlight.min.js
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/
130 KB
33 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
10535848
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
33250
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-20801"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NsJw%2BnqnlF3GdfRnKTSIaW8WjNOxsIV9Btq9huKkC4aa%2BqJpJTsofS1EfoVdkIQZMChLgp8ojRT1FDEi5qvplT%2Fzb03Jxvo17j8NyX2OyZZgk7DMxiCxmoWeaMENNP8N0ODSywZG%2BPWDlDfpjuLOFcgD"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7560e6fa19016-FRA
expires
Tue, 20 Aug 2024 18:28:56 GMT
teknkl-formsplus-1.0.5.js
s3-us-west-2.amazonaws.com/s.cdpn.io/250687/
41 KB
41 KB
Script
General
Full URL
https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.92.225.224 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-west-2.amazonaws.com
Software
AmazonS3 /
Resource Hash
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO
Last-Modified
Thu, 26 Apr 2018 08:20:46 GMT
Server
AmazonS3
x-amz-request-id
2HPHKCK6Q1VB6XQX
ETag
"bab0c2b3523f8244564b675fe34db610"
Content-Type
application/x-js
Cache-Control
public
Accept-Ranges
bytes
Content-Length
41617
x-amz-id-2
Y5/R9sti+Fq2P5iTcTCsNqB2pU0kDuq/Thk6Z30kV/hDxjaexsZiLG2S8Cb5QJkY9aOZ5EjfKE0=
autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
redcanary.com/wp-content/cache/autoptimize/js/
288 KB
82 KB
Script
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b69b65ef8ada1b627de544e100cc1d8.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:29 GMT
server
nginx
etag
W/"64dce75d-48160"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
bdd94f7dfba3cb50ff0a504fa7c16193
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.137.224 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-137-224.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:28:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 17 Mar 2023 01:24:48 GMT
Server
AkamaiNetStorage
ETag
"cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
729
gtm.js
www.googletagmanager.com/
287 KB
95 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
015da308c09a47f68e078a7caaaf738d5c6d6278969dcca30c1c69e4c9531387
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
97052
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:28:56 GMT
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:28:56 GMT
css
fonts.googleapis.com/
7 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:28:56 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 31 Aug 2023 18:28:56 GMT
autoptimize_7c1b044830350562b8347035fb5ab725.css
redcanary.com/wp-content/cache/autoptimize/css/
5 MB
253 KB
Stylesheet
General
Full URL
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 16 Aug 2023 15:12:30 GMT
server
nginx
etag
W/"64dce75e-53c907"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
ca3355bba4b9da07c0eaf329c168bf15
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
default.min.css
cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/
763 B
606 B
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
19736762
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
271
last-modified
Mon, 08 Feb 2021 15:10:43 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"60215473-2fb"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2HsKhfUKPbAnMykLHWu7F8%2FtSvh3siIXyRs2LNMzVZdjULWxrC74KB6rUAAmyjVQfv1wg%2FahCz57bDg7PkwnuGofW0owZBReM64%2FuIkiHqNMvLgKDWD2CF7TbTKiI3C5Q5icI5aj1tItSVQ%2BQxcjtgrE"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7560ee8139016-FRA
expires
Tue, 20 Aug 2024 18:28:56 GMT
truncated
/
64 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
65 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
bullet-square.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
443 B
654 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 23 Aug 2021 16:46:07 GMT
server
nginx
etag
W/"6123d0cf-1bb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
a9596e476f712a420a81a4b22b23a993
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
source-sans-pro-v21-latin-regular.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:25 GMT
server
nginx
etag
"6298f2c1-32ec"
vary
Accept-Encoding
x-wpe-request-id
11cb905767a47f21a29517eb362d7f99
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13036
source-sans-pro-v21-latin-700.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:24 GMT
server
nginx
etag
"6298f2c0-327c"
vary
Accept-Encoding
x-wpe-request-id
86c262a733aa9e5a9d4c88654417b55d
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12924
source-sans-pro-v21-latin-300.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:22 GMT
server
nginx
etag
"6298f2be-329c"
vary
Accept-Encoding
x-wpe-request-id
4d213ee32aff667e995bad5ad4c8198d
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12956
source-sans-pro-v21-latin-600.woff2
redcanary.com/wp-content/themes/redcanary/assets/fonts/
13 KB
13 KB
Font
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Origin
https://redcanary.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 02 Jun 2022 17:26:23 GMT
server
nginx
etag
"6298f2bf-32fc"
vary
Accept-Encoding
x-wpe-request-id
eb9cfeaa2dfb99de6b4b252e8875b071
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
13052
56z2qI0gKcPthQF6l8AW3E
open.spotify.com/embed/track/ Frame BBFE
11 KB
5 KB
Document
General
Full URL
https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy / Next.js
Resource Hash
91adeada9c0927d0f9470ea3b7371578d084ac9f79cb5900559edb24cc816815
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 31 Aug 2023 18:28:56 GMT
etag
"w088sk9akh8m3"
server
envoy
sp-trace-id
70deba517f9dae73
strict-transport-security
max-age=31536000
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
x-content-type-options
nosniff
x-powered-by
Next.js
truncated
/
68 B
68 B
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Type
image/svg+xml
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/site/
5 KB
2 KB
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aff5855b9eea953386c7af491db1ecff00e245e68017864e1bc76fd228efdff3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
cf-cache-status
HIT
age
8257
ce-version
11.5.121
content-length
1539
last-modified
Thu, 31 Aug 2023 16:11:19 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff7560faf4f4d7a-FRA
munchkin.js
munchkin.marketo.net/163/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/163/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.197.137.224 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-197-137-224.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:28:56 GMT
Content-Encoding
gzip
Last-Modified
Fri, 06 Jan 2023 02:26:40 GMT
Server
AkamaiNetStorage
ETag
"ea7826f34518d7c2295738f39c7640fa:1672972000.238769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4741
Expires
Sat, 09 Dec 2023 18:28:56 GMT
visitWebPage
003-yru-314.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1693506536903&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1693506536902-68323&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/163/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:28:57 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
c589518f-9439-4aca-bb1e-48380d85ced8
collect
region1.analytics.google.com/g/
0
252 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je38u0&_p=300246610&_gaz=1&cid=1794674046.1693506537&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EA&_s=1&sid=1693506536&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
252 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=1794674046.1693506537&gtm=45je38u0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
408 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=1794674046.1693506537&gtm=45je38u0&aip=1&z=435401669
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
b2625509b46b716ab8df67870a7d87b8.js
script.crazyegg.com/pages/versioned/common-scripts/
91 KB
31 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:56 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 24 Aug 2023 15:03:06 GMT
server
cloudflare
age
18746
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff756100b9b8ffe-FRA
content-length
31312
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 16:56:53 GMT
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100081-IAD, cache-fra-eddf8230125-FRA
insight.min.js
snap.licdn.com/li.lms-analytics/
1 KB
1 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
x-content-type-options
nosniff
last-modified
Wed, 30 Aug 2023 18:41:20 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
content-type
application/javascript;charset=utf-8
cache-control
max-age=78497
accept-ranges
bytes
content-length
1046
pixel.js
www.redditstatic.com/ads/
23 KB
8 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
last-modified
Thu, 15 Jun 2023 20:49:59 GMT
server
snooserv
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag
"4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding,Origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
application/javascript
cache-control
public, max-age=60
accept-ranges
bytes
content-length
7409
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1693506536981&cv=11&fst=1693506536981&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&hn=www.googleadservices.com&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&auid=601736799.1693506537&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7fe17d5239e8e18bf26795a63f7ca2b4763ecbc61d822077398f19bdc99e5420
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1355
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
42 KB
13 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 31 Aug 2023 18:28:56 GMT
last-modified
Fri, 28 Jul 2023 18:19:39 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: D50B4C75C6CE4259A808426DF65F001C Ref B: FRA31EDGE0522 Ref C: 2023-08-31T18:28:57Z
etag
"806f3b1280c1d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
12469
fbevents.js
connect.facebook.net/en_US/
193 KB
52 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:28:57 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
52127
x-xss-protection
0
pragma
public
x-fb-debug
GZqdXr1XNM2RR1jHsphS08dGe6pddQh8I8PmCxMr0GsEkqcZ0A8EdW14rihpziaA7ReUp3ac4ALx3/1yNgC4Iw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=redcanary.com&pId=6209931020623666948
0
235 B
Image
General
Full URL
https://attr.ml-api.io/?domain=redcanary.com&pId=6209931020623666948
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
2600:9000:2251:7a00:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
via
1.1 987865b81ba895db5b3f56f8ae175c84.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
x-cache
Miss from cloudfront
content-type
application/json
x-amz-cf-id
UE9IcEgTe7sR7LCry2Hoh2ISCRXST7TaxGSxjx37JB0saYCb3wduiw==
content-length
0
apigw-requestid
KidMngg8oAMEJJQ=

