www.cyberhaven.com Open in urlscan Pro
35.152.119.144  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 51

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tm=gtmv2&e_ipv6=AQJqACN-1WqdGQAAAZQVU5jTBpnLsSwuMpHHe5u1JT-gOmgUfAotoONWMokhMMWeYsiPvg

111 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Show response www.cyberhaven.com/blog/	82 KB 26 KB	277ms 82ms	Document text/html	35.152.119.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.152.119.144 Milan, Italy, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-152-119-144.eu-south-1.compute.amazonaws.com Software / Resource Hash 67bb77520d13eea6f1450053b16e4657cb4bed5902a593fe3e6f16e30aa20b30 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 117720 alt-svc h3=":443"; ma=86400 cf-cache-status HIT cf-ray 8f9e7d5a2ddaee53-MXP content-encoding gzip content-type text/html date Mon, 30 Dec 2024 02:09:46 GMT last-modified Sat, 28 Dec 2024 17:26:25 GMT surrogate-control max-age=432000 surrogate-key www.cyberhaven.com 64deefeac57fbbefc32df53d pageId:659f33bed6ad85bae1aa7e8a 659f33bed6ad85bae1aa7e31 659f33bed6ad85bae1aa7e5e vary Accept-Encoding x-cluster-name eu-south-1-prod-hosting-red x-lambda-id 3756c573-c1d4-4a83-99f4-1ecc80a8e0e1
GET H3	200	cyberhaven-2-0.7fc24bcb1.min.css cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/	295 KB 55 KB	106ms 48ms	Stylesheet text/css	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3873b4cb8cce5adf637f085d4577e3b4b0364cd7ae43609b618dbb08fe1027a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT etag "82de427c01c3d2be069f258bb6d853cd" x-amz-version-id hpz1DhbA8Aw1Ayi1NAQ4WRcSqQ.1gd.J age 181907 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type text/css last-modified Fri, 27 Dec 2024 23:20:51 GMT vary Accept-Encoding priority u=0,i=?0 x-amz-id-2 YMGMa+pBf247/t69ndziBp/Q+mq4Dtq4K3IhnjNMGhTi1DQBtMrTbR7V0ggSfPomlfloAw5em2o= cache-control public, max-age=31536000, immutable x-amz-request-id 9WQSBWNT9G0XQ7WW cf-ray 8f9e7d5b0a78dbe6-FRA accept-ranges bytes access-control-allow-origin * content-length 56195 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	fs-cc.js Show response cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/	29 KB 11 KB	96ms 30ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bdeed7650697bd478a6b0591a9ea29664b04a6681a4f9f7c4c2d3d10cdae42a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"73ae-nwFPCwd3UXiTZ7YuAXjbCNGDpOw" age 3351 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230135-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 10845 x-jsd-version 1.15.0
GET H2	200	js.cookie.min.js Show response cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/	2 KB 1 KB	95ms 29ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/js.cookie.min.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"6c3-1s0eec7oePdhcVrYEdKeoGY3QW4" age 2163960 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230030-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 860 x-jsd-version 3.0.5
GET H2	200	readtime.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/	4 KB 2 KB	29ms 29ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/readtime.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 164406864a5606d7181ae4c6f6b48c19478bbc7377178b51c0f53c68a28fe58d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"f7c-CEGEZn4mJhUtZe0HPZGxMFBlZeE" age 36316 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230158-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 1918 x-jsd-version 1.2.3
GET H2	200	richtext.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/	8 KB 4 KB	35ms 34ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2147-I41v+oq443LPQB6aPqMil27q9QY" age 2170 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230147-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3918 x-jsd-version 1.10.2
GET H2	200	socialshare.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/	9 KB 4 KB	29ms 28ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/socialshare.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash eafd7e17be354753ca120ef03d28aa45a37c423e89e9f2602e8fd5a24400f150 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2385-rwl9CAsmlk954AGumYBzecK5wJE" age 32925 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220106-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3619 x-jsd-version 1.3.1
GET H2	200	codehighlight.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/	4 KB 2 KB	37ms 36ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1254f8919b622330bce321d396d373e92655485778b03d3d1a04d493d44431ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1182-meaOv3e3adqfyT4jIRjTa76pxz4" age 24758 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230089-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 2031 x-jsd-version 1.5.2
GET H2	200	toc.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/	22 KB 9 KB	32ms 31ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8f3080c9459e76305ed52789a727b30786b4d8e27da652424db04a22f42ad83d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"57aa-2Zkk0AqSUYYUIrrzTHESzGgsbdg" age 27590 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220054-FRA, cache-mxp6969-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 8646 x-jsd-version 1.2.4
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 32 KB	137ms 47ms	Script application/javascript	52.222.232.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64deefeac57fbbefc32df53d Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.232.144 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-232-144.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" age 381 access-control-allow-methods GET x-cache Hit from cloudfront x-amz-cf-id CmGq-ARrQyCnh2lUMeuOUvgVyoFSMc3gJGQmkUllWdTr_o2BGM6ELQ== date Mon, 30 Dec 2024 02:03:26 GMT content-type application/javascript last-modified Mon, 20 Jul 2020 17:53:02 GMT vary accept-encoding cache-control max-age=84600, must-revalidate via 1.1 c813ed55721b9ee3209e2abab7207a00.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P4 server AmazonS3
GET H3	200	cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Show response cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/	708 KB 173 KB	175ms 126ms	Script text/javascript	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9c433a9098a5976b8d58b4371e89daafba4e0e9a05f5c880fe821355ba88684 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br cf-cache-status HIT etag W/"9792b65f944e5a2e92eae714f7201221" x-amz-version-id _GYyTxRjAFzEvmpHerpKKUquAFj9B32p age 68054 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type text/javascript last-modified Fri, 13 Dec 2024 17:48:45 GMT vary Accept-Encoding priority u=1,i=?0 x-amz-id-2 D2bsWaHyprSXvd87ue+PCwKZfSPnhiTzdxn/fJRHpvBk4DuC/lSOIvxw1bB0R4bnXgY2+4840u4CG7QbHlql0JpGqdVm0wnB cache-control public, max-age=31536000, immutable x-amz-request-id 289MC3GK1EGQP97Z cf-ray 8f9e7d5b0a79dbe6-FRA access-control-allow-origin * server cloudflare x-amz-server-side-encryption AES256
GET H2	200	form-124.js Show response hubspotonwebflow.com/assets/js/	10 KB 3 KB	172ms 62ms	Script application/javascript	66.33.60.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/form-124.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.193 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"392ca1f460caa2aa9439969a89f31c13" age 3949747 x-matched-path /assets/js/form-124.js access-control-allow-origin * date Mon, 30 Dec 2024 02:09:46 GMT content-disposition inline; filename="form-124.js" content-type application/javascript; charset=utf-8 server Vercel last-modified Wed, 13 Nov 2024 15:18:09 GMT x-vercel-id fra1::2zz7w-1735524586792-8107620f1264
GET H2	200	gtm.js Show response www.googletagmanager.com/	412 KB 128 KB	164ms 71ms	Script application/javascript	2a00:1450:4001:803::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 3898dddc000b5c282c6516eb08b93a37f1577a1776e3da6a646f58cdf1cb925b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Mon, 30 Dec 2024 02:09:46 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Mon, 30 Dec 2024 00:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 129867 x-xss-protection 0 server Google Tag Manager
