support.alertlogic.com Open in urlscan Pro
104.16.52.111  Public Scan

16 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 30

• https://dpm.demdex.net/id?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 HTTP 302
• https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270

Request Chain 40

• https://platform.twitter.com/oct.js HTTP 301
• https://static.ads-twitter.com/oct.js

Request Chain 49

• https://www.google-analytics.com/r/collect?v=1&_v=j81&a=2000210400&t=pageview&_s=1&dl=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&ul=en-us&de=UTF-8&dt=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAEAB~&jid=1275255870&gjid=1081850614&cid=700209804.1583713266&tid=UA-17359898-9&_gid=784344155.1583713266&_r=1&z=1367436140 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_gid=784344155.1583713266&gjid=1081850614&_v=j81&z=1367436140 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140&slf_rd=1&random=539802678

Request Chain 69

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=1583713265795 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8957%26url%3Dhttps%253A%252F%252Fsupport.alertlogic.com%252Fhc%252Fen-us%252Farticles%252F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor%26time%3D1583713265795%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=1583713265795&liSync=true

81 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Show response support.alertlogic.com/hc/en-us/articles/	33 KB 10 KB	538ms 457ms	Document text/html	104.16.52.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.16.52.111 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 82e40790c4b18f2301fe5c3ceff153e4bed1728261c5d6fd90df2e2e3d3e2580 Security Headers Name Value Strict-Transport-Security max-age=259200; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority support.alertlogic.com :scheme https :path /hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest document accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers status 200 date Mon, 09 Mar 2020 00:21:05 GMT content-type text/html; charset=utf-8 set-cookie __cfduid=db191aa2ced189a47b7425306db8034c41583713264; expires=Wed, 08-Apr-20 00:21:04 GMT; path=/; domain=.support.alertlogic.com; HttpOnly; SameSite=Lax __cfruid=6684b21042b8a1e79f186b56a772a27b2382aae2-1583713265; path=/; domain=.support.alertlogic.com; HttpOnly; Secure; SameSite=None cf-ray 5710a23ffd22bbd0-LHR cache-control public, max-age=0 content-language en-us etag W/"15b28520c5199a44a453713c9042cbcb" strict-transport-security max-age=259200; vary Accept-Encoding cf-cache-status REVALIDATED cache-tags resource:articles#show, pod:pod13 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" protocol HTTP/1.0 x-content-type-options nosniff x-frame-options SAMEORIGIN x-request-id 570b3fed82efdc0b-SEA x-runtime 0.179741 x-ua-compatible IE=edge x-xss-protection 1; mode=block x-zendesk-origin-server help-center-unicorn-56ddc8f45-ddmrl x-zendesk-user-id server cloudflare content-encoding br
GET H2	200	application-ebbf4a70487f9466c9be47bf4b6055f6.css static.zdassets.com/hc/assets/	53 KB 10 KB	89ms 27ms	Stylesheet text/css	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/application-ebbf4a70487f9466c9be47bf4b6055f6.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8099f06c3097dbe4ed8d47434ec496823e66e1bc774121babbcbb36dcb451ccb Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 313149 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id 729522A6976D2AED x-amz-id-2 o5G73J8q/XPPbIOy50W4V3r7zekXeaxbIuFx4G6B8Fggc327SdA9mvQwFIgXm14xd0Lb+uvTpr4= last-modified Thu, 20 Feb 2020 08:43:15 GMT server cloudflare etag W/"e1b2c6f3945cc55bc26f1a0a67866995" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-amz-version-id wbdnd19JKVIs0p0XqO3RfdAyQ1RcmaVC cf-ray 5710a2434eaadc33-LHR
GET H2	200	theming_v1_support-7eacdab8920220a42cfc91404f4ed182.css static.zdassets.com/hc/assets/	15 KB 7 KB	95ms 32ms	Stylesheet text/css	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/theming_v1_support-7eacdab8920220a42cfc91404f4ed182.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af75ef88a08a11991a5572ea5c9c97e7db1b7049bd0a1b4178d2051082e82c73 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 469267 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id A062BB50F769B08B x-amz-id-2 mvTMj7MrufB23mhV7RxpwPNvgaNeYfgKf+4M+1TJ3rueSioHcEg+0wtafPpsGSX2u59QOt+xVxc= last-modified Tue, 18 Feb 2020 13:13:23 GMT server cloudflare etag W/"ff0f5c15f20ede77a9bb9d6237361a37" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-amz-version-id BoTcxb9llAefHKiBJxADRI4UyiRHTvI0 cf-ray 5710a2434eabdc33-LHR
GET H2	200	style.css p13.zdassets.com/hc/theming_assets/974280/1010937/	70 KB 12 KB	70ms 28ms	Stylesheet text/css	104.18.70.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://p13.zdassets.com/hc/theming_assets/974280/1010937/style.css?digest=360228558592 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68be9366d5e84c15c8f38481c2019b2950c26af7d17d353f243197c8d934ce40 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers cache-tags resource:theming_assets#show_css, pod:pod13 date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 24910 cf-ray 5710a2432c6bce43-LHR status 200 x-zendesk-user-id protocol HTTP/1.0 x-request-id 5403e06f2accbc18-LHR x-ua-compatible IE=edge x-runtime 0.026732 server cloudflare etag W/"68be9366d5e84c15c8f38481c2019b29" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding strict-transport-security max-age=0 content-type text/css; charset=utf-8 cache-control max-age=604800, public x-zendesk-origin-server help-center-unicorn-799669546c-cn2k9 x-robots-tag none, noarchive
GET H2	200	jquery-d5395f0b7ac5027403fc17855c46dbfc.js Show response static.zdassets.com/hc/assets/	91 KB 31 KB	107ms 45ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/jquery-d5395f0b7ac5027403fc17855c46dbfc.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0343f37ebbd97d0f147e4adb5fa3b2362f7f48d79db51cbaa613ebcb4dbc9515 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 476111 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id A7E91B28AA8138A9 x-amz-id-2 bzfqL4DCxnAN7r7bibWoYczLh2KDTiz1nnpPgSVZuaUDtTI8F3KSU7py53c6WJeF5ESX7ZkK+wo= last-modified Thu, 28 Nov 2019 19:07:50 GMT server cloudflare etag W/"d5395f0b7ac5027403fc17855c46dbfc" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=678 x-amz-version-id u__P.f9m1zHE7xsnMXW0BD5AjiJANzeY cf-ray 5710a2434eacdc33-LHR
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	28ms 5ms	Script text/javascript	2a00:1450:4001:825::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Wed, 05 Feb 2020 05:24:08 GMT content-encoding gzip x-content-type-options nosniff age 2833017 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 30306 x-xss-protection 0 last-modified Fri, 24 Mar 2017 20:55:54 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 04 Feb 2021 05:24:08 GMT
GET H2	200	foundation.min.js Show response cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/js/	145 KB 30 KB	16ms 14ms	Script application/javascript	2606:4700::6811:4004 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/foundation/6.4.3/js/foundation.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9916250aee441bea2e0f4ed6c4b17cbf8640658080e96ae67485f29f506ff559 Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 19672397 cf-ray 5710a242de1b145a-FRA status 200 strict-transport-security max-age=15780000; includeSubDomains alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Thu, 17 May 2018 09:19:17 GMT server cloudflare etag W/"5afd4915-2454f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * expires Sat, 27 Feb 2021 00:21:05 GMT cache-control public, max-age=30672000 timing-allow-origin * served-in-seconds 0.004
GET H2	200	all.css pro.fontawesome.com/releases/v5.2.0/css/	59 KB 12 KB	80ms 20ms	Stylesheet text/css	151.139.128.10 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.2.0/css/all.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash d55e3385a8c2063d4b0f3a88c1acd01173f86009702067790613a08e55d7597f Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest style User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Mon, 23 Jul 2018 17:24:43 GMT access-control-allow-origin * etag "5cf28d1228ccc67eef7ef1d2e4666093" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding x-hw 1583713265.cds088.lo4.hn,1583713265.cds063.lo4.c content-type text/css status 200 access-control-max-age 3000 cache-control max-age=31556926 access-control-allow-methods GET accept-ranges bytes content-length 12420