Redirect headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
an-x-request-uuid
203e6bff-6dea-493b-ac02-a7ca2d41fb4c
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
location
https://attr.ml-api.io/?domain=redcanary.com&pId=6209931020623666948
x-proxy-origin
217.114.218.22; 217.114.218.22; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
0
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
8cd00e627952ec8a.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame BBFE
26 KB
4 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
4433399
x-amz-meta-goog-reserved-file-mtime
1689072066
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
4039
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230084-FRA
last-modified
Tue, 11 Jul 2023 10:56:36 GMT
etag
"f3d572702831405545a59c2b3c1f6f80"
x-goog-generation
1689072996772325
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
26326
accept-ranges
bytes
x-cache-hits
6, 24916
c47c6e7745a8b455.css
embed-cdn.spotifycdn.com/_next/static/css/ Frame BBFE
34 KB
6 KB
Stylesheet
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
108139
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5946
x-served-by
cache-chi-kigq8000053-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"fcbec68c9d848190b4c167a8202f2ffd"
x-goog-generation
1693398318469994
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
35014
x-amz-checksum-crc32c
v/JnmQ==
accept-ranges
bytes
x-cache-hits
2, 4164
webpack-3e4f342dbb144246.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
108139
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
2186
x-served-by
cache-chi-kigq8000089-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"afb8c163c2105c690dae52a64acf740d"
x-goog-generation
1693398318516219
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
4611
x-amz-checksum-crc32c
lAXGCg==
accept-ranges
bytes
x-cache-hits
5, 15613
framework-33d379e787c03ddb.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
127 KB
41 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/framework-33d379e787c03ddb.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
8684679
x-amz-meta-goog-reserved-file-mtime
1684765243
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
42161
x-served-by
cache-chi-kigq8000070-CHI, cache-fra-eddf8230084-FRA
last-modified
Mon, 22 May 2023 14:27:39 GMT
etag
"124a9f12f15f3120a5ef711a66ba2662"
x-goog-generation
1684765659849262
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
129927
accept-ranges
bytes
x-cache-hits
739, 25506
main-0117c27f823659ce.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
111 KB
33 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/main-0117c27f823659ce.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
7184894
x-amz-meta-goog-reserved-file-mtime
1686222071
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
33612
x-served-by
cache-chi-kigq8000158-CHI, cache-fra-eddf8230084-FRA
last-modified
Thu, 08 Jun 2023 11:07:26 GMT
etag
"81865ede7cdb1740008282943c7855ac"
x-goog-generation
1686222445991402
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
113515
accept-ranges
bytes
x-cache-hits
617, 25399
_app-fe44d090509824d5.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/ Frame BBFE
507 KB
138 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
108139
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
140746
x-served-by
cache-chi-kigq8000132-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"5686bcaf61d1e15b5f94a8ec151d3215"
x-goog-generation
1693398318953757
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
518987
x-amz-checksum-crc32c
ZWKppg==
accept-ranges
bytes
x-cache-hits
2, 435
fec483df-b230338ad030162e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
320 KB
99 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/fec483df-b230338ad030162e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
6778069
x-amz-meta-goog-reserved-file-mtime
1686661750
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
100913
x-served-by
cache-chi-klot8100047-CHI, cache-fra-eddf8230084-FRA
last-modified
Tue, 13 Jun 2023 13:18:59 GMT
etag
"9c4d5b20d500a4646af02cb2e28e11da"
x-goog-generation
1686662339475826
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
327829
accept-ranges
bytes
x-cache-hits
47959, 25428
415-d009a9159d740903.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
25 KB
6 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/415-d009a9159d740903.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540759
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
5881
x-served-by
cache-chi-kigq8000020-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f45ad0e97a8e71419371027175275215"
x-goog-generation
1690965617730993
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25338
x-amz-checksum-crc32c
I6sMew==
accept-ranges
bytes
x-cache-hits
7, 24247
122-f7d6a526163e333e.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
262 KB
72 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/122-f7d6a526163e333e.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
125318
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
73305
x-served-by
cache-chi-kigq8000095-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"09569bb140037810c364b24b4e3dbfb2"
x-goog-generation
1693381086734856
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
267882
x-amz-checksum-crc32c
vgEZdw==
accept-ranges
bytes
x-cache-hits
64, 18154
345-dd05f38d7ac8a99d.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
96 KB
25 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/345-dd05f38d7ac8a99d.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
125318
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
25529
x-served-by
cache-chi-kigq8000078-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"2ae89e701fdd03960a8a00c1f5dcfa88"
x-goog-generation
1693381086719715
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
98413
x-amz-checksum-crc32c
+DCSmw==
accept-ranges
bytes
x-cache-hits
63, 18048
%5Bid%5D-025dca3822d6ecec.js
embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/ Frame BBFE
31 KB
8 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/track/%5Bid%5D-025dca3822d6ecec.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
125317
x-amz-meta-goog-reserved-file-mtime
1693380126
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
8521
x-served-by
cache-chi-kigq8000160-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 07:38:06 GMT
etag
"ac10207c64f660116f59fdf475284935"
x-goog-generation
1693381086898125
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
31582
x-amz-checksum-crc32c
q2CFuQ==
accept-ranges
bytes
x-cache-hits
54, 4684
_buildManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame BBFE
2 KB
1 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_buildManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
108140
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
821
x-served-by
cache-chi-klot8100127-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"e4f2f5f28d975e18a45aa130cfa30f72"
x-goog-generation
1693398318168737
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
2163
x-amz-checksum-crc32c
8Pix6g==
accept-ranges
bytes
x-cache-hits
5, 15585
_ssgManifest.js
embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/ Frame BBFE
77 B
284 B
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/860b7926-9444-42a4-a58e-096cebb90b02/_ssgManifest.js
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
108140
x-amz-meta-goog-reserved-file-mtime
1693397565
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
61
x-served-by
cache-chi-klot8100033-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 30 Aug 2023 12:25:18 GMT
etag
"b6652df95db52feb4daf4eca35380933"
x-goog-generation
1693398318123960
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
77
x-amz-checksum-crc32c
Ypo4GQ==
accept-ranges
bytes
x-cache-hits
1, 15588
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1693506537053&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=5fa1172c-1d58-44dd-8f48-e81da49d0de8&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
via
1.1 varnish
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server
Varnish
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type
image/gif
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
42
retry-after
0
adsct
t.co/i/
43 B
376 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=c48fa066-3ee1-4af7-9582-d05d3f7bb44a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6e74ef46-347e-46d3-8cba-b3220317e4ee&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.197 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
110
date
Thu, 31 Aug 2023 18:28:56 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
a11650aed8cd7260
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5c3db2d0de84c42b011eaa377f72d57c85e8fc56ad3a7aecde4504dbd02252f6
content-length
43
adsct
analytics.twitter.com/i/
43 B
394 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=c48fa066-3ee1-4af7-9582-d05d3f7bb44a&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6e74ef46-347e-46d3-8cba-b3220317e4ee&tw_document_href=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-response-time
110
date
Thu, 31 Aug 2023 18:28:56 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
cecba9cea401dc62
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5cc1fc89f5e4b72ac902a22969695c5264f1b3ee0c7832a2b959ca28502444ba
content-length
43
ab67616d00001e02ebcc9144c41ae7d42efe6d94
i.scdn.co/image/ Frame BBFE
31 KB
32 KB
Image
General
Full URL
https://i.scdn.co/image/ab67616d00001e02ebcc9144c41ae7d42efe6d94
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/c47c6e7745a8b455.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8d::760 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://embed-cdn.spotifycdn.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:28:57 GMT
Age
726291
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
31979
X-Served-By
cache-chi-kigq8000117-CHI, cache-fra-eddf8230043-FRA
Last-Modified
Wed, 04 Sep 2019 11:41:29 GMT
ETag
"7684273fe7fc515e237eab3b4c5eef9d"
x-goog-generation
1567597289264217
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=315360000
x-goog-stored-content-length
31979
x-amz-checksum-crc32c
1a4KSA==
Accept-Ranges
bytes
Timing-Allow-Origin
*
X-Cache-Hits
11653, 1
CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
encore.scdn.co/fonts/ Frame BBFE
85 KB
86 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSpTitle-Bold-2fbf72b606d7f0b0f771ea4956a8b4d6.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:7890 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
87344
last-modified
Thu, 19 May 2022 07:59:23 GMT
etag
"db1a27b35e26398fef4be920ea96078d"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
r/+ZKQ==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:28:57 GMT
CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
encore.scdn.co/fonts/ Frame BBFE
82 KB
82 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Book-4eaffdf96f4c6f984686e93d5d9cb325.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:7890 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
84027
last-modified
Fri, 13 May 2022 11:38:51 GMT
etag
"f7b12903dd7a2d536ceb2b7cd1dba2c1"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
rmKVPg==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:28:57 GMT
insight.old.min.js
snap.licdn.com/li.lms-analytics/
13 KB
5 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148d Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 28 Aug 2023 12:14:15 GMT
x-cdn
AKAM
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=38307
accept-ranges
bytes
content-length
4862
/
www.google.com/pagead/1p-user-list/759876114/
42 B
455 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/759876114/?random=1693506536981&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=3834282804&rmt_tld=0&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/759876114/
42 B
154 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/759876114/?random=1693506536981&cv=11&fst=1693504800000&bg=ffffff&guid=ON&async=1&gtm=45He38u0&u_w=1600&u_h=1200&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&frm=0&tiba=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&fmt=3&is_vtc=1&random=3834282804&rmt_tld=1&ipr=y
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
56383426.js
bat.bing.com/p/action/
0
118 B
Script
General
Full URL
https://bat.bing.com/p/action/56383426.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 31 Aug 2023 18:28:56 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F37547D3676E44749D686A898D552C95 Ref B: FRA31EDGE0522 Ref C: 2023-08-31T18:28:57Z
x-cache
CONFIG_NOCACHE
monitoring
open.spotify.com/embed/ Frame BBFE
2 B
414 B
Fetch
General
Full URL
https://open.spotify.com/embed/monitoring?o=22381&p=4505164808585216
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:c36:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