GET H3	200	676ef1dd62cb1cf6cb136ce2_blog-hero-statement.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	319 KB 320 KB	100ms 100ms	Image image/jpeg	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676ef1dd62cb1cf6cb136ce2_blog-hero-statement.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d03fd1c247221f88df0079f05411dda41c0e7f10021261dd8c65bb84479a5c2b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "d03766fdc479e3efc4a8bcc0b6331e47" x-amz-version-id fOKi3sUHnjrZ1phvoyJ85171y6XfkJsZ cf-cache-status HIT age 199244 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type image/jpeg last-modified Fri, 27 Dec 2024 18:28:47 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 KuwQJmRnDkNAS+56zJPDkjV1YubK8xg1nMif2iAdMNSxnT8u1MzmfCzX6SiYk1PePdDAiQxLFSZc/UxfVyIg21g9db4MNsUNoW2QOHIHKQY= cache-control max-age=31536000, must-revalidate x-amz-request-id 4YSW844K8B8Z39A0 cf-ray 8f9e7d5beb5adbe6-FRA accept-ranges bytes access-control-allow-origin * content-length 326851 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	92ms 92ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d04419609e6fa08a420ce68756b9bb81fc4ccde283575fb42ffc443e2caf3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "7017fb33ca20ea6252530f4175b595c6" x-amz-version-id nbgTfi_RoVFp7TQUfwt0fBsEIuZbE9lh age 1624404 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 gJhMn2Szeezt8PuGVLNAfz+oPTCXmHeCnPf6C14Hf6+WczXoQSvUeJv+ZErtYdEEW9GBl8NY4stVwvC3++0nIxMdwKCQXH9S1Eyr89nCsbk= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTCZ1ZWMJY9PQTZ cf-ray 8f9e7d5c3feb9000-FRA accept-ranges bytes access-control-allow-origin * content-length 30936 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	129ms 129ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3edff1ede4f95fec11b4ad510397682faac14c622267b92fe314f6860f6eba12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "c74d82a73f65864871167b931348f7dd" x-amz-version-id 0K0YF9sKMHh27RzbO2HdYO7f4xfHi1Ni age 1624404 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 MCQEkNI9Skqtr9UHAlvblDXtXn39LUjYsuoQFWJpCnk8xjEAlGHCYc29sY+wKAKPHtqGdhoW3iD6nmRIMvp0B9f394igWsOQgIZcvgApZ8U= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTC6W8VNHM33H8W cf-ray 8f9e7d5c3fec9000-FRA accept-ranges bytes access-control-allow-origin * content-length 30952 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf53f_TWKLausanne-300.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	29 KB 30 KB	201ms 201ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf53f_TWKLausanne-300.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43e196dea1bb50052e39bb72d5146ca65dcbeddbb56ca9f939d85c39e152f219 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "b6399e7dcfa3936c0f20e75e8ea070c7" x-amz-version-id ZBYM2pzvY3d3.LCU5xbdDaV6IOyUyQV. age 1629274 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 m6ydf77jwkKftQxQBU+1M7YG7wNfzAtOdtxHC2HwfIJKxLWi12d9A5YS1hbQnKJVPkvqhNiPYyo= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id S0D843DW7FKQQXYN cf-ray 8f9e7d5c3fed9000-FRA accept-ranges bytes access-control-allow-origin * content-length 30152 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	203ms 202ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f80afcc11946f09caeaad7fdd4febb98bbb145a41e24bfd36bd482bdf70caa3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "a1659b77956f1919811ab7b82c2276d5" x-amz-version-id YuICHYP_D8aK2yDWMfwtWbNeUZaHyz29 age 1629274 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 P1Q3i9+ephkS6tkM7ppEHyk0CazjiDVvbQycOxzKRmlE4/0kfBKH/2djV9BYPTBYdHN/NH8ARZL9YS1fsmJ5/jrlxfmtwPWUEwihAsNp3hM= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVT0KJSYE65TYGV5 cf-ray 8f9e7d5c3fee9000-FRA accept-ranges bytes access-control-allow-origin * content-length 30716 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	6529fca779cbf4ed0782d78a_author-howard.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	12 KB 12 KB	91ms 90ms	Image image/jpeg	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/6529fca779cbf4ed0782d78a_author-howard.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 815c6622b1685a981bb942e44c7a771c62ae29c757af7516430f1284e6e8f635 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "35e153797e062ed2fd7f64cdda236c71" x-amz-version-id ERbf0mrEkZdgJxTEP6WHuCzvqc6wQ3AC cf-cache-status HIT age 198494 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:46 GMT content-type image/jpeg last-modified Sat, 14 Oct 2023 02:27:52 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 AXJx1pskZQA5ixeTSF83dZN5oJApwfb9bgq5EC1MfgXc1bR4aLopq9dg6NNWCd8FDEowZNahmVs= cache-control max-age=31536000, must-revalidate x-amz-request-id AHYBKGXSZBYYRZ88 cf-ray 8f9e7d5bfb6bdbe6-FRA accept-ranges bytes access-control-allow-origin * content-length 12211 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	highlight.min.js Show response cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/	113 KB 41 KB	29ms 29ms	Script application/javascript	151.101.129.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1828162a4978444dfe33f4cd1f977f17cd13cf7d0f413f8eb9bab9437239736d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1c30f-0mStFr3znP7CsGwgIjuH/LN60ns" age 949795 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230041-FRA, cache-mxp6939-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 41100 x-jsd-version 11.4.0
GET H3	200	github.min.css cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/	1 KB 999 B	29ms 29ms	Stylesheet text/css	151.101.129.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/github.min.css Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 3a9a5def8b9c311e5ae43abde85c63133185eed4f0d9f67fea4b00a8308cf066 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"51d-VLcYxofOhGDhDVAcHrU6gJiULB4" age 953010 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 02:09:47 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-eddf8230117-FRA, cache-mxp6939-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 618 x-jsd-version 11.4.0
GET H2	200	bda12b36-0455-47af-b8ba-9529bbb134fb.js Show response j.6sc.co/j/	4 KB 2 KB	451ms 337ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 73c5c9fb7e8e51a3af35769a05cac8b20493d7158c284c504f93eab13d0d53aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip x-amz-version-id N26XcBiiU4KO8qPH4s3OdRIA551zYsKR etag "2a619c6409aef52add1c19ae5d16a447" expires Mon, 30 Dec 2024 02:39:47 GMT x-amz-cf-id xUACpNAxW2SaWHglFJoDJE8CD8zjrsVaduc7KkwOjrBFLYYOQjaAYw== date Mon, 30 Dec 2024 02:09:47 GMT last-modified Thu, 21 Sep 2023 21:57:20 GMT vary Accept-Encoding content-type application/javascript x-amz-meta-content-type application/json cache-control private, max-age=1800 accept-ranges bytes content-length 1444 x-amz-cf-pop DUS51-P4 server AmazonS3 x-amz-server-side-encryption AES256
POST H3	200	collect www.google.com/ccm/	0 0	155ms 56ms	Ping text/plain	216.58.206.68 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&scrsrc=www.googletagmanager.com&frm=0&rnd=2105387977.1735524587&dt=Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it&auid=842879559.1735524587&navt=n&npa=1&gtm=45He4cc1v832240631za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735524587135&tfd=772&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.206.68 , United States, ASN15169 (GOOGLE, US), Reverse DNS lhr35s11-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	422 KB 134 KB	69ms 69ms	Script application/javascript	2a00:1450:4001:803::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fa1db373269a225871239e4a47b1ba321bc0d49ad11db085e12a5a132d40d41b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Mon, 30 Dec 2024 02:09:47 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136896 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	19 KB 8 KB	143ms 43ms	Script application/javascript	2a02:26f0:3500:10::210:a94 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a94 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 6c0d4e3bd890a4bf01c9a301d3e3ff127af22636c4f94250cc230815eb701593 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding cache-control max-age=16389 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 7404 date Mon, 30 Dec 2024 02:09:47 GMT last-modified Wed, 18 Dec 2024 09:08:52 GMT content-type application/javascript;charset=utf-8 x-edgeconnect-midmile-rtt 0, 0 x-edgeconnect-origin-mex-latency 470, 470 x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	129ms 38ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Mon, 30 Dec 2024 02:09:47 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 20:04:45 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kcgs7200099-IAD, cache-fra-etou8220135-FRA x-amz-server-side-encryption AES256