GET H2	200	al-hc-custom3.css p13.zdassets.com/hc/theme_assets/974280/200240368/	20 KB 4 KB	86ms 45ms	Stylesheet text/css	104.18.70.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://p13.zdassets.com/hc/theme_assets/974280/200240368/al-hc-custom3.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 91d2f4ea850a701459dc6800c0b46dbbb13f0c1d11973750d8d85288bf0e6f3b Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 452a6d5a60db801bab9900e11681a635.cloudfront.net (CloudFront) cf-cache-status HIT age 24910 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-encoding br content-type text/css last-modified Tue, 11 Sep 2018 14:25:16 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET x-amz-version-id AXQ7g3609Wm3pMHuDrz0u3dZyDTPw8YK access-control-allow-origin * cache-control max-age=604800 cf-ray 5710a2432c6cce43-LHR x-amz-cf-id NKMjyFqZkECCVSparnBk9K5TC4K7zwu1SeYLRuS2Ih9dbLX06uX7TQ== expires Sun, 15 Mar 2020 17:25:55 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	86 KB 33 KB	74ms 17ms	Script application/x-javascript	93.184.220.178 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (lcy/1D3F) / ASP.NET Resource Hash e773f4691e8ff30b1394c08334fe9bf17393fb9e1e649770d020b15f1ce5202b Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Wed, 26 Feb 2020 16:11:45 GMT server ECS (lcy/1D3F) age 89734 x-powered-by ASP.NET etag "a1aa3871bfecd51:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript status 200 accept-ranges bytes content-length 33516
GET H2	200	satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/	106 KB 35 KB	96ms 32ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 624bd5cf1da49f9b2d8b5429022597585a28b6a0ef5f904ddd6ec4e9a716bc88 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:24 GMT server AkamaiNetStorage etag "2ef39244a02739ec9d50e3a94e20d4f5:1571408544.062048" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 35068 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	evergage.min.js Show response cdn.evgnet.com/beacon/alertlogic/engage/scripts/	455 KB 121 KB	211ms 171ms	Script application/javascript	151.101.0.114 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.evgnet.com/beacon/alertlogic/engage/scripts/evergage.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.0.114 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 0a8ca976819e6949026e01155e8fe7e022ce5b2f7cd7ffa2d3d15327483383ce Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id xz9BXrdlk8jdKZLRYPJ9FLqcolbRBNFq content-encoding gzip age 81 x-cache HIT, HIT status 200 date Mon, 09 Mar 2020 00:21:05 GMT x-amz-replication-status COMPLETED content-length 123216 x-amz-request-id A554E30B5610CEE3 x-amz-id-2 9PfLfthzJu/C0m3Te8yybG2NcyRn+dAok691CpJ8hmu6jmrJ+S5tTgO8Ma49yGy3JCeA9YKaPO8= x-served-by cache-iad2120-IAD, cache-lon4221-LON x-amz-meta-evergage-sum 7c8ab9e2c2bad9312424416dcc20e0e7ae2116d6 last-modified Sun, 08 Mar 2020 15:29:19 GMT server AmazonS3 x-timer S1583713265.140770,VS0,VE150 etag "e33becc166a6cc3efbe8088d5c385fb1" vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 varnish, 1.1 varnish cache-control max-age=120 accept-ranges bytes timing-allow-origin * x-amz-meta-evergage-beacon-ver 12 x-cache-hits 1, 1
GET H2	200	auth0.min.js Show response cdn.auth0.com/js/auth0/9.5.1/	109 KB 33 KB	141ms 49ms	Script application/javascript	143.204.215.119 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.auth0.com/js/auth0/9.5.1/auth0.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.215.119 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-215-119.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash c65499454b28db683dd0efc366872a896cef0fe2ccfd6d51d6db446dcad88fcb Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-amz-version-id 38nHgGlXmejuOCEREftQ2ogm5Z01rLQ3 content-encoding gzip last-modified Mon, 30 Apr 2018 13:21:04 GMT server AmazonS3 age 81297 date Sun, 08 Mar 2020 01:46:09 GMT vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript status 200 cache-control max-age=2628000,public x-amz-replication-status COMPLETED x-amz-cf-pop FRA53-C1 x-amz-cf-id vUzgLYEKhPXM5H5_qCRlLCF5LH9aeCTKC1i0KLL8Fa9tVZlywWemcw== via 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront)
GET H2	200	select2.min.css cdnjs.cloudflare.com/ajax/libs/select2/4.0.6-rc.0/css/	15 KB 2 KB	22ms 21ms	Stylesheet text/css	2606:4700::6811:4004 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.6-rc.0/css/select2.min.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1100388fbf996eb7b0090bf027336657188a330191b295cc1a0b7b23a0008aab Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 28347205 cf-ray 5710a242de1a145a-FRA status 200 strict-transport-security max-age=15780000; includeSubDomains alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Thu, 17 May 2018 09:25:33 GMT server cloudflare etag W/"5afd4a8d-3bab" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * expires Sat, 27 Feb 2021 00:21:05 GMT cache-control public, max-age=30672000 timing-allow-origin * served-in-seconds 0.004
GET H2	200	select2.min.js Show response cdnjs.cloudflare.com/ajax/libs/select2/4.0.6-rc.0/js/	66 KB 18 KB	15ms 14ms	Script application/javascript	2606:4700::6811:4004 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.6-rc.0/js/select2.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:4004 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1cd91b9dd3e258ce4421181a85cde15a2b860fa0adc0580c7c4534a37cde69ba Security Headers Name Value Strict-Transport-Security max-age=15780000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 28347205 cf-ray 5710a242de1c145a-FRA status 200 strict-transport-security max-age=15780000; includeSubDomains alt-svc h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Thu, 17 May 2018 09:25:33 GMT server cloudflare etag W/"5afd4a8d-108a7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * expires Sat, 27 Feb 2021 00:21:05 GMT cache-control public, max-age=30672000 timing-allow-origin * served-in-seconds 0.003
GET H2	200	bc949d62cb31eeb5726f087abc84e270f1ec54cf.js Show response theme.zdassets.com/theme_assets/974280/	28 KB 8 KB	96ms 53ms	Script application/javascript	104.18.72.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://theme.zdassets.com/theme_assets/974280/bc949d62cb31eeb5726f087abc84e270f1ec54cf.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5f90a195781ca5146b625bdea1ab3fe6c1771455242bf89e5d7b3c73b9003d7 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 9946ab784d1328de1a34d3840ab6cea6.cloudfront.net (CloudFront) cf-cache-status HIT age 56455 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-encoding br content-type application/javascript last-modified Tue, 26 Feb 2019 21:07:31 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET x-amz-version-id RNaa5ZGMIRoDNVHtdQSxyp3h0r4kJ0r9 access-control-allow-origin * cache-control public, max-age=86400 x-amz-cf-pop CDG3-C1 cf-ray 5710a24329c6e674-LHR x-amz-cf-id gsgyfuzsWc535gnlZi8AqXf_xEvdZlPH83saoEwkpP65_Fgxikaavg==
GET H2	200	8f7759938f1c6997924dc8714e61a6d479a58289.js Show response theme.zdassets.com/theme_assets/974280/	8 KB 3 KB	103ms 59ms	Script application/javascript	104.18.72.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://theme.zdassets.com/theme_assets/974280/8f7759938f1c6997924dc8714e61a6d479a58289.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 83a534610ccc8f27293d34e0ee8926d0aecafb4f966589e621487f54861c465d Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 e9264a80086c9204ba271fc4403dab51.cloudfront.net (CloudFront) cf-cache-status HIT age 48312 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-encoding br content-type application/javascript last-modified Tue, 26 Feb 2019 22:50:40 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET x-amz-version-id xZ.sKt7umhrn0BtYFcwa12VMiCMl7SrH access-control-allow-origin * cache-control public, max-age=86400 cf-ray 5710a24329c7e674-LHR x-amz-cf-id VmGw_C1nL-gIYmycqKLPWAgaqRmtZwJFq0Ln_WDrsJHxeTcoivQlRw==