sp-trace-id
5b7a53f8bc131899
date
Thu, 31 Aug 2023 18:28:57 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
via
1.1 google, HTTP/2 edgeproxy, 1.1 google
server
envoy
vary
origin,access-control-request-method,access-control-request-headers, Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000, h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
/
apresolve.spotify.com/ Frame BBFE
273 B
270 B
XHR
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
3d7d27dcd8a89b39bdfa577047b0097ee18ba312043968b35a08aadaace0d2bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
encore.scdn.co/fonts/ Frame BBFE
87 KB
88 KB
Font
General
Full URL
https://encore.scdn.co/fonts/CircularSp-Bold-fe1cfc14b7498b187c78fa72fb72d148.woff2
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/css/8cd00e627952ec8a.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:280:3::213:7890 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://embed-cdn.spotifycdn.com/
Origin
https://open.spotify.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
strict-transport-security
max-age=15768000
content-length
89529
last-modified
Fri, 13 May 2022 11:38:50 GMT
etag
"216b12b5a9657850b1b324e158454f8e"
vary
Accept-Encoding
access-control-max-age
86400
content-type
font/woff2
access-control-allow-origin
*
access-control-allow-methods
GET
cache-control
max-age=31536000
x-amz-checksum-crc32c
3OfNxA==
accept-ranges
bytes
access-control-allow-headers
range
expires
Fri, 30 Aug 2024 18:28:57 GMT
1042590016249604
connect.facebook.net/signals/config/
137 KB
35 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1042590016249604?v=2.9.125&r=stable&domain=redcanary.com
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 31 Aug 2023 18:28:57 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
fFT/hFJ6NJw1yNnhO0wUhkp0WI9ovcfoWgRbtCbaZVpzyRInUSXCEOslZybMrWeAMA2iLMnoeHgDovbohdyU9A==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
origin-agent-cluster
?0
cache-control
public, max-age=1200
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires
Sat, 01 Jan 2000 00:00:00 GMT
662.dc13e1cf69424def.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
56 KB
12 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540758
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
12292
x-served-by
cache-chi-kigq8000034-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"f63aef00c0a6fb21f8372a038ee41c3a"
x-goog-generation
1690965617313097
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
57497
x-amz-checksum-crc32c
yfdB0g==
accept-ranges
bytes
x-cache-hits
8, 23092
90.e174c663531d2840.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
5 KB
2 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/90.e174c663531d2840.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540759
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
1750
x-served-by
cache-chi-klot8100099-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"9a75e6801ccd6da13a45572ceefe7d6b"
x-goog-generation
1690965617342176
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
5117
x-amz-checksum-crc32c
467rEw==
accept-ranges
bytes
x-cache-hits
8, 22675
/
apresolve.spotify.com/ Frame BBFE
273 B
170 B
Fetch
General
Full URL
https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:0:524d:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
3d7d27dcd8a89b39bdfa577047b0097ee18ba312043968b35a08aadaace0d2bc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
via
1.1 google
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
110
8e3465fd-e5d8-4ef9-be28-264d1f862d7b
https://open.spotify.com/ Frame BBFE
46 KB
0
Other
General
Full URL
blob:https://open.spotify.com/8e3465fd-e5d8-4ef9-be28-264d1f862d7b
Requested by
Host: open.spotify.com
URL: https://open.spotify.com/embed/track/56z2qI0gKcPthQF6l8AW3E?si=6ddbfd91d0304aca&utm_source=oembed
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
46922
Content-Type
token
cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/
36 B
375 B
XHR
General
Full URL
https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20eb:8c00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89

Request headers

Accept
*
Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:20:24 GMT
content-encoding
gzip
via
1.1 cb33a7a4640adbb55df3e0d143601558.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C1
age
513
vary
accept-encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=3600
x-amz-cf-id
9HW6UMmWkHdGLcXq6Dytymnqu0n8qni-kSprGycolVrXN--9-MqsXg==
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1693506537289%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fthre...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesT...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookies...
0
267 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLRnQ5toqKLwgAAAYpM2wsdRUmSIxMr-xWRE2PhRmzuP2AxZ6c9h8oaeoLB6oA0yZcFaz3KWV7j
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: F5CEEA0D7EF3401388DAD2F9D7973DCD Ref B: FRAEDGE1507 Ref C: 2023-08-31T18:28:58Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lor1
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPDenW19+SL+xqCjZqA==