GET H2	200	hotjar-3169094.js Show response static.hotjar.com/c/	13 KB 6 KB	239ms 81ms	Script application/javascript	18.66.102.51 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.51 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-51.fra56.r.cloudfront.net Software / Resource Hash 43c2d70426bf789ed5df8ac4ee8424936a9e3f7de6a0e257084419e374911f55 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 content-encoding br etag W/bf843c974312fa628171afef285c2211 cross-origin-resource-policy cross-origin x-content-type-options nosniff x-cache-hit 1 via 1.1 c387974a86541bbcc6c5141a85eeaf36.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront x-amz-cf-id CaoWpWh2euXwPlatmmrMzbegD1RlZYqaesuZFI9IowaTZokiB03Tsg== date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding x-amz-cf-pop FRA56-P2
GET H3	200	2985.js Show response script.crazyegg.com/pages/scripts/0115/	7 KB 3 KB	683ms 624ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0115/2985.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0d810efe03fa42a406546c8b52a2b9623d2625938f7e1048fba55a71f99eafa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:47 GMT content-type text/javascript last-modified Mon, 30 Dec 2024 02:09:47 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9e7d5e1e8330ee-FRA accept-ranges bytes access-control-allow-origin * content-length 2480 ce-version 11.5.340 server cloudflare
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	115ms 29ms	Script application/javascript	2a04:4e42:600::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Mon, 30 Dec 2024 02:09:47 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	96ms 43ms	Script application/x-javascript	157.240.251.9 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra5.fbcdn.net Software / Resource Hash 24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-y0A3cyVo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-y0A3cyVo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4496, tp=9, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug t+it+iM5aCJcT8qyOS/uxJYt4mE2w8/N/IoHTLZmxAzcxYSuej61Leqyt+/ScI+wd/HtscVPGGA6Qehe0ZYnjg== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62282 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	137ms 42ms	Script text/javascript	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip age 724 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],} x-content-type-options nosniff expires Mon, 30 Dec 2024 03:57:43 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 01:57:43 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 17168 server Golfe2
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/	16 KB 5 KB	320ms 222ms	Script application/javascript	2600:9000:2670:c800:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2670:c800:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Clearbit / Resource Hash 11e852bb791058078812ff8c0780eee92054fbaad4e03ca2f4263576ee487ac7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip etag W/"baf7329e47c04b0ab497040e04f53af5" x-envoy-response-flags - x-content-type-options nosniff via 1.1 f9b794511293751fa3df3ec945ab397e.cloudfront.net (CloudFront) x-cache Miss from cloudfront x-amz-cf-id YmlWe7N273uVP4VR2W5sj4fuhsYd6rAjfyYMQyoObPU_rLYeC4qmhA== date Mon, 30 Dec 2024 02:09:46 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit x-amz-cf-pop FRA56-P9
GET H3	200	62febdf93e32fb008eef5596 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	261ms 210ms	Script text/javascript	104.16.118.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62febdf93e32fb008eef5596 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash da9a2848e28706374f065940615adb8d6cdf26c741bfcf2276174bcf7004521c Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:47 GMT content-type text/javascript vary Accept-Encoding priority u=3,i=?0 access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url access-control-allow-credentials true via 1.1 google cf-ray 8f9e7d5ecbd565c1-FRA access-control-allow-origin * x-powered-by Express server cloudflare
GET H3	200	warmly.js Show response opps-widget.getwarmly.com/	1 KB 2 KB	156ms 87ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b64ac9b7bf876d9264e9eebf36cc6385fcc3519947a89c5846dda7e04f7a070e Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status BYPASS etag W/"4c09ae33bcd4d090ac6377d96d5856783350463d2be8c5e352371aa9207cbc00-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fcpYMMrlck2o9LwfMsD3XA6a2hn3vXmUYiY3TxDJS%2BRwbd18vNpFsgGU6mgeefz75PmJre8P6iW7lMaYw%2FSH2t0eoE9Th4RuXK9tAVUnjRacTfMGIrfJNxK5CCSIP%2Bdte53PdwoXeNlEK%2FhC"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache MISS server-timing cfL4;desc="?proto=QUIC&rtt=45876&min_rtt=45872&rtt_var=17209&sent=12&recv=7&lost=0&retrans=0&sent_bytes=4159&recv_bytes=4267&delivery_rate=71493&cwnd=12000&unsent_bytes=0&cid=1d74b4e7554f7758&ts=92&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 30 Dec 2024 02:09:47 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230021-FRA x-cache-hits 0 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=3,i=?0 x-timer S1735524587.380250,VS0,VE28 referrer-policy origin-when-cross-origin cf-ray 8f9e7d5f0bd8d369-FRA access-control-allow-origin * server cloudflare
GET H2	200	5298086.js Show response js-na1.hs-scripts.com/	2 KB 1 KB	154ms 85ms	Script application/javascript	2606:4700::6810:8cd1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/5298086.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8cd1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 523aba5c780f1fe22e70c7fade1af4788e3c414bd0b06ca55b1a61631f6a0ee7 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3600 content-encoding gzip cf-cache-status HIT access-control-allow-credentials true x-content-type-options nosniff cf-ray 8f9e7d5f0a0f3745-MXP accept-ranges bytes access-control-allow-origin https://www.cyberhaven.com content-length 650 date Mon, 30 Dec 2024 02:09:47 GMT x-hubspot-correlation-id 0acf4b12-14c7-4d92-ae26-03c1faef0b0f content-type application/javascript;charset=utf-8 vary origin, Accept-Encoding server cloudflare last-modified Mon, 30 Dec 2024 01:21:44 GMT
GET H/1.1	200 OK	reb2b.js.gz Show response s3-us-west-2.amazonaws.com/b2bjsstore/b/Y4O7Z0H9ZMNX/	34 KB 12 KB	623ms 208ms	Script application/javascript	52.92.235.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/b2bjsstore/b/Y4O7Z0H9ZMNX/reb2b.js.gz Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.92.235.144 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 35d8fd95a1c9fe7b854528fd5a3ae33edce6572598aa761f2fed65f965b7d42b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-id-2 /iJzCxHlXGaw/y9fSyTPN+Yty0LqckYWv/w0pPvil+CIeb3u7kBqpqOm5nzLvN+kfJNqPB7u4fE= Cache-Control max-age=172800 Content-Encoding gzip ETag "d6872064b5018016e9fa249238aef095" x-amz-request-id 1FNZDVWM8HFV0544 Expires Sun, 03 Nov 2024 18:47:37 GMT Accept-Ranges bytes Content-Length 11291 Date Mon, 30 Dec 2024 02:09:48 GMT Last-Modified Fri, 01 Nov 2024 18:47:38 GMT Content-Type application/javascript Server AmazonS3 x-amz-server-side-encryption AES256
GET H2	200	array.js Show response us-assets.i.posthog.com/static/	175 KB 62 KB	503ms 435ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/array.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 194433cfcf698601025b3b524cabab64841800b5467ec6e199de7f9169b5fd34 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9e7d5f1ce0edab-MXP access-control-allow-origin * date Mon, 30 Dec 2024 02:09:47 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	web gtm-server.cyberhaven.com/measurement/	35 B 386 B	330ms 253ms	Image image/gif	34.8.125.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://gtm-server.cyberhaven.com/measurement/web?event_name=page_view&event_id=1735525038055_17355248459321&page_location=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it%3Ffbclid%3Dnull%26li_fat_id%3Dnull Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.8.125.141 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.125.8.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires Thu, 01 Jan 1970 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif server Google Frontend
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4cc0/ Frame 1CD7	0 0	125ms 40ms	Document text/html	2a00:1450:4001:803::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.cyberhaven.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:803::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 206066 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Fri, 27 Dec 2024 16:55:21 GMT expires Sat, 27 Dec 2025 16:55:21 GMT last-modified Thu, 12 Dec 2024 10:18:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