GET H2	200	script.js Show response p13.zdassets.com/hc/theming_assets/974280/1010937/	28 KB 9 KB	68ms 27ms	Script text/javascript	104.18.70.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://p13.zdassets.com/hc/theming_assets/974280/1010937/script.js?digest=360228558592 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10510f6cdf42f4e5216c62444732bed9deb8cd2b43a2149c5ec0ee978e18811c Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers cache-tags resource:theming_assets#show_javascript, pod:pod13 date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 24910 cf-ray 5710a2432c6ece43-LHR status 200, 200 OK x-zendesk-user-id protocol HTTP/1.0 x-request-id 506162c2faa9dc23-SEA x-ua-compatible IE=edge x-runtime 0.047971 server cloudflare etag W/"10510f6cdf42f4e5216c62444732bed9" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding strict-transport-security max-age=0 content-type text/javascript; charset=utf-8 cache-control max-age=604800, public x-zendesk-origin-server help-center-unicorn-54cd5cb49d-xgtkj x-robots-tag none, noarchive
GET H2	200	fea8b256c3f860c01c60a419b1716d77308d61ee.png theme.zdassets.com/theme_assets/974280/	39 KB 40 KB	71ms 27ms	Image image/png	104.18.72.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://theme.zdassets.com/theme_assets/974280/fea8b256c3f860c01c60a419b1716d77308d61ee.png Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.72.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash af37a3884a0e5363a2cc70b2d12d280cfade94ab5973d68020ec02fc99923c3e Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 8566cb770d0695bb6bffb61a26f5b400.cloudfront.net (CloudFront) cf-cache-status HIT age 41314 x-amz-server-side-encryption AES256 x-cache Miss from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-type image/png content-length 39806 last-modified Thu, 07 Mar 2019 15:51:44 GMT server cloudflare etag "6c99c127f42bec65fb17557e3575acf1" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding access-control-allow-methods HEAD, GET x-amz-version-id 5QX_ZwVTjdMZz.XN.jUyRYcTcdKwOLOa access-control-allow-origin * cache-control public, max-age=86400 x-amz-cf-pop LHR50-C1 accept-ranges bytes cf-ray 5710a24329c8e674-LHR x-amz-cf-id hgR8d0qjLYQgDWJamHi5xtAM2UyEmKQ6EyHoTDaXD7LB8oUUFjCDog==
GET H2	200	mceclip0.png support.alertlogic.com/hc/article_attachments/360007636031/	17 KB 17 KB	579ms 578ms	Image image/png	104.16.52.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://support.alertlogic.com/hc/article_attachments/360007636031/mceclip0.png Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.16.52.111 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ae5279eb96e51b48c3fda3c81cbdc94b420b74e9ddaf57030d2aea061898c46a Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff cf-cache-status REVALIDATED x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED content-disposition inline; filename="mceclip0.png" content-type image/png content-length 17218 last-modified Sat, 19 Jan 2019 01:59:07 GMT server cloudflare etag "2f1cd5bcc83d2599a6345691f877a582" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding x-amz-version-id qhC6dkwqN6n0gHQktTF4xOjE0QRPrVUK access-control-allow-origin * cache-control max-age=10, public accept-ranges bytes cf-ray 5710a2440f7ebbd0-LHR
GET H/1.1	200 OK	logo-alertlogic-white.png www.alertlogic.com/assets/img/	3 KB 4 KB	671ms 533ms	Image image/png	99.86.3.87 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://www.alertlogic.com/assets/img/logo-alertlogic-white.png Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.3.87 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-3-87.fra6.r.cloudfront.net Software / Resource Hash d4631de95e8413346dedfde1266d66e35294fbd88f0b675d7637f007a71b01ae Security Headers Name Value Content-Security-Policy frame-ancestors 'self' http://resources.alertlogic.com https://resources.alertlogic.com http://blog.alertlogic.com https://blog.alertlogic.com Strict-Transport-Security max-age=63072000; includeSubDomains X-Frame-Options allow-from https://resources.alertlogic.com https://blog.alertlogic.com Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Content-Security-Policy frame-ancestors 'self' http://resources.alertlogic.com https://resources.alertlogic.com http://blog.alertlogic.com https://blog.alertlogic.com Via 1.1 507b5edb20d0e1a0b73c8687f53defa9.cloudfront.net (CloudFront) X-Amz-Cf-Pop FRA6-C1 X-Cache Miss from cloudfront Date Mon, 09 Mar 2020 00:21:05 GMT Connection keep-alive Content-Length 3215 Last-Modified Thu Mar 5 22:44:18 UTC 2020 Server ETag "c8f-58358179bcb00" X-Frame-Options allow-from https://resources.alertlogic.com https://blog.alertlogic.com Strict-Transport-Security max-age=63072000; includeSubDomains Content-Type image/png Cache-Control public, max-age=900 Accept-Ranges bytes X-Amz-Cf-Id DYY5_HL-7XXTV0IeSEESf2Op6ajst4tJ0BiPeEFblHcxzSeoRR1kEQ==
GET H2	200	en-us.0aa8fb06734a1c1977c3.js Show response static.zdassets.com/hc/assets/	181 KB 31 KB	31ms 30ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/en-us.0aa8fb06734a1c1977c3.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8a28409bf0ec44784eb24ced01719df409207456736008054962a816cef9bfba Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 466312 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id D2C5EB10EF27A884 x-amz-id-2 /d7UY/gMh+ssEjAfBvesxXej/gdf/ghE67JVJnWKXpX4GU0+cUpNeOIwJHGJtfPLUNKI+15qeMo= last-modified Tue, 03 Mar 2020 14:33:59 GMT server cloudflare etag W/"0aa8fb06734a1c1977c36ea59e4a056c" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-amz-version-id oVbGlVVYjYFOrKUGqWIAdkNNUds0o1.R cf-ray 5710a2437f18dc33-LHR
GET H2	200	host.js Show response alertlogic.zendesk.com/auth/v2/	9 KB 3 KB	82ms 39ms	Script text/javascript	104.16.52.111 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://alertlogic.zendesk.com/auth/v2/host.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.16.52.111 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b8bfd09c864ac52ffce214939be9e1f690f3cd78329d5ea3329605c71e6e6f15 Security Headers Name Value Strict-Transport-Security max-age=31536000; X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT age 41315 p3p CP="NOI DSP COR NID ADMa OPTa OUR NOR" status 200 strict-transport-security max-age=31536000; x-xss-protection 1; mode=block x-request-id 53df6b785f7bf407-LHR x-runtime 0.082606 server cloudflare etag W/"d61169f8168b2fe0bb7133caeae6e805" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept, Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control max-age=86400, public x-zendesk-origin-server classic-app-server-69c5d5ff44-dhblj cf-ray 5710a243bd87dbfb-LHR
GET H2	200	moment-f6f8513da6ab17eadada59a1a4edb536.js Show response static.zdassets.com/hc/assets/	24 KB 9 KB	26ms 26ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/moment-f6f8513da6ab17eadada59a1a4edb536.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc6fef41f718988375e6774e0772183e68d2fe4ac7fdb46f99e1276ace91b1a4 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 471605 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id 16E2D7A6A4954EFE x-amz-id-2 sjIgOB/0LdyeKmVjmg/vWqrtKTCOxOsPXlFtzmNI94E/2udwPgJDEN/pvhzjjWZjYYvI36E3AwA= last-modified Tue, 04 Feb 2020 12:28:14 GMT server cloudflare etag W/"f6f8513da6ab17eadada59a1a4edb536" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-amz-version-id Sdm5LUhYft98r.tSM2F1rgpmrYqtcrF7 cf-ray 5710a243df7edc33-LHR
GET H2	200	hc_enduser-0d30706c9f12907f2d6f8afe59752ee3.js Show response static.zdassets.com/hc/assets/	685 KB 193 KB	37ms 36ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/hc_enduser-0d30706c9f12907f2d6f8afe59752ee3.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 273ba42ff321cfc0d68a7291c97827c058a10f7e615a218eb3835aed5a33d5de Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 466312 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id 34FF8B3514F9232F x-amz-id-2 m6SQY64s3GUZIjoShZhHQJCr+uF/rv7qA6PkVOXfEQO8C8quhXOVrLaxz9tpW7X9fGVkffxm8R0= last-modified Tue, 03 Mar 2020 14:33:59 GMT server cloudflare etag W/"9fde3a123ebcb514ae8d25443312955d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-amz-version-id 853Ex_IPN112ao9aBTa7TkMrWK9A_Qgz cf-ray 5710a243ffaadc33-LHR
GET H2	200	foundation.css p13.zdassets.com/hc/theme_assets/974280/200240368/	104 KB 15 KB	32ms 31ms	Stylesheet text/css	104.18.70.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://p13.zdassets.com/hc/theme_assets/974280/200240368/foundation.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 741acd892c9d59b9a362b61c3b6a9198966f78e585a7af02d05a8ffe84e71040 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 85ddca57b96353e9e4cd2660cf65d9da.cloudfront.net (CloudFront) cf-cache-status HIT age 24909 x-amz-server-side-encryption AES256 cf-ray 5710a2436cc8ce43-LHR x-cache Hit from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-encoding br x-amz-version-id MvrRrT3oN8WcYy0Df9vH_.dO17caNQPM last-modified Tue, 11 Sep 2018 14:25:12 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method access-control-allow-methods HEAD, GET content-type text/css access-control-allow-origin * cache-control max-age=604800 x-robots-tag none, noarchive x-amz-cf-id zlU7dVZSrvh36ztU6f2RZwRFoFkXCWsqWgIwzXkBvR9cRs9BLxOkWw== expires Sun, 15 Mar 2020 17:25:56 GMT