Redirect headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: 55FFCDEA805A47539E2A57776570D02A Ref B: FRAEDGE1115 Ref C: 2023-08-31T18:28:58Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1693506537289&url=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&cookiesTest=true&liSync=true&e_ipv6=AQLRnQ5toqKLwgAAAYpM2wsdRUmSIxMr-xWRE2PhRmzuP2AxZ6c9h8oaeoLB6oA0yZcFaz3KWV7j
x-li-proto
http/2
content-length
0
x-li-uuid
AAYEPDejQZZolXKKuWjPIA==
239.07bc4bf7922798bd.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
112 KB
32 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/239.07bc4bf7922798bd.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540757
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
32825
x-served-by
cache-chi-klot8100053-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"754ab6b3cee4b386497a168a8900298e"
x-goog-generation
1690965617240921
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
114759
x-amz-checksum-crc32c
Xrafeg==
accept-ranges
bytes
x-cache-hits
8, 23371
70.0c0cdff9477a566b.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
241 KB
53 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/70.0c0cdff9477a566b.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540758
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
54273
x-served-by
cache-chi-kigq8000064-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"d01bb82fc57aa696eb7a37f25227533f"
x-goog-generation
1690965617620460
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
246299
x-amz-checksum-crc32c
60anbQ==
accept-ranges
bytes
x-cache-hits
8, 23438
spotify_player_o.42e735f526de3a43.js
embed-cdn.spotifycdn.com/_next/static/chunks/ Frame BBFE
25 KB
7 KB
Script
General
Full URL
https://embed-cdn.spotifycdn.com/_next/static/chunks/spotify_player_o.42e735f526de3a43.js
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/webpack-3e4f342dbb144246.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:8d::762 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://open.spotify.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
age
2540758
x-amz-meta-goog-reserved-file-mtime
1690964677
x-cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
content-length
7328
x-served-by
cache-chi-klot8100155-CHI, cache-fra-eddf8230084-FRA
last-modified
Wed, 02 Aug 2023 08:40:17 GMT
etag
"615db0ae9631539d4b3438ee8a5a68da"
x-goog-generation
1690965617266128
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-goog-stored-content-length
25627
x-amz-checksum-crc32c
CIvg6w==
accept-ranges
bytes
x-cache-hits
8, 22733
tdr-sidenav-grain.png
redcanary.com/wp-content/themes/redcanary/assets/img/
84 KB
84 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-sidenav-grain.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
"64187eac-14f3f"
vary
Accept-Encoding
x-wpe-request-id
950d118ff84c5d5eb56be69d5045573f
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
85823
tdr-search-icon.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
773 B
764 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-search-icon.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:32 GMT
server
nginx
etag
W/"64187eac-305"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
ff1fc23b320d5527bbe8fe4203136de7
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-canaries.png
redcanary.com/wp-content/themes/redcanary/assets/img/
10 KB
10 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-canaries.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-27ad"
vary
Accept-Encoding
x-wpe-request-id
e5179fb2508334d0fb4fb018ba27d82e
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
10157
topic-hero.jpg
redcanary.com/wp-content/themes/redcanary/assets/img/
244 KB
245 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/topic-hero.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:15 GMT
server
nginx
etag
"5c76b1f3-3d141"
vary
Accept-Encoding
x-wpe-request-id
9740fad221ee1934b022a939bc438b0a
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
250177
graphic-soundwave.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
3 KB
836 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/graphic-soundwave.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:29 GMT
server
nginx
etag
W/"64187ea9-abb"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
0d299f9924dfcc99c2220826d826f92e
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
icon-spotify.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
2 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/icon-spotify.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:30 GMT
server
nginx
etag
W/"64187eaa-653"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
7dd4208682de232eedc253a902a290a3
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
tdr-hero-dots.png
redcanary.com/wp-content/themes/redcanary/assets/img/
11 KB
11 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/tdr-hero-dots.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 15:41:31 GMT
server
nginx
etag
"64187eab-2b89"
vary
Accept-Encoding
x-wpe-request-id
ecf9f85bc909864703478e47111c5d74
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
11145
TDR-Header03-1200w.jpeg
redcanary.com/wp-content/themes/redcanary/assets/img/
331 KB
332 KB
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/TDR-Header03-1200w.jpeg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 18:01:24 GMT
server
nginx
etag
"6419f0f4-52bf0"
vary
Accept-Encoding
x-wpe-request-id
a7bf0415602e127a3b8a8bbfabf1fcf4
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
338928
search-btn.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
161 B
473 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 08 Sep 2021 23:08:04 GMT
server
nginx
etag
W/"61394254-a1"
vary
Accept-Encoding, Accept-Encoding
x-wpe-request-id
f87767cc0ed557e4c7924351148e6d71
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
/
www.facebook.com/tr/
0
185 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&rl=&if=false&ts=1693506537704&sw=1600&sh=1200&v=2.9.125&r=stable&ec=0&o=30&fbp=fb.1.1693506537703.236217604&it=1693506537237&coo=false&rqm=GET
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 31 Aug 2023 18:28:57 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
0
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame BBFE
13 B
172 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:28:57 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame BBFE
13 B
103 B
Fetch
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:28:57 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:28:57 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:28:57 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
redcanary.com.json
script.crazyegg.com/pages/data-scripts/0096/9416/sampling/
158 B
256 B
XHR
General
Full URL
https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=470418
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
cf-cache-status
HIT
age
8257
ce-version
11.5.121
content-length
145
last-modified
Thu, 31 Aug 2023 16:11:20 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
CE-Version
cache-control
public, max-age=300, s-maxage=1209600
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff756151f094d7a-FRA
ipv
cdn.bizible.com/m/
43 B
327 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=879cf844f9164914b1d38a1b8e62fda6&_biz_s=7f30da&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506536775&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=0&a=redcanary.com&rnd=508689&cdn_o=a&_biz_z=1693506537793
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6760) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
last-modified
Wed, 30 Aug 2023 04:10:18 GMT
server
ECS (frb/6760)
age
137919
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
203 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=879cf844f9164914b1d38a1b8e62fda6&_biz_s=7f30da&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506537800&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&a=redcanary.com&rnd=112669&cdn_o=a&_biz_z=1693506537800
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67E0) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:57 GMT
last-modified
Wed, 30 Aug 2023 04:10:19 GMT
server
ECS (frb/67E0)
age
137918
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
j.6sc.co/j/
4 KB
2 KB
Script
General
Full URL
https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