POST H2	204	collect region1.analytics.google.com/g/	0 0	158ms 56ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-WLE78NS0JZ&gtm=45je4cc1v890707664z8832240631za200zb832240631&_p=1735524586839&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=2003135162.1735524587&ul=it-it&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1735524587&sct=1&seg=0&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&dt=Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clean_url=www.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&ep.clean_path=%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&ep.level1=blog&ep.level2=cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tfd=905 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:47 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 557 B	179ms 58ms	Ping text/plain	2a00:1450:400c:c0d::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WLE78NS0JZ&cid=2003135162.1735524587&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0d::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:48 GMT content-type text/plain server Golfe2
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	169ms 58ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-WLE78NS0JZ&cid=2003135162.1735524587&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1384870081 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Mon, 30 Dec 2024 02:09:47 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_kk14jgkb/	3 B 124 B	518ms 435ms	XHR application/json	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_kk14jgkb/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/json
GET H2	200	t2_kk14jgkb_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	92ms 34ms	XHR application/json	2a04:4e42:600::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_kk14jgkb_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	215ms 130ms	Image image/gif	151.101.65.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1735524587274&id=t2_kk14jgkb&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=9a6e33cf-0a85-4608-804c-ec7adaa105ca&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif server Varnish
GET H2	200	adsct t.co/1/i/	43 B 632 B	300ms 224ms	Image image/gif	162.159.140.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=390c437e-af23-4233-be6e-4fb1073f69b0&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=b1a0d392-e8bc-4919-84bc-801ffa71ea96&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=0 x-transaction-id fd1189b37bd7149c cache-control no-cache, no-store, max-age=0 x-connection-hash 38b84893d954fb6fb72272a11750dccd4d7f3f0a82289efc5271f21c6be7999d cf-cache-status DYNAMIC cf-ray 8f9e7d6018333a98-FRA x-response-time 173 content-length 43 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 726 B	346ms 215ms	Image image/gif	104.244.42.67 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=390c437e-af23-4233-be6e-4fb1073f69b0&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=b1a0d392-e8bc-4919-84bc-801ffa71ea96&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 53ff8c89cedb4f42 cache-control no-cache, no-store, max-age=0 x-connection-hash 706b36a9bbd6adc1ff91ee54c376c9cd98f9365c20f082375efe9d7d3e2449cf x-response-time 171 content-length 43 date Mon, 30 Dec 2024 02:09:47 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	42ms 41ms	Script application/javascript	2a02:26f0:3500:10::210:a94 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a94 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=28760 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Mon, 30 Dec 2024 02:09:47 GMT last-modified Mon, 02 Dec 2024 10:13:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H3	200	321517546861767 Show response connect.facebook.net/signals/config/	69 KB 14 KB	200ms 200ms	Script application/x-javascript	157.240.251.9 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/321517546861767?v=2.9.179&r=stable&domain=www.cyberhaven.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.251.9 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra5.fbcdn.net Software / Resource Hash eb24f0f3a43ff4aac43ed08c045e810d847652a5393b3db67de9f6c055deebc5 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-sydOf6OY' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-sydOf6OY' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" x-fb-connection-quality EXCELLENT; q=0.9, rtt=44, rtx=0, c=77, mss=1232, tbw=70512, tp=65, tpl=0, uplat=156, ullat=1 pragma public x-fb-debug M2QWUYD7xGoB+RVsLsfSl5P2vOYPXA1fB6BzPMOFdtDzWUGrr2Q3cunaxbt5igbKSU2zURiEW8yV8mbyNQq1BQ== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 410 B	49ms 49ms	Image image/gif	2a00:1450:4001:828::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=592315707&utmhn=www.cyberhaven.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=it-it&utmje=0&utmfl=-&utmdt=Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it&utmhid=363305578&utmr=-&utmp=%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&utmht=1735524587302&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D154243370.2003135162.1735524587.1735524587.1735524587.1%3B%2B__utmz%3D154243370.1735524587.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=726937787&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],} x-content-type-options nosniff content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0 expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 02:09:47 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif server Golfe2
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 701 B	252ms 149ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: ECD72071003F40808D0F621D1569681A Ref B: ZRHEDGE1907 Ref C: 2024-12-30T02:09:47Z x-li-fabric prod-lva1 access-control-allow-credentials true x-li-uuid AAYqc06JhjJvkK7j8hvJ7g== x-li-proto http/2 access-control-allow-origin https://www.cyberhaven.com x-cache CONFIG_NOCACHE date Mon, 30 Dec 2024 02:09:46 GMT vary Origin
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 815 B	582ms 491ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1962740&time=1735524587350&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.cyberhaven.com/ Response headers x-li-pop afd-prod-ltx1-x content-encoding gzip x-fs-uuid 00062a734e8e3faa087fc65455907d5e x-msedge-ref Ref A: 35D6E59E225A4C9C9182BCDC15EF9AF4 Ref B: ZRHEDGE1811 Ref C: 2024-12-30T02:09:47Z x-li-fabric prod-ltx1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYqc06OP6oIf8ZUVZB9Xg== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Mon, 30 Dec 2024 02:09:47 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-we... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-w...	0 267 B	228ms 133ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tm=gtmv2&e_ipv6=AQJqACN-1WqdGQAAAZQVU5jTBpnLsSwuMpHHe5u1JT-gOmgUfAotoONWMokhMMWeYsiPvg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: DAFB4A1C62E94E778F770B2A1D7D5A0B Ref B: MIL30EDGE0919 Ref C: 2024-12-30T02:09:47Z x-li-fabric prod-lva1 x-li-uuid AAYqc06QW2CR+RtX91Ncxg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lva1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735524587350&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&tm=gtmv2&e_ipv6=AQJqACN-1WqdGQAAAZQVU5jTBpnLsSwuMpHHe5u1JT-gOmgUfAotoONWMokhMMWeYsiPvg x-msedge-ref Ref A: 3A6ECD0511644B81A4263692FB608588 Ref B: ZRHEDGE1907 Ref C: 2024-12-30T02:09:47Z x-li-fabric prod-lva1 x-li-uuid AAYqc06M3PlTE73wYSB/qQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 30 Dec 2024 02:09:46 GMT
GET H2	200	modules.60031afbf51fb3e88a5b.js Show response script.hotjar.com/	223 KB 56 KB	154ms 48ms	Script application/javascript	52.222.236.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.236.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-236-43.fra56.r.cloudfront.net Software / Resource Hash e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b4a1a7933e55e780894c3f39b1aca0b4" age 1001920 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id 6_0SXMBw-JZou2Vruy9bZlARD-TqHdbPwRlVFfSswOhmgCesvbBvTw== date Wed, 18 Dec 2024 11:51:07 GMT content-type application/javascript; charset=utf-8 last-modified Wed, 18 Dec 2024 11:50:24 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 e59bea79ab5f15feda92136bc7b74158.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56408 x-amz-cf-pop FRA56-P4