GET H2	200	spacing.css p13.zdassets.com/hc/theme_assets/974280/200240368/	24 KB 2 KB	27ms 26ms	Stylesheet text/css	104.18.70.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://p13.zdassets.com/hc/theme_assets/974280/200240368/spacing.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.70.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb5e822842cb883ab5da613a1140a23ad836187b7d0f4c0c83fc215b7c358f9f Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT via 1.1 97d744cbc5fa647cc362d14ff20ecf08.cloudfront.net (CloudFront) cf-cache-status HIT age 24910 x-amz-server-side-encryption AES256 cf-ray 5710a2436cc9ce43-LHR x-cache Hit from cloudfront status 200 access-control-max-age 86400 x-amz-replication-status COMPLETED strict-transport-security max-age=0 content-encoding br x-amz-version-id ERDvN1j4pv8LFyXQlWkJlyk9HvEK.aSH last-modified Tue, 11 Sep 2018 14:25:10 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Access-Control-Request-Headers,Access-Control-Request-Method, Accept-Encoding access-control-allow-methods HEAD, GET content-type text/css access-control-allow-origin * cache-control max-age=604800 x-amz-cf-pop SEA19-C2 x-robots-tag none, noarchive x-amz-cf-id DmrwwBg-vlhBqlUrEhZHT8xvwMDzrwXxDQoqfoyWvKRK52lOWg8q4w== expires Sun, 15 Mar 2020 17:25:55 GMT
GET H2	200	font-awesome.min.css maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/	30 KB 7 KB	27ms 8ms	Stylesheet text/css	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Wed, 12 Dec 2018 18:35:20 GMT access-control-allow-origin * etag "1544639720" vary Accept-Encoding x-cache HIT content-type text/css; charset=utf-8 status 200 cache-control public, max-age=31536000 x-hello-human Say hello back! @getBootstrapCDN on Twitter accept-ranges bytes timing-allow-origin * content-length 7050
GET H2	200	analytics.js Show response www.google-analytics.com/	44 KB 18 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:81a::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 06 Feb 2020 00:21:02 GMT server Golfe2 age 1735 date Sun, 08 Mar 2020 23:52:10 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 18174 expires Mon, 09 Mar 2020 01:52:10 GMT
GET H2	200	hotjar-228809.js Show response static.hotjar.com/c/	5 KB 2 KB	157ms 106ms	Script application/javascript	147.75.33.131 PACKET
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-228809.js?sv=5 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.33.131 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress7 Software / Resource Hash 45eca70a0cd8f85c736f54de3f0f7a68c518f0655e909b8bbd82b2065b7307c6 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff content-type application/javascript section-io-tag hotjar age 0 status 200 access-control-max-age 600 section-io-cache Miss content-length 1922 x-cache-hit 1 x-frame-options SAMEORIGIN etag W/cc7e3f1a1ef1534a0ec3caaf57b20246 vary Accept-Encoding section-io-origin-status 304 access-control-allow-origin * cache-control max-age=60 section-io-origin-time-seconds 0.080 accept-ranges bytes section-io-id c2040dc3d984c652ffcf9f5a7ce82f82 section-origin-responded true
GET H2	200	css fonts.googleapis.com/	40 KB 2 KB	17ms 17ms	Stylesheet text/css	2a00:1450:4001:818::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 0988503fc209c28c8c0ee01e271110682c58efdce03c9e0044d59826ff2137db Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 x-xss-protection 0 last-modified Mon, 09 Mar 2020 00:21:05 GMT server ESF date Mon, 09 Mar 2020 00:21:05 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 09 Mar 2020 00:21:05 GMT
GET H/1.1	302 Found	rd Show response dpm.demdex.net/id/ Redirect Chain https://dpm.demdex.net/id?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270	0 -1 B	127ms 28ms	XHR	52.30.78.155 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.30.78.155 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-30-78-155.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Location https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 X-TID v1MvrV+IQxE= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://support.alertlogic.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 GMT Redirect headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Access-Control-Allow-Origin https://support.alertlogic.com X-TID v1MvrV+IQxE= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	forms2.min.js Show response app-ab01.marketo.com/js/forms2/js/	169 KB 58 KB	177ms 33ms	Script application/x-javascript	104.16.92.80 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app-ab01.marketo.com/js/forms2/js/forms2.min.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.92.80 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f6e7e0830124ea580b3f0de0da80ba48a45d9df9d7c092af0f47c63ed0692578 Security Headers Name Value Strict-Transport-Security max-age=63113904 X-Content-Type-Options nosniff Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 3413 status 200 strict-transport-security max-age=63113904 last-modified Wed, 12 Feb 2020 19:42:36 GMT server cloudflare etag "141f2b-2a546-59e662c9ea300" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 5710a244ef02ce17-LHR expires Mon, 09 Mar 2020 04:21:05 GMT
GET H/1.1	200 OK	rd Show response dpm.demdex.net/id/	219 B 1 KB	31ms 31ms	XHR application/json	52.30.78.155 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id/rd?d_visid_ver=1.8.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&d_nsid=0&ts=1583713265270 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.30.78.155 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-30-78-155.eu-west-1.compute.amazonaws.com Software / Resource Hash 1fe25f1a26ed4839bd993879401ed62138c9e90bf2c1c616f49090d4db7239eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers DCS dcs-prod-irl1-v062-0886a0235.edge-irl1.demdex.com 5.65.0.20200212140016 2ms (+1ms) Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains X-TID JMVRl/nKRJE= Vary Origin, Accept-Encoding, User-Agent P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://support.alertlogic.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json;charset=utf-8 Content-Length 219 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	id Show response alertlogic.sc.omtrdc.net/	2 B 322 B	87ms 24ms	XHR application/x-javascript	35.181.91.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://alertlogic.sc.omtrdc.net/id?d_visid_ver=1.8.0&d_fieldgroup=A&mcorgid=2D2BFE14571E4A8E7F000101%40AdobeOrg&mid=51813954325541781652282061315971511965&ts=1583713265439 Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.181.91.36 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-181-91-36.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers status 200 date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff server jag xserver anedge-5dd475c59f-262fz vary Origin x-c master-1187.Ief0e9e.M0-357 p3p CP="This is not a P3P policy" access-control-allow-origin https://support.alertlogic.com cache-control no-cache, no-store, max-age=0, no-transform, private access-control-allow-credentials true content-type application/x-javascript;charset=utf-8 content-length 2 x-xss-protection 1; mode=block
GET H2	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2 fonts.gstatic.com/s/sourcesanspro/v13/	13 KB 13 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v13/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2 Requested by Host: app-ab01.marketo.com URL: https://app-ab01.marketo.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 03:23:15 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 03:46:05 GMT server sffe age 334670 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 13224 x-xss-protection 0 expires Fri, 05 Mar 2021 03:23:15 GMT