x-amz-version-id
a5rebSMZ.Kk9yiZR85vsDTngv6hjCogp
content-encoding
gzip
date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-cf-pop
TPA52-P2
x-amz-server-side-encryption
AES256
x-amz-meta-content-type
application/json
content-length
1176
pragma
no-cache
last-modified
Mon, 22 May 2023 19:07:21 GMT
server
AmazonS3
etag
"9fdd9f5f306ab8eec57207f0e3c1a4e7"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
x-amz-cf-id
cWunvl1Zn3A08elSvDJCakr1Jnr2oFhl6rW8JDVElLRAlauNKyJm8A==
expires
Thu, 31 Aug 2023 18:28:58 GMT
0
bat.bing.com/action/
0
287 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=3dac6de3-7f88-4119-87f8-3501a71938cd&sid=3fb519c0482c11eeb6552fd81fc620d4&vid=3fb53bf0482c11eebdf7bf423e9cf8e7&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&p=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&r=&lt=2062&evt=pageLoad&sv=1&rn=260435
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:28:57 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 3EE9D568E49349C0B569A3FD3A823D9C Ref B: FRA31EDGE0522 Ref C: 2023-08-31T18:28:57Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
TDR-Logo-Lockup-02.png
redcanary.com/wp-content/uploads/2023/03/
7 KB
8 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Logo-Lockup-02.png
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Tue, 21 Mar 2023 02:03:06 GMT
server
nginx
etag
"6419105a-1d03"
vary
Accept-Encoding
x-wpe-request-id
888238b68a912ae3dfad18d4917b8588
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
7427
birdInFlight-flipped-975x975-1.jpg
redcanary.com/wp-content/uploads/2022/03/
18 KB
18 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2022/03/birdInFlight-flipped-975x975-1.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 07 Mar 2022 19:56:58 GMT
server
nginx
etag
"6226638a-460b"
vary
Accept-Encoding
x-wpe-request-id
7400f931d60acaf9a2f24e36e8b97cd5
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
17931
TDR-Header01-1200w.jpg
redcanary.com/wp-content/uploads/2023/03/
339 KB
340 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2023/03/TDR-Header01-1200w.jpg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 20 Mar 2023 20:12:02 GMT
server
nginx
etag
"6418be12-54b50"
vary
Accept-Encoding
x-wpe-request-id
a178d1b3cfafd7d16e3a1e64a172081c
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
346960
Icon_Alert-Center_Investigation.svg
redcanary.com/wp-content/uploads/2020/09/
4 KB
1 KB
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2020/09/Icon_Alert-Center_Investigation.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Thu, 24 Sep 2020 17:12:27 GMT
server
nginx
etag
W/"5f6cd37b-e55"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
92f80e0b8539c320e5cab30170b4e816
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
e216ddfa-ed00-4433-bed0-7d85285cf498
https://redcanary.com/
45 B
0
Other
General
Full URL
blob:https://redcanary.com/e216ddfa-ed00-4433-bed0-7d85285cf498
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
45
Content-Type
text/javascript
xdc.js
cdn.bizible.com/
116 B
323 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=879cf844f9164914b1d38a1b8e62fda6&_biz_h=-1906410348&cdn_o=a&jsVer=4.23.08.24&a=redcanary.com
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
be981f6b1756883e9085a2afae48f2b14320d922d9a6861bce5d1af2a9f65bd4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:57 GMT
content-encoding
gzip
server
ECS (frb/6711)
etag
0145C43A
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
text/javascript; charset=utf-8
cache-control
private, must-revalidate, max-age=21600
content-length
218
button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/
350 B
619 B
Image
General
Full URL
https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_7c1b044830350562b8347035fb5ab725.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Wed, 27 Feb 2019 15:51:05 GMT
server
nginx
etag
W/"5c76b1e9-15e"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
10b3877f9e2eb130f43bfa69dd77f2a2
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
spotify-logo-black-8-01.svg
redcanary.com/wp-content/uploads/2021/03/
898 B
856 B
Image
General
Full URL
https://redcanary.com/wp-content/uploads/2021/03/spotify-logo-black-8-01.svg
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
223.136.198.104.bc.googleusercontent.com
Software
nginx /
Resource Hash
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-security-policy
upgrade-insecure-requests
content-encoding
br
strict-transport-security
"max-age=63072000; includeSubDomains; preload";
last-modified
Mon, 29 Mar 2021 15:22:29 GMT
server
nginx
etag
W/"6061f0b5-382"
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
x-wpe-request-id
14e3015e3066427e5e749eca9a8eae7f
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
clock
tracking.crazyegg.com/ Frame 2D0E
30 B
137 B
XHR
General
Full URL
https://tracking.crazyegg.com/clock?t=1693506538042&tk=40ea43635c9a9388c5f9f97df894a565&s=360154&p=%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&u=969416&v=a34cd20d322f1161d7047dac0035938e31e7d904&f=redcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation&ul=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/b2625509b46b716ab8df67870a7d87b8.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.18.119.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-119-10.eu-west-1.compute.amazonaws.com
Software
awselb/2.0 /
Resource Hash
7239fcd11c6badcfc8d5957c38169fab74c8e112f783032571b6b81670ceaa1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 31 Aug 2023 18:28:58 GMT
cache-control
no-store
server
awselb/2.0
content-length
30
content-type
text/plain
u
cdn.bizible.com/m/
43 B
144 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1693506536902-68323&_biz_u=879cf844f9164914b1d38a1b8e62fda6&_biz_s=7f30da&_biz_l=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&_biz_t=1693506537801&_biz_i=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&_biz_n=1&a=redcanary.com&rnd=261796&cdn_o=a&_biz_z=1693506538069
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6776) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:58 GMT
last-modified
Wed, 30 Aug 2023 04:10:23 GMT
server
ECS (frb/6776)
age
137915
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
content-type
image/gif
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
43
expires
-1
6si.min.js
j.6sc.co/
51 KB
15 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Aug 2023 22:29:49 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"64e7d9dd-cc38"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
14993
expires
Thu, 31 Aug 2023 18:28:58 GMT
/
c.6sc.co/
7 B
191 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
23 B
313 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:c::210:f19f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d9ed018e66f84298e7de09168f8c536f6af7726a131bbfcb3dadb8a14f4ddb2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:58 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::3
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693506538249_34664543_307589761_13_711_33_67_219";dur=1
content-length
23
expires
Thu, 31 Aug 2023 18:28:58 GMT
/
www.facebook.com/tr/ Frame 510D
0
70 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://redcanary.com
Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://redcanary.com
alt-svc
h3=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Thu, 31 Aug 2023 18:28:58 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
d9b6b28e3d84db3e4c966a5cf73af402.js
script.crazyegg.com/pages/versioned/trackingpagestate-scripts/
20 KB
8 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/d9b6b28e3d84db3e4c966a5cf73af402.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:50 GMT
server
cloudflare
age
18744
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff75617fd208ffe-FRA
content-length
8025
cf22e2b7-bf06-4417-89d8-571895bb155a
https://redcanary.com/
241 B
0
Other
General
Full URL
blob:https://redcanary.com/cf22e2b7-bf06-4417-89d8-571895bb155a
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Content-Length
241
Content-Type
text/javascript
661bb7e9d0e0abee5d7403d3d65553a1.js
script.crazyegg.com/pages/versioned/tracking-scripts/
98 KB
32 KB
Script
General
Full URL
https://script.crazyegg.com/pages/versioned/tracking-scripts/661bb7e9d0e0abee5d7403d3d65553a1.js
Requested by
Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 28 Aug 2023 18:41:48 GMT
server
cloudflare
age
18747
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, s-maxage=31536000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ff756183d588ffe-FRA
content-length
32149
messenger
app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame E3B7
6 KB
3 KB
Document
General
Full URL
https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Requested by
Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.204.253.158 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-204-253-158.compute-1.amazonaws.com
Software
/
Resource Hash
2532958b3f6e31463672e55086b4c26d0ddf510baf9f999592179d7d898b331c
Security Headers
Name Value
Content-Security-Policy
Strict-Transport-Security max-age=63072000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://redcanary.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
max-age=0, private, must-revalidate
Content-Encoding
gzip
Content-Length
1830
Content-Security-Policy
Content-Type
text/html; charset=utf-8
Date
Thu, 31 Aug 2023 18:28:58 GMT
Etag
W/"2532958b3f6e31463672e55086b4c26d"
Link
<https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=63072000; includeSubDomains
Vary
Accept-Encoding
Via
1.1 spaces-router (devel)
X-Content-Type-Options
nosniff
X-Download-Options
noopen
X-Permitted-Cross-Domain-Policies
none
X-Request-Id
4c6bf935-1d1b-0c1f-62bf-ef99627c1e5e
X-Runtime
0.023206
X-Xss-Protection
1; mode=block
messenger-94e6eccc.chunk.css
assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame E3B7
35 KB
7 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
CR7RLVOSvN8A59.U_Z8vAhDQbuXMYHqb
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 04 Jan 2023 23:05:35 GMT
server
cloudflare
x-amz-request-id
90FWQHM1YN0C4AZ0
age
2920
etag
W/"a788ecf510f83ee517cbaf79306145dd"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff7561c4ad6bbb5-FRA
x-amz-id-2
rLqAcBUjCR5iItU2BmaSomv6EBclRN5fXi6l55J/N8krCig+rJdq2Kyy59scvA6+BkA5YO2cQj1KXQAiAsBZ5Q==
expires
Thu, 31 Aug 2023 22:28:58 GMT
messenger-84a66aeb.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame E3B7
5 KB
1 KB
Stylesheet
General
Full URL
https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css
Requested by
Host: redcanary.com
URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
RuQi5GOo1hqbX6GFZui6YyPZ0XQ1C5E6
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
87WCQR418JZVSXNA
age
4873
x-amz-server-side-encryption
AES256
x-amz-id-2
iySJJL1mjeoq19kwudTNrL9KoNn+0HpEUspqVSrfJ3TtLUQvqZro1IgTbf/TVZSQMLn9j/zk3qk=
last-modified
Tue, 14 Mar 2023 23:12:27 GMT
server
cloudflare
etag
W/"22d5f23e695250d3c5a5b1e76a015c5e"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7ff7561c4ad4bbb5-FRA
expires
Thu, 31 Aug 2023 22:28:58 GMT
messenger~runtime-f4ac063cf9338bc709b8.js
assets.qualified.com/packs/js/widget/sandboxed/ Frame E3B7
2 KB
1 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-f4ac063cf9338bc709b8.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
PdfsJsTwxZSJ8tn07cjcyE.BvIAlLvhP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
RP2P52MGEGM4GVJP
age
4873
x-amz-server-side-encryption
AES256
x-amz-id-2
ryK5zHGwO8y/dfMelvuFjnQT88Q0TmjfXdJK0cPFwD6DhS32BdUjFFfED5CwVtNMdIODLo8V6aI=
last-modified
Thu, 31 Aug 2023 01:01:43 GMT
server
cloudflare
etag
W/"211c830511b7e3f0f42259032f070166"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7561c4adbbbb5-FRA
expires
Thu, 31 Aug 2023 22:28:58 GMT
messenger-369223c5490f8cdcf187.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame E3B7
1 MB
362 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
oK9jovqhn.gYLI4zbnGqtErXgbUHzdXb
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
KP5ZQZ231G0Y36P7
age
5989
x-amz-server-side-encryption
AES256
x-amz-id-2
gAgFhhooMYzd5z13lXTUxQdXtcIU6Wtm9n7X06aB1mKG1Zbfxbm2E0rTuNd2Q++GRWQSP1eFN5s=
last-modified
Mon, 28 Aug 2023 20:31:37 GMT
server
cloudflare
etag
W/"07365b735e31be744e837d71d12cb7ad"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7561c4ad8bbb5-FRA
expires
Thu, 31 Aug 2023 22:28:58 GMT
messenger-4dcf43b9b54c3f5764c6.chunk.js
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame E3B7
622 KB
162 KB
Script
General
Full URL
https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-4dcf43b9b54c3f5764c6.chunk.js
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
TbFSaWaZouDNzEPRloXQJWsSi3g5kbCP
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
RP2XNN986JX5A0RV
age
4873
x-amz-server-side-encryption
AES256
x-amz-id-2
Wkq0Zp9JFZVA+yMK14zYYYWUMzTCHP06RCk5wWH1z96njCRrOEuwq0pavRv+pooOJ6YfAV7MlYI=
last-modified
Thu, 31 Aug 2023 01:01:44 GMT
server
cloudflare
etag
W/"94ddddc8eac8fb41be3179fa9a2943df"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7ff7561c8b31bbb5-FRA
expires
Thu, 31 Aug 2023 22:28:58 GMT
Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame E3B7
97 KB
97 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos
cf-cache-status
HIT
x-amz-request-id
FAPX6SQN6211Z29Z
age
22956415
content-length
98868
x-amz-id-2
iVHxNBUxDsBjZePojI4rKO3FuW55Pbxi+Wjl60hXgxyZAzE71JVtTCcWY82D4AF13FFljcEhKBI=
last-modified
Thu, 08 Dec 2022 23:17:25 GMT
server
cloudflare
etag
"dc131113894217b5031000575d9de002"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff7561c9f69901f-FRA
expires
Sat, 31 Aug 2024 00:28:58 GMT
Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame E3B7
103 KB
104 KB
Font
General
Full URL
https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2
Requested by
Host: app.qualified.com
URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=a930da61-9721-43c7-b948-707dc9ccf56a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5