GET H3	200	/ www.facebook.com/tr/	0 19 B	112ms 50ms	Image text/plain	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&rl=&if=false&ts=1735524587502&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735524587502.864822409491247822&ler=empty&cdl=API_unavailable&it=1735524587294&coo=false&eid=1735525038055_17355248459321&tm=1&exp=j3&rqm=GET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=46, rtx=0, c=23, mss=1232, tbw=4544, tp=10, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Mon, 30 Dec 2024 02:09:47 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 196 B	194ms 165ms	Image image/png	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&rl=&if=false&ts=1735524587502&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735524587502.864822409491247822&ler=empty&cdl=API_unavailable&it=1735524587294&coo=false&eid=1735525038055_17355248459321&tm=1&exp=j3&rqm=FGET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7454021342778432661"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x388744eefc87a3b9","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["5988309531205427"]},"debug_reporting":true,"debug_key":"4340562192495469785"} date Mon, 30 Dec 2024 02:09:47 GMT content-type image/png vary Accept-Encoding x-fb-debug fVt9qmDaDze4fWM+Su2pqpeZny78rUsXyDnKwTMcACQCFMxIQUdcuyUR0iWiuV9ESuvpgcNNBmHygbgyRbBHwA== priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7454021342778432661", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality EXCELLENT; q=0.9, rtt=46, rtx=0, c=23, mss=1232, tbw=4912, tp=13, tpl=0, uplat=117, ullat=0 cross-origin-opener-policy same-origin-allow-popups pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	39ms 38ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 91c20c70d36b608cf919e894b0ac9e32298d6b3ac3ca59c45a85e7c44161d170 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "6763d39f-1110f" x-content-type-options nosniff expires Mon, 30 Dec 2024 05:09:47 GMT accept-ranges bytes content-length 18919 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 19 Dec 2024 08:04:47 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	0 21 B	608ms 463ms	Script application/javascript	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 x-envoy-response-flags - x-content-type-options nosniff content-length 0 date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript;charset=utf-8 server Clearbit
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	168 KB 45 KB	504ms 382ms	Script application/javascript	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash 9be0e78d405feaf2f28eaa33d8f8b0c298c5385a546d825fba34e81aed740be0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip x-envoy-response-flags - x-content-type-options nosniff date Mon, 30 Dec 2024 02:09:47 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit
GET H2	200	5298086.js Show response js.hs-analytics.net/analytics/1735521600000/	68 KB 25 KB	245ms 176ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1735521600000/5298086.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash deff21bdd3cf5ec27f508fe5d3e13bcd67ffb7dda68e07d97582cddc6ab4e7f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 x-request-id 0cf764f4-3a33-4e01-ba2a-97d8db779028 content-encoding gzip cf-cache-status MISS etag W/"db94dc959471013f74dd433982c87807" x-amz-version-id null expires Mon, 30 Dec 2024 02:14:47 GMT x-evy-trace-listener listener_https date Mon, 30 Dec 2024 02:09:47 GMT x-hubspot-correlation-id 0cf764f4-3a33-4e01-ba2a-97d8db779028 content-type text/javascript last-modified Wed, 06 Nov 2024 18:35:26 GMT vary origin, Accept-Encoding x-amz-id-2 uLoRLOVVxX+7bbqKWZOdb3sioZytOIOsM9pZ+Vg/oEUdhp1rHV9xs2uipR3TjTayiFoVv2jUUfSTPrTQkdxyXL0uyeCcyb4y x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-l4dxl x-envoy-upstream-service-time 26 access-control-allow-credentials false x-amz-request-id 1FNJEMXRVXM1ADGE cf-ray 8f9e7d61691f0e9f-MXP x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	70 KB 25 KB	223ms 156ms	Script application/javascript	2606:4700::6810:6dfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers x-request-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-encoding gzip cf-cache-status EXPIRED x-amz-version-id 8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_ etag W/"ceb8bcb73e5536d8416735a3977d227a" cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-content-type-options nosniff x-cache Hit from cloudfront x-evy-trace-listener listener_https x-amz-cf-id 8WfkRX3JAvexG5l-W6G4VtYiAK3XggMdfy0nlP-0JfveLJ71QnecPQ== x-hubspot-correlation-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-type application/javascript; charset=utf-8 last-modified Mon, 09 Dec 2024 13:03:17 UTC x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-4w2hc x-envoy-upstream-service-time 5 x-hs-target-asset collected-forms-embed-js/static-1.1112/bundles/project.js server cloudflare x-evy-trace-virtual-host all x-amz-server-side-encryption AES256 access-control-max-age 3000 access-control-allow-methods GET x-hs-cache-status MISS date Mon, 30 Dec 2024 02:09:47 GMT vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8ef5bfb0bfdeedcb-FRA via 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront) cf-ray 8f9e7d61bddaed2e-MXP access-control-allow-origin * x-evy-trace-route-configuration listener_https/all x-amz-cf-pop IAD12-P3
GET H2	200	banner.js Show response js.hs-banner.com/v2/5298086/	71 KB 26 KB	479ms 409ms	Script text/javascript	2606:4700:4400::6812:28f0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/5298086/banner.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1f5bfd29b1b65351bdeec611c0f02131e5a8a7336e2d87075b15dff2b7f3f8f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all access-control-max-age 604800 x-request-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing content-encoding gzip cf-cache-status REVALIDATED etag W/"70c5670e6d77885ece19beb74afe4af5" x-amz-version-id GcEt1rgO1vU4WsJ6afMIGzER7IXMa_OI access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD expires Mon, 30 Dec 2024 02:14:48 GMT x-evy-trace-listener listener_https date Mon, 30 Dec 2024 02:09:48 GMT x-hubspot-correlation-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea content-type text/javascript; charset=UTF-8 last-modified Thu, 24 Oct 2024 19:19:32 GMT vary origin, Accept-Encoding x-amz-id-2 MQCYBvG4V5+djwpG0cU2tMuf/xfG+OQ3887eGE3FR+ewuikvYiayuXnhJbexmo5WsCK+SjZoz4I= access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public timing-allow-origin * x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-85276 x-envoy-upstream-service-time 156 access-control-allow-credentials true x-amz-request-id 6NB4N8W9R5GSAPVD cf-ray 8f9e7d61eb54edc0-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-amz-server-side-encryption AES256
GET H2	200	conversations-embed.js Show response js.usemessages.com/	94 KB 27 KB	109ms 40ms	Script application/javascript	2606:4700::6810:4e8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4e8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d2b03470a7d1ae7aba4f78432a23655d3e5092f63312f3dcc3bd1f3e2ed7ec5 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all x-request-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-encoding gzip cf-cache-status HIT etag W/"4dfe3f6f9786f2063afe9a04ac031914" x-amz-version-id fDaori16DhigsoRwsdU7m4W4sxmAcg6S cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod age 173 x-content-type-options nosniff x-cache Hit from cloudfront x-hs-cache-status HIT x-amz-cf-id j-SnkIpB8dxYR4_xkUb1_co81133geiWWU2BVr0S_m3zvz2sOR5wuw== date Mon, 30 Dec 2024 02:09:47 GMT x-hubspot-correlation-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-type application/javascript; charset=utf-8 last-modified Tue, 17 Dec 2024 16:16:40 UTC vary accept-encoding x-evy-trace-listener listener_https x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-mglm2 x-envoy-upstream-service-time 0 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19372/bundles/project.js&cfRay=8f76c22c89cd8fd6-FRA via 1.1 b77313059f3d50280ced20238b151620.cloudfront.net (CloudFront) cf-ray 8f9e7d622a995a1f-MXP x-evy-trace-route-configuration listener_https/all x-hs-target-asset conversations-embed/static-1.19372/bundles/project.js x-amz-cf-pop IAD12-P3 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 705 B	178ms 54ms	XHR application/json	185.89.211.84 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.211.84 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 192.145.127.215; 192.145.127.215; 959.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://www.cyberhaven.com an-x-request-uuid 11ca8093-a793-431b-8948-5db61c0cf4c7 content-length 11 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Mon, 30 Dec 2024 02:09:47 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H2	200	/ Show response c.6sc.co/	7 B 196 B	68ms 39ms	XHR text/html	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://www.cyberhaven.com content-length 7 date Mon, 30 Dec 2024 02:09:47 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	18 B 310 B	159ms 40ms	XHR text/html	2a02:26f0:7100::210:180 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 6cba0fd7551dfe0a0f2e4c5c47ba43fc659d9989bc8cd2beaef958f6ad776f65 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:24:44::12 expires Mon, 30 Dec 2024 02:09:47 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1735524587733_34603374_1106240957_18_978_36_39_219";dur=1 access-control-allow-origin https://www.cyberhaven.com content-length 18 date Mon, 30 Dec 2024 02:09:47 GMT content-type text/html vary Origin