GET H2	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2 fonts.gstatic.com/s/sourcesanspro/v13/	13 KB 13 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v13/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2 Requested by Host: app-ab01.marketo.com URL: https://app-ab01.marketo.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 11:27:08 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 03:46:19 GMT server sffe age 910437 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 13324 x-xss-protection 0 expires Fri, 26 Feb 2021 11:27:08 GMT
GET H2	200	TK3iWkUHHAIjg752GT8Gl-1PKw.woff2 fonts.gstatic.com/s/oswald/v31/	25 KB 25 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/oswald/v31/TK3iWkUHHAIjg752GT8Gl-1PKw.woff2 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash e747521bc9729c30f06bda6471e77ad26ce0e05b104743e93fe14c8ef3b559a7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Mar 2020 00:32:04 GMT x-content-type-options nosniff last-modified Tue, 03 Mar 2020 00:19:42 GMT server sffe age 517741 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 25376 x-xss-protection 0 expires Wed, 03 Mar 2021 00:32:04 GMT
GET DATA	200 OK	truncated /	4 KB 4 KB		Font font/woff
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 50d5b516d840c7f050b44630b17a495e6549316b53c4a81bff2c8d11f1f0500e Request headers Origin https://support.alertlogic.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Content-Type font/woff
GET H2	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v16/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 27 Feb 2020 10:31:47 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 03:45:54 GMT server sffe age 913758 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 14176 x-xss-protection 0 expires Fri, 26 Feb 2021 10:31:47 GMT
GET H2	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v16/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:81d::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81d::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/css?family=Oswald:400,300,700|Lato:100,300,400,700|Source+Sans+Pro:200,300,400,600,700,900,200italic,300italic,400italic,600italic,700italic,900italic Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 05 Mar 2020 00:02:28 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 03:45:55 GMT server sffe age 346717 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 14044 x-xss-protection 0 expires Fri, 05 Mar 2021 00:02:28 GMT
GET H2	200	oct.js Show response static.ads-twitter.com/ Redirect Chain https://platform.twitter.com/oct.js https://static.ads-twitter.com/oct.js	5 KB 2 KB	101ms 33ms	Script application/javascript	151.101.12.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/oct.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip age 57997 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1954 x-served-by cache-fra19178-FRA last-modified Tue, 23 Jan 2018 20:09:00 GMT x-timer S1583713266.676671,VS0,VE0 etag "b7b33882a4f3ffd5cbf07434f3137166+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes Redirect headers Access-Control-Allow-Origin * Date Mon, 09 Mar 2020 00:21:05 GMT Server ECS (fcn/40B6) Content-Length 0 Location https://static.ads-twitter.com/oct.js Access-Control-Allow-Methods GET P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
GET H2	200	satellite-574dbcd564746d6b9000b831.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	1 KB 685 B	34ms 34ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-574dbcd564746d6b9000b831.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a71627b229a3d8bc6683b642f9a935697c58fc2814737f28dcc7ad9e1850fa42 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:24 GMT server AkamaiNetStorage etag "6557647bb78af336887c92e3e1440ec3:1571408544.598714" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 439 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-5755b4f864746d251700cf7d.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	545 B 582 B	35ms 34ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5755b4f864746d251700cf7d.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 22f35f1e580566391809fff946156e10901faac6df9584e8a1427f8d3e6dcc33 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:24 GMT server AkamaiNetStorage etag "d29b96d7bd0c0bed29f85bbf8ded0120:1571408544.767367" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 336 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-5755b4f864746d251700cf81.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	1 KB 594 B	37ms 36ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5755b4f864746d251700cf81.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash d151fd397dceb2ee8c1b5cb3f2058f35d274fb252f83d1625a695259425cc027 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:24 GMT server AkamaiNetStorage etag "19b0ded3b40a4cf442064f24d4aee91f:1571408544.913677" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 349 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-5786765d64746d0b190000bf.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	425 B 544 B	37ms 37ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5786765d64746d0b190000bf.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 30c17daac37a203b4986c9579e3a8427df97f5c6a0a81c9bc1ea4887e68d3b94 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:25 GMT server AkamaiNetStorage etag "9c701d02af65f42edaf13e0a41e60516:1571408545.086733" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 300 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-5757183d64746d6333002e60.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	309 B 444 B	38ms 37ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5757183d64746d6333002e60.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 87197718e8f9bfc844d6ad5757e05a0272d822da162ea9bd5848bfcb33a64d3b Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:25 GMT server AkamaiNetStorage etag "0afdcb65ae294c6b81275d557c39b35e:1571408545.258775" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 198 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-57e594e364746d36190149e3.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	10 KB 3 KB	39ms 38ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-57e594e364746d36190149e3.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 3c643bbf83ac3dc1fd8bece240c1a7a6c4e0918e5c1004f57b750bfc106533d3 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:25 GMT server AkamaiNetStorage etag "914b7f9356b8dba5b8cac09af284c1e0:1571408545.40086" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 2635 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	satellite-5a3c0d6f64746d7c6f00e127.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/	731 B 646 B	39ms 39ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5a3c0d6f64746d7c6f00e127.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 8c99a2efb42f096f7628d2a67dc7bde4ba3ecd96f1f21a15b7e293135d06ecf8 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:25 GMT server AkamaiNetStorage etag "57a6b75fed4083758f42d2aaa9ad8a42:1571408545.648257" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 401 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	s-code-contents-6ca4ae86ae1c90dcc634066533467ce4cb891326.js Show response assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/	40 KB 15 KB	39ms 38ms	Script application/x-javascript	2.18.232.23 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/s-code-contents-6ca4ae86ae1c90dcc634066533467ce4cb891326.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.18.232.23 , Ascension Island, ASN16625 (AKAMAI-AS, US), Reverse DNS a2-18-232-23.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash e1b14fab01159f43f337ddbf24563382b9099558189106cef967084f9e94ff37 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip last-modified Fri, 18 Oct 2019 14:22:24 GMT server AkamaiNetStorage etag "a7afa196cb173cd3bc360ab1cc217e16:1571408544.418763" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=3600 accept-ranges bytes timing-allow-origin * content-length 15470 expires Mon, 09 Mar 2020 01:21:05 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j81&a=2000210400&t=pageview&_s=1&dl=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registr... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_gid=784344155.1583713266&gjid=1081850614&_v=j81&z=1367436140 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140&slf_rd=1&random=539802678	42 B 478 B	38ms 17ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140&slf_rd=1&random=539802678 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff server cafe timing-allow-origin * location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-17359898-9&cid=700209804.1583713266&jid=1275255870&_v=j81&z=1367436140&slf_rd=1&random=539802678 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 cache-control no-cache, no-store, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	fbds.js Show response connect.facebook.net/en_US/	4 KB 2 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f02d:12:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbds.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5755b4f864746d251700cf7d.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 40fb16d9709677a81ac280f1a654e85e821a9d3758a063bfac0d21bf53dbea75 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 nzbneZ2UNZrOtdX2Qe54SQ== status 200 date Mon, 09 Mar 2020 00:21:05 GMT, Mon, 09 Mar 2020 00:21:05 GMT expires Mon, 09 Mar 2020 00:35:05 GMT alt-svc h3-27=":443"; ma=3600 content-length 2117 x-fb-debug MOecABMT1d4GuM6GqQ7KcT/NhkSw8U0FwbGQmU3xpS9W4yi2z24JHHw2CaEIVyd7QCyKBwQZTPy5CKpZhnjecA== x-fb-trip-id 2047048586 x-fb-content-md5 0a6ad2df864e1e5779f1db8a14071977 etag "bc50190f534b3ea8aa5641942ae9db70" x-frame-options DENY content-type application/x-javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public,max-age=1200,stale-while-revalidate=3600 timing-allow-origin * access-control-expose-headers X-FB-Content-MD5
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	102ms 38ms	Script application/x-javascript	184.30.221.218 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5755b4f864746d251700cf81.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 184.30.221.218 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a184-30-221-218.deploy.static.akamaitechnologies.com Software Apache / Resource Hash d5c203337a799c43303edff227ee132e0718f3a072663ff7652323196f6df6af Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Mon, 09 Mar 2020 00:21:05 GMT Content-Encoding gzip Last-Modified Sat, 07 Mar 2020 03:17:53 GMT Server Apache ETag "b30bd02bf7e3088a3d2d5f2248508733:1583551073" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 764
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	26 KB 10 KB	195ms 72ms	Script text/javascript	216.58.210.2 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.210.2 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s07-in-f2.1e100.net Software cafe / Resource Hash c3631ac1c623c7498c038ddf390931387f2b76e517675efed274b1c95bd80b68 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9943 x-xss-protection 0 server cafe etag 4339192439078300971 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 09 Mar 2020 00:21:05 GMT
GET H2	200	bat.js Show response bat.bing.com/	23 KB 7 KB	49ms 29ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/scripts/satellite-5786765d64746d0b190000bf.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:04 GMT content-encoding gzip last-modified Fri, 31 Jan 2020 21:01:31 GMT x-msedge-ref Ref A: 2DF9D87103F6440193E872F6CFA96BC3 Ref B: FRAEDGE0213 Ref C: 2020-03-09T00:21:05Z access-control-allow-origin * etag "8087c39c79d8d51:0" vary Accept-Encoding content-type application/javascript status 200 cache-control private,max-age=1800 accept-ranges bytes content-length 7295
GET H2	200	iframe_api Show response www.youtube.com/	859 B 1 KB	43ms 22ms	Script application/javascript	2a00:1450:4001:808::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.youtube.com/iframe_api Requested by Host: assets.adobedtm.com URL: https://assets.adobedtm.com/3df907290fe2f7f77da1165ca1ee90c6b6614263/satelliteLib-970ca04256ccf294d4790a04807d4a7ba75d01fd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software YouTube Frontend Proxy / Resource Hash bdde153c2225a8ece83bee8df43f9f677bba41681f9be21e450a95efce937c59 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff server YouTube Frontend Proxy content-type application/javascript status 200 cache-control no-cache alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 859 x-xss-protection 0 expires Tue, 27 Apr 1971 19:44:06 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 349 B	18ms 5ms	Image image/gif	2a03:2880:f12d:83:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=722360314547694&ev=PixelInitialized&dl=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&rl=&if=false&ts=1583713265610 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT, Mon, 09 Mar 2020 00:21:05 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-27=":443"; ma=3600 content-length 44 expires Mon, 09 Mar 2020 00:21:05 GMT
GET H2	200	s05531756381645 alertlogic.sc.omtrdc.net/b/ss/alogglobalprod/1/JS-1.7.0-D7QN/	43 B 222 B	25ms 25ms	Image image/gif	35.181.91.36 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://alertlogic.sc.omtrdc.net/b/ss/alogglobalprod/1/JS-1.7.0-D7QN/s05531756381645?AQB=1&ndh=1&pf=1&t=9%2F2%2F2020%201%3A21%3A5%201%20-60&D=D%3D&mid=51813954325541781652282061315971511965&aamlh=6&ce=UTF-8&pageName=support%3Ahc%3Aen-us%3Aarticles%3A360007307931-windows-sticky-keys-utilman-registry-cmd-exe-backdoor&g=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&ch=support%3Ahc&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&v1=support.alertlogic.com&c2=page%3Eview%3Esupport%3Ahc%3Aen-us%3Aarticles%3A360007307931-windows-sticky-keys-utilman-registry-cmd-exe-backdoor&v5=support%3Ahc&v6=support%3Ahc%3Aen-us%3Aarticles%3A360007307931-windows-sticky-keys-utilman-registry-cmd-exe-backdoor&v9=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&v16=desktop&v17=First%20Visit&v18=51813954325541781652282061315971511965&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.181.91.36 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-181-91-36.eu-west-3.compute.amazonaws.com Software jag / Resource Hash a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff x-c master-1187.Ief0e9e.M0-357 p3p CP="This is not a P3P policy" status 200 content-length 43 x-xss-protection 1; mode=block pragma no-cache last-modified Tue, 10 Mar 2020 00:21:05 GMT server jag xserver anedge-5dd475c59f-rfd46 etag 3400998339793485824-4618838856012364036 vary * content-type image/gif;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Sun, 08 Mar 2020 00:21:05 GMT
GET H2	200	www-widgetapi.js Show response s.ytimg.com/yts/jsbin/www-widgetapi-vflkAsU_-/	27 KB 10 KB	27ms 6ms	Script text/javascript	2a00:1450:4001:814::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://s.ytimg.com/yts/jsbin/www-widgetapi-vflkAsU_-/www-widgetapi.js Requested by Host: www.youtube.com URL: https://www.youtube.com/iframe_api Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 39b400a9f636b03c497e9f79bb638536984d3619774d1a01993a46df9a1be610 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Sun, 08 Mar 2020 19:37:01 GMT content-encoding gzip x-content-type-options nosniff age 17044 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 10183 x-xss-protection 0 last-modified Sun, 08 Mar 2020 11:08:47 GMT server sffe vary Accept-Encoding, Origin content-type text/javascript cache-control public, max-age=691200 accept-ranges bytes timing-allow-origin https://www.youtube.com expires Mon, 16 Mar 2020 19:37:01 GMT
GET H2	204	0 bat.bing.com/action/	0 170 B	28ms 28ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=5284253&Ver=2&mid=34c190cd-6f62-b49e-e4ce-705dde1085f9&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&p=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&r=&evt=pageLoad&msclkid=N&rn=548766 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers status 204 pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: 5970236F77874B598581C223000D747E Ref B: FRAEDGE0213 Ref C: 2020-03-09T00:21:05Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 448 B	163ms 125ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuosp&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=0 content-length 65 x-xss-protection 0 x-response-time 108 pragma no-cache last-modified Mon, 09 Mar 2020 00:21:05 GMT server tsa_f x-frame-options SAMEORIGIN content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 6dfbafd43af9bcaeb98742694097b321 x-transaction 006efe6e00bf3cb6 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	19ms 6ms	Script application/x-javascript	2a02:26f0:6c00:28c::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:28c::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Mon, 09 Mar 2020 00:21:05 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=24748 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	react-83330e387cb7e738a30dddddbeca8654.js Show response static.zdassets.com/hc/assets/	111 KB 34 KB	32ms 32ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/react-83330e387cb7e738a30dddddbeca8654.js Requested by Host: static.zdassets.com URL: https://static.zdassets.com/hc/assets/hc_enduser-0d30706c9f12907f2d6f8afe59752ee3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b685061d49b861d848d83ffce10ec0e32173c3a67fa014de6f3b06766f90ce7 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 9099 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id 1DA9938F7B3C7635 x-amz-id-2 DM3tePWI3hOP4mAQ8IcKxPFCud6sIdaKhhqTYRzTsxO8434K3Uhyfr836CtHb9IJ+A3xY7SkbtI= last-modified Fri, 31 Jan 2020 13:48:07 GMT server cloudflare etag W/"8fc5bdc168a36517bb6bd7de371cef56" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-amz-version-id tCOw2Nyb2ui1i4nsm2w2kkqwVIdcVZnv cf-ray 5710a246ec41dc33-LHR