Request headers

Referer
https://app.qualified.com/
Origin
https://app.qualified.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:58 GMT
x-amz-version-id
ePBeoMCujYBxKBCWHO9COs36tHcpJSw9
cf-cache-status
HIT
x-amz-request-id
FAPKJ5R71HA0K2DK
age
22956415
content-length
105804
x-amz-id-2
naNQYZDuvBcl7mMT1sopEggVFp3R/HeGwh8YEtQCKUixA12qI2SwZHuvqzlS/5N616ouLeRRDH8=
last-modified
Thu, 08 Dec 2022 23:17:25 GMT
server
cloudflare
etag
"007ad31a53f4ab3f58ee74f2308482ce"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
public, max-age=31557600
accept-ranges
bytes
cf-ray
7ff7561c9f6c901f-FRA
expires
Sat, 31 Aug 2024 00:28:58 GMT
/
sentry.io/api/1332833/envelope/ Frame E3B7
2 B
324 B
Fetch
General
Full URL
https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1
Requested by
Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.247.156 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
156.247.186.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://app.qualified.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
server
nginx
vary
origin,access-control-request-method,access-control-request-headers
content-type
application/json
access-control-allow-origin
*
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
x-envoy-upstream-service-time
1
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2
getuidj
secure.adnxs.com/
29 B
704 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
8519dc6649ea461ba1e461f514b4836ffae99f719585d60fbcedd7573340f749
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:59 GMT
an-x-request-uuid
a6d0fcac-f4dc-4d24-894e-2766b4823e95
server
nginx/1.21.3
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type
application/json; charset=utf-8
access-control-allow-origin
https://redcanary.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-proxy-origin
217.114.218.22; 217.114.218.22; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length
29
x-xss-protection
0
expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
191 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
/
ipv6.6sc.co/
23 B
312 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:480:c::210:f19f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d9ed018e66f84298e7de09168f8c536f6af7726a131bbfcb3dadb8a14f4ddb2f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:59 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://redcanary.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2001:1b60:2:240:3247::3
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1693506539218_34664543_307594705_11_613_32_0_219";dur=1
content-length
23
expires
Thu, 31 Aug 2023 18:28:59 GMT
optimize.js
www.google-analytics.com/gtm/
124 KB
48 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
49085
x-xss-protection
0
last-modified
Thu, 31 Aug 2023 18:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 31 Aug 2023 18:28:59 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A28%3A56%20GMT%22%2C%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A28%3A56%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A28%3A56%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2031%20Aug%202023%2018%3A28%3A56%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A2%3A240%3A3247%3A%3A3%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f020a0-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
analytics.js
www.google-analytics.com/
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 17:44:23 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
2676
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Thu, 31 Aug 2023 19:44:23 GMT
details
epsilon.6sense.com/v3/company/
770 B
592 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.204.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-204-254.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
8f747cdb56a6ab39c12ede219686c746531c30fecf37506b9d941baac2ea08c5

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
Authorization
Token e8bebcdaa132f727ae8d16d9967447769318945e
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
X-6s-CustomID
WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a

Response headers

date
Thu, 31 Aug 2023 18:28:59 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://redcanary.com
access-control-allow-credentials
true
content-length
409
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.204.254 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-204-254.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,x-6s-customid
Access-Control-Request-Method
GET
Origin
https://redcanary.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,x-6s-customid
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://redcanary.com
access-control-max-age
1800
date
Thu, 31 Aug 2023 18:28:59 GMT
server
nginx
collect
www.google-analytics.com/j/
4 B
24 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j101&a=300246610&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=596047966&gjid=1775882331&cid=1794674046.1693506537&tid=UA-52702906-1&_gid=1856923810.1693506539&_r=1&_slc=1&gtm=45He38u0n81PXWC8JW&cd18=null&z=1213313657
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
151 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-52702906-1&cid=1794674046.1693506537&jid=596047966&gjid=1775882331&_gid=1856923810.1693506539&_u=YADAAEAAQAAAACAAI~&z=1959201660
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://redcanary.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://redcanary.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1794674046.1693506537&jid=596047966&_u=YADAAEAAQAAAACAAI~&z=350235668
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-52702906-1&cid=1794674046.1693506537&jid=596047966&_u=YADAAEAAQAAAACAAI~&z=350235668
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 18:28:59 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j101&a=300246610&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&ul=en-us&de=UTF-8&dt=Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aADAAEABQAAAACAAI~&jid=&gjid=&cid=1794674046.1693506537&tid=UA-52702906-1&_gid=1856923810.1693506539&gtm=45He38u0n81PXWC8JW&cd4=&cd5=&cd10=&cd11=&cd20=&z=372480585
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81c::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 31 Aug 2023 04:43:13 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
49546
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame E3B7
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.233.242 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:29:01 GMT
Last-Modified
Thu, 20 Oct 2022 23:47:27 GMT
Server
AmazonS3
x-amz-request-id
RFDB9N1B022F79RQ
ETag
"fd481ec600c1b3fad6f9e29aa732a946"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
12932
x-amz-id-2
AOX1f6U+KqWWpDo7tw4SOeM97VmiFbmHD+Q6ke6t2etDS6c67e6jy0IlggS6Z3CYYyfADTnWl6g=
img.gif
b.6sc.co/v1/beacon/
43 B
484 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A28%3A56%20GMT%22%2C%22timeSpent%22%3A%223297%22%2C%22totalTimeSpent%22%3A%223297%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:29:00 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"5e502810-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame E3B7
13 KB
13 KB
Image
General
Full URL
https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.233.242 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-us-east-1-r-w.amazonaws.com
Software
AmazonS3 /
Resource Hash
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app.qualified.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

Date
Thu, 31 Aug 2023 18:29:01 GMT
Last-Modified
Thu, 20 Oct 2022 23:48:08 GMT
Server
AmazonS3
x-amz-request-id
RFDA4B1G27KGFWZ5
ETag
"7797b96a7f999ac42de528bede3329af"
x-amz-server-side-encryption
AES256
Content-Type
image/png
Cache-Control
Cache-Control: public, max-age=31536000
Accept-Ranges
bytes
Content-Length
13099
x-amz-id-2
flrgQDxHpWqSp9wHP5/DGFv0/Mph74qg6LlyS1C7/utfLz0F6C5rptXal9L00WC20yMwubak32A=
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A00%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224298%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:29:01 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame BBFE
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:29:01 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame BBFE
13 B
58 B
XHR
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Requested by
Host: embed-cdn.spotifycdn.com
URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/pages/_app-fe44d090509824d5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://open.spotify.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36
content-type
application/json

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 31 Aug 2023 18:29:01 GMT
via
HTTP/2 edgeproxy, 1.1 google
server
envoy
content-type
application/json
access-control-allow-origin
https://open.spotify.com
cache-control
private, max-age=0
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
39
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:29:00 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
events
gew4-spclient.spotify.com/gabo-receiver-service/public/v3/ Frame
0
0
Preflight
General
Full URL
https://gew4-spclient.spotify.com/gabo-receiver-service/public/v3/events
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:1901:1:81:: , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://open.spotify.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Authorization,Origin,Content-Type,Spotify-App-Version,App-Platform,X-Spotify-Connection-Id,X-Client-Id,X-Spotify-Quicksilver-Uri,client-token,content-access-token,x-cloud-trace-context
access-control-allow-methods
DELETE,GET,PATCH,POST,PUT,OPTIONS
access-control-allow-origin
https://open.spotify.com
access-control-max-age
604800
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Thu, 31 Aug 2023 18:29:01 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A01%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225299%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:29:02 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
485 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=bfdc32ca-9dde-4c8f-8961-9d54f399cc07&session=6ec3db9b-8de8-4542-87a8-c8c26fc13ccf&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2031%20Aug%202023%2018%3A29%3A02%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226300%22%7D&isIframe=false&m=%7B%22description%22%3A%22Windows%20Management%20Instrumentation%20(WMI)%20is%20a%20technique%20leveraged%20for%20lateral%20movement%20and%20discovery%20by%20adversaries.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Windows%20Management%20Instrumentation%20-%20Red%20Canary%20Threat%20Report%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fthreat-detection-report%2Ftechniques%2Fwindows-management-instrumentation%2F&pageViewId=618ad29d-8186-415b-84f2-f12137cf6bf7&an_uid=6209931020623666948&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.53.43.58 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-53-43-58.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://redcanary.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.140 Safari/537.36

Response headers

date
Thu, 31 Aug 2023 18:29:03 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 18 Feb 2023 02:04:22 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"63f03226-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

99 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| documentPictureInPicture function| $ function| jQuery object| Cli_Data object| cli_cookiebar_settings object| log_object object| MktoForms2 object| dataLayer object| _6si function| gtag string| QualifiedObject function| qualified object| Bizible object| BizTrackingA object| BizA object| hljs object| theme_ajax_object object| lazyLoadOptions boolean| CE_USER_SCRIPT object| CE2 string| CE_USER_SITE_DATA_URL string| CE_USER_DATA_URL function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| MunchkinTracker object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal string| CE_USER_COMMON_SCRIPT_URL string| CE_USER_THIRDPARTY_SCRIPT_URL function| postscribe object| google_tag_manager_external function| twq string| _linkedin_data_partner_id function| rdt object| GooglebQhCsO function| fbq function| _fbq function| getParam function| getExpiryRecord function| addGclid object| webpackChunkCE2 object| CE2BH function| CE_URL_FINGERPRINT object| CE_API object| configArgs number| pixelRatio number| width number| height object| screenSize object| labels object| regeneratorRuntime object| twttr function| UET function| UET_init function| UET_push object| ueto_ecb994498d object| uetq function| lintrk boolean| _already_called_lintrk boolean| _q_widgetInitialized object| FormsPlus undefined| Cookies undefined| URI object| CLI_Cookie object| CLI object| cliBlocker string| CLI_ACCEPT_COOKIE_NAME string| CLI_PREFERNCE_COOKIE number| CLI_ACCEPT_COOKIE_EXPIRE boolean| CLI_COOKIEBAR_AS_POPUP object| webpackChunknylon function| LazyLoad object| images boolean| is_image object| iframes boolean| is_iframe object| rocket_lazy object| _vis_opt_queue object| LC_API string| _q_lastClientActivityAt string| currentText string| categoryCookie object| categoryCookieValue object| cli_chkbox_elm string| cli_chkbox_data_id string| cli_chkbox_data_id_trimmed string| GoogleAnalyticsObject function| ga object| google_optimize boolean| _storagePopulated object| gaplugins object| gaData