POST H2	200	/ Show response content.hotjar.io/	56 B 171 B	289ms 127ms	XHR application/json	63.35.138.184 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://content.hotjar.io/?site_id=3169094&gzip=1 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 63.35.138.184 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-63-35-138-184.eu-west-1.compute.amazonaws.com Software / Resource Hash 1e061d3d155a7a2af25ad0523736cb2ae2a4d97f052a20330ec4d6985fcced18 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain; charset=UTF-8 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 86400 access-control-allow-origin * content-length 56 date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 656 B	176ms 81ms	XHR application/json	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash f4a34c3d3a257c60a880889233ebb2169035f172404bc1aad871d90b18170839 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	146ms 45ms	Preflight	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 30 Dec 2024 02:09:47 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	143ms 127ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:47 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	134ms 126ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:47 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	131ms 125ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22218d4ca0f0d30c4801ecd3d056a7fae0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22555171e6d4c91ba269d673d31c487f9d31fe33c9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22bda12b36-0455-47af-b8ba-9529bbb134fb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:47 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:47 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	config.js Show response us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/	963 B 775 B	428ms 428ms	Script application/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/config.js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224f0faed26a56018f3d6f3d5e8fe2dda990c262ca0903c723145d2b47d1b108 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status EXPIRED x-content-type-options nosniff date Mon, 30 Dec 2024 02:09:48 GMT content-type application/javascript vary Origin, Referer, Accept-Encoding last-modified Mon, 30 Dec 2024 02:09:48 GMT x-frame-options SAMEORIGIN cache-control max-age=300 cross-origin-opener-policy same-origin x-envoy-upstream-service-time 14 referrer-policy same-origin allow GET, HEAD, OPTIONS cf-ray 8f9e7d620e0eedab-MXP accept-ranges bytes access-control-allow-origin * content-length 554 server cloudflare
POST H2	200	/ Show response us.i.posthog.com/decide/	861 B 837 B	393ms 126ms	Fetch application/json	54.235.141.174 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/decide/?v=3&ip=1&_=1735524587830&ver=1.203.1&compression=base64 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.235.141.174 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-235-141-174.compute-1.amazonaws.com Software envoy / Resource Hash c28e2af4e14aafdc9b247281d5aa398e81f6c95a1543caa0fdc786ffe4552856 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/x-www-form-urlencoded Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
POST H2	200	/ Show response us.i.posthog.com/e/	13 B 414 B	390ms 126ms	Fetch application/json	54.235.141.174 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/e/?ip=1&_=1735524587834&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.235.141.174 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-235-141-174.compute-1.amazonaws.com Software envoy / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 7 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/site/	5 KB 2 KB	202ms 161ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/site/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bde882bace3bbb25b8aa0a7bf6d98e17bea9cd54c25d410dcc711889d4e0fe89 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json last-modified Mon, 30 Dec 2024 02:09:47 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9e7d625da018b7-FRA accept-ranges bytes access-control-allow-origin * content-length 1767 ce-version 11.5.340 server cloudflare
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	220ms 153ms	Preflight text/plain	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=785496a2aef2462ca9be09283258c3cb&traceId=785496a2aef2462ca9be09283258c3cb Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://www.cyberhaven.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8f9e7d62db44ee71-MXP content-length 18 content-type text/plain; charset=utf-8 date Mon, 30 Dec 2024 02:09:48 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hkRQ2Uikv%2BzWQ07lJD3EpAof2O2cMeeYwhRbYAr0EULLATUvph62FlkjxhGqPGJsnG1J54y686SArw%2BWuRi8YSgKtAVaEmMNvofzHuVEkhr8Eh4gBHOoQXhm%2BYkWRMEDbujV5QwsbGb46VZ%2Bzw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-hubspot-correlation-id 90b04326-b481-4604-b638-cc2cf74869a7
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	297 B 941 B	305ms 304ms	XHR application/json	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=785496a2aef2462ca9be09283258c3cb&traceId=785496a2aef2462ca9be09283258c3cb Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8af8d9f8ac38ac300b56c2ba952948c937b0327d4098f407dfc08d705d75cfc7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 X-HubSpot-Messages-Uri https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A93jCeWQ5ZxJsqSQzhH8kCRkgNtxqA8GUfAMVzZmuwhK3RMVE7MVAFQVkGJKmUJ5XVfOA1hjfYn6Mw2Bj742IBSHOEq3MzhiL6Er2arXL4Uk629YXga%2BmdhxeSnVrz2cDZ0RNT%2FCZjK7SOOfBA%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff date Mon, 30 Dec 2024 02:09:48 GMT x-hubspot-correlation-id 8763f1b4-0b95-4574-b127-d6bd4a57c6b9 content-type application/json;charset=utf-8 vary origin, Accept-Encoding access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials false cf-ray 8f9e7d63dbe0ee71-MXP access-control-allow-origin https://www.cyberhaven.com content-length 236 server cloudflare
GET H/1.1	200 OK	json Show response pro.ip-api.com/	215 B 371 B	154ms 48ms	Fetch application/json	51.77.64.70 OVH OVH SAS
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/json?key=zPwv6i0dpmS2yR5&fields=proxy,hosting,isp,lat,long,zip,city,region,status,country,timezone,regionName,countryCode Requested by Host: s3-us-west-2.amazonaws.com URL: https://s3-us-west-2.amazonaws.com/b2bjsstore/b/Y4O7Z0H9ZMNX/reb2b.js.gz Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH OVH SAS, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 6c39380ad5b63a53f7f1cd08d2965a52e4b4259447cf0b317805e6f7bdfd712a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers Access-Control-Allow-Origin * Content-Length 215 Date Mon, 30 Dec 2024 02:09:48 GMT Content-Type application/json; charset=utf-8