GET H2	200	48-a9ba8a5e0ac72f725fd81642b62b7cd0.js Show response static.zdassets.com/hc/assets/	21 KB 8 KB	26ms 26ms	Script application/javascript	104.18.73.113 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.zdassets.com/hc/assets/48-a9ba8a5e0ac72f725fd81642b62b7cd0.js Requested by Host: static.zdassets.com URL: https://static.zdassets.com/hc/assets/hc_enduser-0d30706c9f12907f2d6f8afe59752ee3.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.73.113 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc19b2e304e6e0393f97b2492b177775f54303e8f4fd2f91745c8eec3f98189e Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br cf-cache-status HIT age 312382 x-amz-server-side-encryption AES256 status 200 x-amz-replication-status COMPLETED strict-transport-security max-age=0 x-amz-request-id 351B45D27EC150FA x-amz-id-2 RaD7sV5EsKwIjM2aCq0QTymhPPos3srXb3ZpMF5VUk+L3SYHtvJjNFCDAQ46E5gDNmDXTdz4tsY= last-modified Thu, 27 Feb 2020 09:29:31 GMT server cloudflare etag W/"5f715655933abfbad328f027482c8fa5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-amz-version-id V9Oto.aPLg.AISheqHPmYnv2XP_BEnNc cf-ray 5710a246ec43dc33-LHR
GET H2	200	ipv cdn.bizible.com/m/	43 B 347 B	18ms 18ms	Image image/gif	93.184.220.178 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=b702884374084993df510c193ca1e9b3&_biz_s=4ea224&_biz_l=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&_biz_t=1583713265248&_biz_i=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&_biz_n=0&rnd=896246&cdn_o=a&_biz_z=1583713265755 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (lcy/1D2F) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-aspnet-version 4.0.30319 age 426395 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 content-length 43 pragma no-cache x-aspnetmvc-version 5.2 last-modified Wed, 04 Mar 2020 01:54:30 GMT server ECS (lcy/1D2F) content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes expires -1
POST H/1.1	200 OK	twreceiver Show response alertlogic.evergage.com/	16 KB 3 KB	454ms 127ms	XHR application/json	34.237.171.3 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alertlogic.evergage.com/twreceiver?_r=528499 Requested by Host: cdn.evgnet.com URL: https://cdn.evgnet.com/beacon/alertlogic/engage/scripts/evergage.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.237.171.3 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-171-3.compute-1.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash 05687301d691ff04b22d463cc7e70c96ef019303ecf93cd72d911411078e5bf4 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Mon, 09 Mar 2020 00:21:05 GMT Content-Encoding gzip Server Apache-Coyote/1.1 Vary Accept-Encoding Content-Type application/json;charset=UTF-8 Access-Control-Allow-Origin https://support.alertlogic.com Connection keep-alive Timing-Allow-Origin * Content-Length 2753
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 650 B	166ms 130ms	Script application/javascript	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nuosp&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/oct.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_f / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 57 x-xss-protection 0 x-response-time 113 pragma no-cache last-modified Mon, 09 Mar 2020 00:21:05 GMT server tsa_f x-frame-options SAMEORIGIN strict-transport-security max-age=631138519 content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash d0f985ab775062db80c47dad0d2a5b98 x-transaction 007c63f800ca355a expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	BizibleAcct.js Show response cdn.bizible.com/	377 B 539 B	116ms 116ms	Script text/javascript	93.184.220.178 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/BizibleAcct.js?_biz_u=b702884374084993df510c193ca1e9b3&_biz_h=-1906410348&cdn_o=a&jsVer=4.20.02.21 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash dbe2c50477f20346029e4b51f65588f66336685376082838d1643fca10aded08 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:04 GMT content-encoding gzip x-aspnetmvc-version 5.2 server Microsoft-IIS/10.0 x-aspnet-version 4.0.30319 x-powered-by ASP.NET etag 21BFDFF9 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 318
GET H2	200	modules.4ad5fd5dd561559ff499.js Show response script.hotjar.com/	402 KB 70 KB	79ms 25ms	Script application/javascript	147.75.33.131 PACKET
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.4ad5fd5dd561559ff499.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-228809.js?sv=5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.33.131 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress7 Software / Resource Hash 37677b86486b332162c730ade618ef963c585a3dec12b6920572ec3d7ea780e6 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers date Mon, 09 Mar 2020 00:21:05 GMT content-encoding br content-type application/javascript age 217731 status 200 section-io-cache Hit content-length 71450 last-modified Fri, 06 Mar 2020 11:52:15 GMT etag "c6a970f0d34585ecab6d715df9977fd8" vary Accept-Encoding section-io-origin-status 200 access-control-allow-origin * cache-control max-age=31536000 section-io-origin-time-seconds 0.022 accept-ranges bytes section-io-id 82902f40958ecdaf50140346663527a4 section-origin-responded true
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/157/	9 KB 5 KB	33ms 33ms	Script application/x-javascript	184.30.221.218 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/157/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 184.30.221.218 , Netherlands, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a184-30-221-218.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 640a401ef807204873f6f29f1825bf7400035432bdfd51361edc487d17099df0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Mon, 09 Mar 2020 00:21:05 GMT Content-Encoding gzip Last-Modified Fri, 01 Nov 2019 01:52:19 GMT Server Apache ETag "8b51a976b2f24b5c747cd9dff2d593ed:1572573139" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4265 Expires Wed, 17 Jun 2020 00:21:05 GMT
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=15... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D8957%26url%3Dhttps%253A%252F%252Fsupport.alertlogic.com%252Fhc%252Fen-us%252Farti... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=15...	0 81 B	122ms 122ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=1583713265795&liSync=true Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 09 Mar 2020 00:21:06 GMT server Play linkedin-action 1 x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 0 x-li-uuid a4+SHNN6+hVw70jiqisAAA== Redirect headers date Mon, 09 Mar 2020 00:21:06 GMT x-content-type-options nosniff linkedin-action 1 status 302 strict-transport-security max-age=2592000 content-length 0 x-li-uuid 8H3IFtN6+hXAhohf4SoAAA== server Play pragma no-cache x-li-pop prod-tln1 expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=8957&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&time=1583713265795&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1017341980/	2 KB 2 KB	37ms 17ms	Script text/javascript	2a00:1450:4001:825::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1017341980/?random=1583713265810&cv=9&fst=1583713265810&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&tiba=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 64a43cd18c35818d0cf1873e6a1850a4340c2ded23a5923d8786dca75ce19fc7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT content-encoding gzip x-content-type-options nosniff content-type text/javascript; charset=UTF-8 server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1091 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	visitWebPage Show response 023-pwj-200.mktoresp.com/webevents/	2 B 304 B	638ms 212ms	XHR text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://023-pwj-200.mktoresp.com/webevents/visitWebPage?_mchNc=1583713265831&_mchCn=&_mchId=023-PWJ-200&_mchTk=_mch-alertlogic.com-1583713265830-51957&_mchHo=support.alertlogic.com&_mchPo=&_mchRu=%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&_mchPc=https%3A&_mchVr=157&_mchEcid=2D2BFE14571E4A8E7F000101%40AdobeOrg%3A6%3A51813954325541781652282061315971511965&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/157/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software akka-http/10.1.10 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Mon, 09 Mar 2020 00:21:06 GMT Content-Encoding gzip Server akka-http/10.1.10 Transfer-Encoding chunked X-Request-Id b3abff8f-78c5-46b8-81e7-f86aafceb887 Content-Type text/plain; charset=UTF-8