45 Cookies

Domain/Path Name / Value
.resource.redcanary.com/ Name: __cf_bm
Value: a_8xLhlzIOT0sB8Oi8yqZLH9_y4iQ6KpFgl9dDQtffo-1693506536-0-AVLh+hTwggdzZloKEXUxrPEgVHtfcvsYL2AHKWhCPnzNALISqMd9kEWBVQQUckSRUIllQW/BlphfF1FO7DsIpiQ=
.redcanary.com/ Name: _biz_uid
Value: 879cf844f9164914b1d38a1b8e62fda6
.redcanary.com/ Name: _biz_sid
Value: 7f30da
.redcanary.com/ Name: _mkto_trk
Value: id:003-YRU-314&token:_mch-redcanary.com-1693506536902-68323
.redcanary.com/ Name: _ga_T3K4MTNQJN
Value: GS1.1.1693506536.1.0.1693506536.60.0.0
.redcanary.com/ Name: _gcl_au
Value: 1.1.601736799.1693506537
.spotify.com/ Name: sp_t
Value: f9dfd2896f4014e23603593f7806eb56
.spotify.com/ Name: sp_landing
Value: https%3A%2F%2Fredcanary.com%2F%3Fsp_cid%3Df9dfd2896f4014e23603593f7806eb56%26device%3Ddesktop
.redcanary.com/ Name: _rdt_uuid
Value: 1693506537052.5fa1172c-1d58-44dd-8f48-e81da49d0de8
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.t.co/ Name: muc_ads
Value: 2798b9cc-1405-436b-b135-ab621df4539b
.twitter.com/ Name: personalization_id
Value: "v1_VQyRWKzpKLgRBqpKS5rdSg=="
redcanary.com/ Name: ln_or
Value: eyIxNTQwNzUzIjoiZCJ9
.linkedin.com/ Name: li_sugr
Value: 062686e2-ae82-4a2c-83d3-e556ac65ccaf
.linkedin.com/ Name: bcookie
Value: "v=2&e0d2edbc-1c6e-4b1c-88a3-3909ef7bce1b"
.linkedin.com/ Name: lidc
Value: "b=OGST07:s=O:r=O:a=O:p=O:g=2621:u=1:x=1:i=1693506537:t=1693592937:v=2:sig=AQHs6vIfaSiuwlSds7ri3aDWZDobccrp"
.adnxs.com/ Name: uuid2
Value: 6209931020623666948
.redcanary.com/ Name: _fbp
Value: fb.1.1693506537703.236217604
.redcanary.com/ Name: _biz_nA
Value: 2
.bizible.com/ Name: _BUID
Value: 879cf844f9164914b1d38a1b8e62fda6
.bizibly.com/ Name: _BUID
Value: c51ed63b9e225c2a21203cb9cb8a7dee
.linkedin.com/ Name: UserMatchHistory
Value: AQI0DjDVtI73iQAAAYpM2wks8vj0OzeUXZoQgH4dda58xbplZ-J4-UoU3mN3R2u9AI3ol7-2D-uTPA
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJJgNKrnkeL4QAAAYpM2wksJb8ig0qcPUN6Cal3Wut1S-wKgffVwNYD1Hjt2XJtSOSsry9b-AhbqTGgI7uRVw
redcanary.com/ Name: cookielawinfo-checkbox-necessary
Value: yes
redcanary.com/ Name: cookielawinfo-checkbox-non-necessary
Value: yes
.redcanary.com/ Name: cebs
Value: 1
.redcanary.com/ Name: _ce.s
Value: v~a34cd20d322f1161d7047dac0035938e31e7d904~lcw~1693506537955~vpv~0~lcw~1693506537956
.redcanary.com/ Name: _uetsid
Value: 3fb519c0482c11eeb6552fd81fc620d4
.redcanary.com/ Name: _uetvid
Value: 3fb53bf0482c11eebdf7bf423e9cf8e7
.bing.com/ Name: MUID
Value: 3248BF9D8426625D25A1ACE385AD6300
.redcanary.com/ Name: _ce.clock_event
Value: 1
.redcanary.com/ Name: _biz_pendingA
Value: %5B%5D
.redcanary.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.www.linkedin.com/ Name: bscookie
Value: "v=1&20230831182858cf76aa5c-d904-42e2-87a5-97478fe710b7AQGyYdfkCjeR2Jugt3ZFiRANjx4dX5UR"
.linkedin.com/ Name: li_gc
Value: MTswOzE2OTM1MDY1Mzg7MjswMjGNRJLLibRS0W7I1HSxIkRo4+XEP4xdbH95xRGn+0Vpbg==
.redcanary.com/ Name: _ce.clock_data
Value: 30%2C217.114.218.22%2C1%2C0f286e8f7fa153358c622af13d09b529
.redcanary.com/ Name: cebsp_
Value: 1
redcanary.com/ Name: _an_uid
Value: 6209931020623666948
redcanary.com/ Name: _gd_visitor
Value: bfdc32ca-9dde-4c8f-8961-9d54f399cc07
redcanary.com/ Name: _gd_session
Value: 6ec3db9b-8de8-4542-87a8-c8c26fc13ccf
.redcanary.com/ Name: _ga
Value: GA1.2.1794674046.1693506537
.redcanary.com/ Name: _gid
Value: GA1.2.1856923810.1693506539
.redcanary.com/ Name: _gat_UA-52702906-1
Value: 1
.6sc.co/ Name: 6suuid
Value: 362b351756630100ebdbf064d4010000567c3d00
.redcanary.com/ Name: __q_state_bAEbi2aHVysBKzuy
Value: eyJ1dWlkIjoiYTkzMGRhNjEtOTcyMS00M2M3LWI5NDgtNzA3ZGM5Y2NmNTZhIiwiY29va2llRG9tYWluIjoicmVkY2FuYXJ5LmNvbSIsIm1lc3NlbmdlckV4cGFuZGVkIjpmYWxzZSwicHJvbXB0RGlzbWlzc2VkIjpmYWxzZSwiY29udmVyc2F0aW9uSWQiOiIxMjE0NDAyODg3MzI2MzY3OTQ1In0=