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	133 B 660 B	148ms 139ms	XHR application/json	2606:4700::6810:6dfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=5298086&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6dfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51cde42c03bdfd44328fe282089cbd8e3ee5185c09d38ac0814480d824de684a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, */* Referer https://www.cyberhaven.com/ Response headers x-robots-tag none access-control-max-age 180 x-request-id e3053e10-f5bc-4c5c-8f81-00eac52d4428 content-encoding br cf-cache-status DYNAMIC access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff x-evy-trace-listener listener_https date Mon, 30 Dec 2024 02:09:48 GMT x-hubspot-correlation-id e3053e10-f5bc-4c5c-8f81-00eac52d4428 content-type application/json;charset=utf-8 vary Accept-Encoding access-control-allow-headers * x-evy-trace-route-service-name envoyset-translator cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-2w2nl x-envoy-upstream-service-time 10 cf-ray 8f9e7d62de70ed2e-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H3	200	4905af20a771527fdcc240cf8ab4172a.js Show response script.crazyegg.com/pages/versioned/common-scripts/	107 KB 37 KB	47ms 47ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f17058a6ac8f171e452a0ed24075c6e592834eef8dc12e343ade35adc73c4cc Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 332716 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:48 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:04 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8f9e7d63583630ee-FRA accept-ranges bytes access-control-allow-origin * content-length 37122 server cloudflare
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/sampling/	160 B 389 B	153ms 153ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/sampling/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 54b470fa4aa8d9260bd1f34779a3247ca00feec0bf247d6651d7b9800b0c58da Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json last-modified Mon, 30 Dec 2024 02:09:48 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9e7d643e3918b7-FRA accept-ranges bytes access-control-allow-origin * content-length 149 ce-version 11.5.340 server cloudflare
GET H2	200	recorder.js Show response us-assets.i.posthog.com/static/	112 KB 40 KB	421ms 421ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/recorder.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ec3f8ef2aa975a22f11d5d3592111d857a5917287a00ca6cf191d72859354d75 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9e7d648faeedab-MXP access-control-allow-origin * date Mon, 30 Dec 2024 02:09:48 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	dead-clicks-autocapture.js Show response us-assets.i.posthog.com/static/	14 KB 5 KB	134ms 134ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6efafe07fd29b04ec60906d17ea4e89d6c0601d49ff2f160e06d709060bbcee2 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=14400 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 3 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9e7d648fafedab-MXP access-control-allow-origin * date Mon, 30 Dec 2024 02:09:48 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	web-vitals.js Show response us-assets.i.posthog.com/static/	10 KB 4 KB	438ms 438ms	Script text/javascript	2606:4700:10::ac43:2832 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/web-vitals.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::ac43:2832 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7196c8f501e096262228f56c988d4fb9e4b2e3e331e411f40c30e6889f282fb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9e7d648fb0edab-MXP access-control-allow-origin * date Mon, 30 Dec 2024 02:09:48 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
OPTIONS H2	204	clock tracking.crazyegg.com/ Frame	0 0	244ms 84ms	Preflight	52.19.232.37 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1735524588333&tk=8278c3be49784fffa4a1b15f884798b8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.19.232.37 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-19-232-37.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods access-control-allow-methods * access-control-allow-origin * access-control-max-age 86400 cache-control public, max-age=86400 date Mon, 30 Dec 2024 02:09:48 GMT server awselb/2.0 vary Access-Control-Request-Headers, Origin, Access-Control-Request-Method
GET		fda4c311-a68c-4dbd-99ce-4730a044fb56 https://www.cyberhaven.com/ Frame	0 0
POST H2	200	clock Show response tracking.crazyegg.com/	41 B 147 B	101ms 100ms	XHR text/plain	52.19.232.37 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1735524588333&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.19.232.37 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-19-232-37.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 8a430a99b49d5a23f8443c05dcc956fd4c6aab021cf4e6ccbd7ef49cc851420e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers cache-control no-store access-control-allow-origin * content-length 41 date Mon, 30 Dec 2024 02:09:48 GMT content-type text/plain server awselb/2.0
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/	19 B 463 B	163ms 48ms	XHR application/json	13.35.58.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.128 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-128.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 8448834 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id ekmzXmEfW7G7LHiTlkR0IFV18XkY7Gxcj_CxmH5IUvu3RduyQI0OKw== date Mon, 23 Sep 2024 07:15:55 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 43244f77affffa1d8942dd025413b8d8.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P10 server AmazonS3
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/	19 B 462 B	162ms 47ms	XHR application/json	18.66.122.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-72.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 8963851 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id DXYNaYpfXVFK40rGypnWsI--vPi8OT8JrWOfJMzAbI7OYhJfyMzVbA== date Tue, 17 Sep 2024 08:12:17 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 d71acb203a3e8fc7db2c1cf9725d51da.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P2 server AmazonS3
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	299ms 196ms	XHR application/json	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload access-control-max-age 7200 access-control-expose-headers content-encoding gzip x-envoy-response-flags - access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; x-content-type-options nosniff access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 02:09:48 GMT content-type application/json vary Accept-Encoding, Origin server Clearbit
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	128ms 128ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A47%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:48 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:48 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET		1d1adbd7-8c5a-4741-9172-8a2640c4fc0c https://www.cyberhaven.com/ Frame	0 0
GET H2	200	blockedDomains.json Show response hubspotonwebflow.com/assets/js/	98 KB 23 KB	65ms 65ms	Fetch application/json	66.33.60.193 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/blockedDomains.json Requested by Host: hubspotonwebflow.com URL: https://hubspotonwebflow.com/assets/js/form-124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.193 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"04708d47dd194d37b8231a65de7a66f1" age 6863542 x-matched-path /assets/js/blockedDomains.json access-control-allow-origin * date Mon, 30 Dec 2024 02:09:48 GMT content-disposition inline; filename="blockedDomains.json" content-type application/json; charset=utf-8 server Vercel last-modified Thu, 10 Oct 2024 20:46:42 GMT x-vercel-id fra1::sjfcf-1735524588799-bc0d5dd15620
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	217ms 148ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=151041951&v=1.1&a=5298086&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&t=Cyberhaven%E2%80%99s+Chrome+extension+security+incident+and+what+we%E2%80%99re+doing+about+it&cts=1735524588774&vi=192aa73bf3a20e532c3111f3a062e085&nc=true&u=208653005.192aa73bf3a20e532c3111f3a062e085.1735524588773.1735524588773.1735524588773.1&b=208653005.1.1735524588773&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none x-request-id 1450c734-5efc-4329-8d0f-3d61d5c5fff1 cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xY%2FNrVp0FlKgQVzv%2BGp7TI%2BbPEEH6TO4hFwheKOPpjnDQWey0SkwUdjbatReivLTx8ace4jIOYssKz1%2FJMyCr1kRsn4ZahyJoeB%2BCNR%2BIxytHH0jxbDH3QerhCjcVN5%2FGJAix%2BCmK7LlBwYwFhrd"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-evy-trace-listener listener_https p3p CP="NOI CUR ADM OUR NOR STA NID" date Mon, 30 Dec 2024 02:09:48 GMT x-hubspot-correlation-id 1450c734-5efc-4329-8d0f-3d61d5c5fff1 content-type image/gif vary origin, Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator cache-control no-cache, no-store, no-transform nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-nc9kd x-envoy-upstream-service-time 5 access-control-allow-credentials false cf-ray 8f9e7d685b1b83ac-MXP x-evy-trace-route-configuration listener_https/all content-length 45 server cloudflare x-evy-trace-virtual-host all