GET H2	200	box-469cf41adb11dc78be68c1ae7f9457a4.html vars.hotjar.com/ Frame 0A9A	0 0	78ms 26ms	Document text/html	147.75.33.131 PACKET
General Check archive.org Show headers Download Go to Full URL https://vars.hotjar.com/box-469cf41adb11dc78be68c1ae7f9457a4.html Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-228809.js?sv=5 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 147.75.33.131 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS pkt-ams-k2-shared-ingress7 Software / Resource Hash Request headers :method GET :authority vars.hotjar.com :scheme https :path /box-469cf41adb11dc78be68c1ae7f9457a4.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-dest iframe accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest iframe Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Response headers status 200 date Mon, 09 Mar 2020 00:21:05 GMT content-type text/html content-length 851 last-modified Wed, 29 Jan 2020 12:33:12 GMT etag "d594f1d4c3e5dbd6b556c60d34e0daea" cache-control max-age=31536000 content-encoding br section-io-origin-status 200 section-io-origin-time-seconds 0.031 section-origin-responded true age 3411886 vary Accept-Encoding section-io-cache Hit accept-ranges bytes section-io-id 1e13c3ad9462e60a02ef96bd4e9b9a90
GET H2	200	/ www.google.com/pagead/1p-user-list/1017341980/	42 B 167 B	22ms 21ms	Image image/gif	2a00:1450:4001:81f::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1017341980/?random=1583713265810&cv=9&fst=1583712000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&tiba=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&async=1&fmt=3&is_vtc=1&random=2473454504&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1017341980/	42 B 156 B	20ms 19ms	Image image/gif	2a00:1450:4001:81c::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1017341980/?random=1583713265810&cv=9&fst=1583712000000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&tiba=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&async=1&fmt=3&is_vtc=1&random=2473454504&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers pragma no-cache date Mon, 09 Mar 2020 00:21:05 GMT x-content-type-options nosniff content-type image/gif server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	u cdn.bizible.com/m/	43 B 124 B	18ms 17ms	Image image/gif	93.184.220.178 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=ecid&mapValue=2D2BFE14571E4A8E7F000101%40AdobeOrg_51813954325541781652282061315971511965&_biz_u=b702884374084993df510c193ca1e9b3&_biz_s=4ea224&_biz_l=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&_biz_t=1583713265757&_biz_i=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&_biz_n=1&rnd=269983&cdn_o=a&_biz_z=1583713265858 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.178 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (lcy/1D34) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-aspnet-version 4.0.30319 age 168998 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 content-length 43 pragma no-cache x-aspnetmvc-version 5.2 last-modified Sat, 07 Mar 2020 01:24:28 GMT server ECS (lcy/1D34) content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes expires -1
GET H2	200	u cdn.bizibly.com/	43 B 405 B	95ms 17ms	Image image/gif	93.184.220.42 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=b702884374084993df510c193ca1e9b3&_biz_s=4ea224&_biz_l=https%3A%2F%2Fsupport.alertlogic.com%2Fhc%2Fen-us%2Farticles%2F360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor&_biz_t=1583713265912&_biz_i=Windows%20Sticky%20Keys%2FUtilman%20Registry%20cmd.exe%20Backdoor%20%E2%80%93%20Alert%20Logic%20Support%20Center&rnd=339009&cdn_o=a&_biz_z=1583713265912 Requested by Host: support.alertlogic.com URL: https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Protocol H2 Security TLS 1.3, , AES_256_GCM Server 93.184.220.42 London, United Kingdom, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (lcy/1D26) / ASP.NET Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers date Mon, 09 Mar 2020 00:21:05 GMT x-aspnet-version 4.0.30319 age 338583 x-powered-by ASP.NET x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 content-length 43 pragma no-cache x-aspnetmvc-version 5.2 last-modified Thu, 05 Mar 2020 02:18:02 GMT server ECS (lcy/1D26) content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes expires -1
POST H/1.1	204 No Content	msreceiver Show response alertlogic.evergage.com/	0 200 B	101ms 101ms	XHR text/plain	34.237.171.3 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alertlogic.evergage.com/msreceiver?_r=382641 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.237.171.3 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-171-3.compute-1.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Access-Control-Allow-Origin https://support.alertlogic.com Date Mon, 09 Mar 2020 00:21:05 GMT Server Apache-Coyote/1.1 Connection keep-alive Timing-Allow-Origin *
POST H/1.1	204 No Content	pr Show response alertlogic.evergage.com/	0 200 B	101ms 101ms	XHR text/plain	34.237.171.3 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alertlogic.evergage.com/pr?_r=604141 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.237.171.3 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-171-3.compute-1.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Access-Control-Allow-Origin https://support.alertlogic.com Date Mon, 09 Mar 2020 00:21:06 GMT Server Apache-Coyote/1.1 Connection keep-alive Timing-Allow-Origin *
POST H/1.1	204 No Content	msreceiver Show response alertlogic.evergage.com/	0 200 B	101ms 100ms	XHR text/plain	34.237.171.3 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://alertlogic.evergage.com/msreceiver?_r=416271 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.237.171.3 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-237-171-3.compute-1.amazonaws.com Software Apache-Coyote/1.1 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://support.alertlogic.com/hc/en-us/articles/360007307931-Windows-Sticky-Keys-Utilman-Registry-cmd-exe-Backdoor Origin https://support.alertlogic.com Sec-Fetch-Dest empty User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Access-Control-Allow-Origin https://support.alertlogic.com Date Mon, 09 Mar 2020 00:21:08 GMT Server Apache-Coyote/1.1 Connection keep-alive Timing-Allow-Origin *
GET H2	200	fa-solid-900.woff2 pro.fontawesome.com/releases/v5.2.0/webfonts/	81 KB 81 KB	21ms 21ms	Font font/woff2	151.139.128.10 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.2.0/webfonts/fa-solid-900.woff2 Requested by Host: cdn.evgnet.com URL: https://cdn.evgnet.com/beacon/alertlogic/engage/scripts/evergage.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS Software / Resource Hash a007d9ddd44ab3e1dd643c487884c254d24fb30beeea1260eabe70153d018523 Request headers Referer https://pro.fontawesome.com/releases/v5.2.0/css/all.css Origin https://support.alertlogic.com Sec-Fetch-Dest font User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 09 Mar 2020 00:21:08 GMT last-modified Mon, 23 Jul 2018 17:25:06 GMT access-control-allow-origin * etag "3b944a15735413ab9c3c2bc0afb6fb46" vary Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding access-control-allow-methods GET content-type font/woff2 status 200 access-control-max-age 3000 cache-control max-age=31556926 accept-ranges bytes content-length 83144 x-hw 1583713268.cds088.lo4.hn,1583713268.cds085.lo4.c