3 Console Messages

Source Level URL
Text
other warning URL: https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/(Line 306)
Message:
Allow attribute will take precedence over 'allowfullscreen'.
javascript warning URL: https://embed-cdn.spotifycdn.com/_next/static/chunks/662.dc13e1cf69424def.js
Message:
It is recommended that a robustness level be specified. Not specifying the robustness level could result in unexpected behavior.
javascript verbose URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-369223c5490f8cdcf187.chunk.js(Line 1)
Message:
Rendering was performed in a subtree hidden by content-visibility.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
alb.reddit.com
analytics.twitter.com
app.qualified.com
apresolve.spotify.com
assets.qualified.com
attr.ml-api.io
b.6sc.co
bat.bing.com
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
cdn.linkedin.oribi.io
cdnjs.cloudflare.com
connect.facebook.net
embed-cdn.spotifycdn.com
encore.scdn.co
epsilon.6sense.com
fonts.googleapis.com
gew4-spclient.spotify.com
googleads.g.doubleclick.net
i.scdn.co
ipv6.6sc.co
j.6sc.co
js.qualified.com
munchkin.marketo.net
open.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
qualified-production.s3.us-east-1.amazonaws.com
redcanary.com
region1.analytics.google.com
resource.redcanary.com
s.ml-attr.com
s3-us-west-2.amazonaws.com
script.crazyegg.com
secure.adnxs.com
sentry.io
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
tracking.crazyegg.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
104.17.70.206
104.198.136.223
104.244.42.195
104.244.42.197
13.107.42.14
146.75.116.157
151.101.193.140
152.195.15.58
192.28.147.68
2001:4860:4802:32::36
23.197.137.224
23.53.43.58
2600:1901:0:524d::
2600:1901:1:81::
2600:1901:1:c36::
2600:9000:20eb:8c00:2:53b2:240:93a1
2600:9000:2251:7a00:12:3734:2a40:93a1
2606:4700::6811:180e
2606:4700::6812:1005
2606:4700::6813:9408
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:80f::2008
2a00:1450:4001:81c::200a
2a00:1450:4001:81c::200e
2a00:1450:4001:827::200a
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2004
2a00:1450:4001:831::2003
2a00:1450:400c:c00::9c
2a02:26f0:280:3::213:7890
2a02:26f0:3500:16::215:148d
2a02:26f0:480:c::210:f19f
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
2a04:4e42:200::396
2a04:4e42:8d::760
2a04:4e42:8d::762
35.186.247.156
37.252.171.52
52.18.119.10
52.204.253.158
52.58.204.254
52.92.225.224
54.231.233.242
68.67.153.60
00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f
015da308c09a47f68e078a7caaaf738d5c6d6278969dcca30c1c69e4c9531387
039130d456855a745451bff40707bee5512bc4466373224b2258f67cc6c6d879
040c6c4b281ea6760e1db7e9f2063e2409f8a2434d95851d85cc535f0ff1f9b5
0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8
1004dc1b12f999eafe5336d4c92c18af95daf65af8b2bd641d29e697efb56364
122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade
1486615b34c43bee393a5dd74f110c6f25c5f2d66d8111278f54e77ffcbc63a3
152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5
1576f47ba50e5433d2efe01986fa43b861bd6a4de15751c35bf606b2a9fed2c9
15e5827ebf3a8660ccf687d7f208b247f355421bfeeaa572f26913a453acf45e
16005d3dd555b3e66dd9ebf840d8b225ee02966d26b62f58aea68e6808ff3c83
1cbfcbb81af382110b9d1911b035a8d19b3ca175272555884721d64fb72221c1
1d3d9de6db687e8b9bf3aa08f565dc2db8743147acce6904bf762b7ff56dbf09
1d752805498ebd36b9c69ad1d3da93b1561ea6b33f58ec89a66a4228a357dfe2
2182476b2f19b36cc23e9bbdb2dd97b84f4d6eddabc117e374b893fe3cd8cdc5
24a9979fff20ad59cba9b4a38af6fba8903c482fa2c390e2f0e82c97a649da98
24b99703cc2b2d010f48778c5700beb1ed63e688c460b7498c911bb4a97e2e23
2532958b3f6e31463672e55086b4c26d0ddf510baf9f999592179d7d898b331c
263e16f176fddc5af313fa27a6173538c61b5f28db6a4360e9ae9f81504907b1
292f853f9ef0e448c5536987fe87197f401bafcde3e0857e17de1f0676f5b2eb
2f472251b6b4a4a8d7ceed7539cb6ebea71caf28bccc0beda7a6866a6847b53e
2fb0db460ef1851e44c7e94a3f1944e299e306def449ed72c30adfb89b25b029
3436a3567df14bd76a0e5b2ab1edba77ff61c49fb811b64de0dd23899103ecdc
35134ff1cfb9ea2e3a5d5e63856b1efeba6893a5bcbfb93a73b6e4b671239282
3562dd5ebaf7d001cd283fe325fc4b574e26b053807efb3331dd8fcb5964f559
36975a27509bf92a53016181456a48ff34220ab524329a013bd2fa486ab19048
3a48ba6d11055a2a6f840befa14e603650d8ca3d752e16daccd828d3869fb791
3ac0c589d242920586289eabdd93bf71f3d85bb1c6c8333d3e2deb4e173b61a4
3d7d27dcd8a89b39bdfa577047b0097ee18ba312043968b35a08aadaace0d2bc
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4
53f545d884abf02ce99f4e0369ffec8be28f1f3f22eb99bf0fab9f4522ea5142
5408d95db01e0b235e7f251650932b36f5abfe4f40e8111b74c437826480b8fb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5a67c844a08bb049379474c28891b836a26d673555f882dd5717beeabf42200f
5d07fef4322254c5ef1217d36478f2493d1dcdea7254b5f35adf231c55588cb4
6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11
62c59060782cf4822b2598e623b331039dc6e4a1f8ded9c07032eb91f60adc20
68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23
6af930f857a9b1c2e3f638e4c2eeae1f5a8d28643db55d6a2f7d99c77e17489f
6bc9a4bdde5c48a39cabd8840dec8bd11281dcdd167cf4440f383f01ad3ab123
6e0b02e307a08a6384527ffd3c99e8a3d4f83927b855c2ab6836e951337be886
6ea27beb5e90d0b65a769f26f1864df79c97c997cc279952734892eeafd5ab05
6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
7239fcd11c6badcfc8d5957c38169fab74c8e112f783032571b6b81670ceaa1c
731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
747e9ca7a5f5157e1555dca2f78d780db6a1bef9dc270dcd7a73f571f1391d2b
7481436346ad777435fe494e87a3d7fa9dc1251ab9a024d5305a90fcc0b44f8c
756b9a05dda5b1afa4e8c3aaa061eccf77460cbd84f4b31f511b675fc9dbacd3
7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89
7bb26544c7c0d00e118860dc125c1bc943201bca5cf780804370732b39210d38
7fe17d5239e8e18bf26795a63f7ca2b4763ecbc61d822077398f19bdc99e5420
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8519dc6649ea461ba1e461f514b4836ffae99f719585d60fbcedd7573340f749
8635f631a35b170f9809857bc49f5c1cbedaa732e0916f4af99573e9e939d8d5
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
86f2855487ee0f2a026de07b800d0a191f2d66723011cf5e7bddea4669037b33
8ec32112354b4493286cb34daa05fa0a49791553bfedb374d7a67c7ad9cb2c9f
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
8f747cdb56a6ab39c12ede219686c746531c30fecf37506b9d941baac2ea08c5
91adeada9c0927d0f9470ea3b7371578d084ac9f79cb5900559edb24cc816815
92511de80aeff7994b5d8d947cf375ed5d9f8f319bfb452874fdd8dfc2b9293f
977858a0c518ab885051998c26954247bcc67d50bd26c4438d3022aec559c5c8
99011a0690be8d013bbf0ba1c7e2921db4c6f9e03d6d78e03ca8e1e826bf5b96
99e97366cd580fb716ea693b2696808c006d45c6366004db4286156077f20c4f
9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381
9b7413f945c8b8bb3f75eb10513c7ad79d386e98494d541e5f1fa9301ffbddd6
9dcafe0dd491720f7b4e7168ee159909aba669acbba23ca17e32c9a2174510b0
9e41e783ec4cfc524c1666d1d5a4c805f8e92be52b030d130acfb31105e1e04c
9edb5c5ef600768db6e8ee027853f2c6f8ab34f615b495faaf114579f8de2e22
a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74
a4499f745882700108e60115ea38c28693bf225e861ffa788c30fceac83fb88e
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
af40bad1e1b6415c6d7dfa127a6e8bf4c64111adfca9e4f4c43ade9c39dc9592
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
aff5855b9eea953386c7af491db1ecff00e245e68017864e1bc76fd228efdff3
b40d37fbb13b1b903fd3c063523b41c47c57e61ab99cad3bd35881672ea3e3d6
b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a
bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a
be981f6b1756883e9085a2afae48f2b14320d922d9a6861bce5d1af2a9f65bd4
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
cc240e36234dec6c472a04a70af52dfa5dce110a2766d9280e19fb12cde54e9d
ccccfce93233bff70d19b919d1cb552aed5bc6caac3fc76d01ab6f4c757901d9
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9
d3cffae0a07184a7f41e99ed86654a87129116d1bc4ad30df766400d3953c404
d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6
d9e0863aa56b8cba71d458f9491fdca3c7cc6b0eddbc288d0dfe3d41d0a30eef
d9ed018e66f84298e7de09168f8c536f6af7726a131bbfcb3dadb8a14f4ddb2f
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd25827c9ad7ac0cbdb3545ed377f0ff5c9d5c1d14282307cf04ac4776d0a572
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
debf84af8d66827e1cbc6791aa686504e3116d8cb20f4697fef23108333061f8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90
e803e774c7b59fe74f71ed93acaa875cf9a99947ff8ed7615cd0c93c1667250f
eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f244fcb6b0aeadba8f41f30a7f451c0aaa06445ec854c3d9bbef1c485a036424
f526e42397f6b24d9b2c3cb34f9cec6af49cc7e1eb921f397a2ce7315fd607d1
f538eff9a0c9c118e0fe1b1a654f57f85a2a48179f86451514dbe3c3ce514c44
f872315d333981663bad5953d1280c886beab704fa9a9d2abc768352aa71d39a
f8e765848384e530beac002fc4656b7d54b12ef24564025933981afe76e2ca43
fa53fcd8da139d256c0ca83b69cb37473ca627b6052368ed3327c80d9fb61e25
fd7385bd0bc7f291c2370cc63389d132bcac95e8449f516bbd8c0e40c10cdabe
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a