GET H3	200	6515e83924723987bacc4b6b_favicon.png cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	2 KB 2 KB	49ms 49ms	Other image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/6515e83924723987bacc4b6b_favicon.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35f594c6250e4f6beb23551ea8b2128ca0faa451998403ac7859bc51873b3cf2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "7f9532364c9c4bd7e55de7b330a315d7" x-amz-version-id 2PFNNcwh85NMJaJS3FT9RI.EWY5iSVaq age 1231887 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 02:09:48 GMT content-type image/png last-modified Thu, 28 Sep 2023 20:55:22 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 DXBM/QZjP7VP0udFWwQW1Ne7Ln2t4YKWVp1eFwUKXXpTzGxa2UJL/gJOzqOckRkg147HE3WbLM62S9LLMIF80Un+8HW3s9kvXNDcEiWLLzw= cache-control max-age=31536000, must-revalidate x-amz-request-id RFQT0G6005M45KPE cf-ray 8f9e7d680e97dbe6-FRA accept-ranges bytes access-control-allow-origin * content-length 1946 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	widget-tA7EQKQY.js Show response opps-widget.getwarmly.com/	598 KB 183 KB	107ms 59ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc6d50d5d2484099d6743c7978504b4d781fdb3974629742ec15c7772798f0bf Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status REVALIDATED etag W/"f7b80d857423a14c3abd182b35f25ecc8b513bdee66a9c0e3e8bec251b8b6b47-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MeIjtuXmqJOQOy6DD%2B29s8hIE5%2B02VNe8Iyh%2BBs%2FHVZZX5kLiSyqx69B8v7nVpiPxuMsMSv0xI248qLGGMulcw%2F39c%2By%2FAZL%2B18%2F4JDuEmhTsZiASYFuek2d1Pr9dLfZvEkHzBtOsIsM3e9F"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache HIT server-timing cfL4;desc="?proto=QUIC&rtt=45746&min_rtt=45743&rtt_var=17160&sent=9&recv=6&lost=0&retrans=0&sent_bytes=2157&recv_bytes=4073&delivery_rate=30774&cwnd=12000&unsent_bytes=0&cid=f2ed3e6731c89a08&ts=60&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 30 Dec 2024 02:09:49 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230050-FRA x-cache-hits 96 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=1,i=?0 x-timer S1735261732.027078,VS0,VE0 referrer-policy origin-when-cross-origin cf-ray 8f9e7d6a4bd49b22-FRA access-control-allow-origin * server cloudflare
POST H3	200	sessions.createSession Show response opps-api.getwarmly.com/api/sessions/trpc/	2 KB 2 KB	269ms 216ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash fffbc5be2e970b4003ef36b62d73008d18450fa92b730e73c6e67dfd5ab92153 Request headers x-warmly-user-identifier x-warmly-referer https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 833ecb26-1875-4423-9d07-764502c7104f X-Warmly-Target session-server User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2089 date Mon, 30 Dec 2024 02:09:49 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	sessions.createSession opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	281ms 171ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 02:09:49 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	126ms 126ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A48%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:49 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:49 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	204	sessions.trackScriptAdded opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	166ms 165ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 02:09:50 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		cs a.usbrowserspeed.com/	0 0
POST H3	200	sessions.trackScriptAdded Show response opps-api.getwarmly.com/api/sessions/trpc/	65 B 82 B	173ms 171ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-referer https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 833ecb26-1875-4423-9d07-764502c7104f content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Mon, 30 Dec 2024 02:09:50 GMT content-type application/json; charset=utf-8 vary Origin
GET H3	200	chat.getMessages Show response opps-api.getwarmly.com/api/sessions/trpc/	31 B 47 B	165ms 165ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%22d8b8b033-fea5-4f24-98df-709f4121bd55%22%7D%7D Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 2485e74dd82a729476c358bb9ad59c0322ee42bfeeac9805606cb9da39a47f98 Request headers x-warmly-referer https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 833ecb26-1875-4423-9d07-764502c7104f content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 date Mon, 30 Dec 2024 02:09:50 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	chat.getMessages opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	168ms 168ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%22d8b8b033-fea5-4f24-98df-709f4121bd55%22%7D%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 02:09:50 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	128ms 128ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:50 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:50 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
POST H2	200	/ Show response us.i.posthog.com/s/	15 B 248 B	778ms 766ms	Fetch application/json	54.235.141.174 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/s/?ip=1&_=1735524590830&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.235.141.174 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-235-141-174.compute-1.amazonaws.com Software envoy / Resource Hash 0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers x-envoy-upstream-service-time 419 access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 15 date Mon, 30 Dec 2024 02:09:51 GMT content-type application/json vary origin, access-control-request-method, access-control-request-headers server envoy
POST H3	200	sessions.updateHubspotUserToken Show response opps-api.getwarmly.com/api/sessions/trpc/	33 B 49 B	169ms 167ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash ded6935dc09c7888de1b41c8ab7cebf82223c044f9eced4628c8236962fec3c5 Request headers x-warmly-session-id d8b8b033-fea5-4f24-98df-709f4121bd55 x-warmly-user-identifier ca91a31d-b93c-43d8-b232-4bc2d6785d7d x-warmly-referer https://www.cyberhaven.com/blog/cyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 833ecb26-1875-4423-9d07-764502c7104f X-Warmly-Target session-server x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33 date Mon, 30 Dec 2024 02:09:51 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.updateHubspotUserToken opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	154ms 154ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 02:09:51 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	127ms 127ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A50%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:51 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:51 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	127ms 126ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=a5e2dab9-bc2f-43d7-8ab0-9e5d0b0534a1&session=223b8fed-c882-4d77-8cc3-560a6301cb51&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2002%3A09%3A51%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Our%20team%20has%20confirmed%20a%20malicious%20cyberattack%20that%20occurred%20on%20Christmas%20Eve%2C%20affecting%20Cyberhaven%27s%20Chrome%20extension.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cyberhaven%E2%80%99s%20Chrome%20extension%20security%20incident%20and%20what%20we%E2%80%99re%20doing%20about%20it%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fblog%2Fcyberhavens-chrome-extension-security-incident-and-what-were-doing-about-it&pageViewId=5e0f5637-23b4-4510-814b-62461d5d14fa&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 02:09:52 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 02:09:52 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/fda4c311-a68c-4dbd-99ce-4730a044fb56

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/1d1adbd7-8c5a-4741-9172-8a2640c4fc0c

Domain

a.usbrowserspeed.com

URL

https://a.usbrowserspeed.com/cs?pid=4dd5c5fae59ce3249cf6f13469fbc883b27c8135ce5092e6a3b38092dc07d387&puid=d8b8b033-fea5-4f24-98df-709f4121bd55&r=%0A%20%20%20%20https%3A%2F%2Fapi.immagnify.com%2Fv1%2Fintegrations%2Ffxf%2Fwebhook%2FkhlFEhkHvc%3Fhem%3D%24%7BHEM_SHA256_LOWERCASE%7D%26up_id%3D%24%7BUP_ID%7D%26puid%3Dd8b8b033-fea5-4f24-98df-709f4121bd55%26ip%3D%24%7BIP%7D%0A%20%20