www.securonix.com Open in urlscan Pro
141.193.213.20  Public Scan

21 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

• https://unpkg.com/web-vitals/dist/web-vitals.iife.js HTTP 302
• https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js

Request Chain 55

• https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js HTTP 302
• https://s.adroll.com/j/pre/index.js

Request Chain 60

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&tm=gtmv2&e_ipv6=AQLjaXa4UqYR1AAAAZJSiSgwLFDWLBre-uyg44PZ_m5SA9LyQXWWJJ_mizNUa18vp09WQgc

109 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Show response www.securonix.com/blog/	167 KB 28 KB	1657ms 1610ms	Document text/html	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / WP Engine Resource Hash a22b4782b8ae301c9bcd75ff16e42d89a3a87ef543c69dd161daa6638c06b24b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control max-age=600, must-revalidate cf-cache-status DYNAMIC cf-ray 8ccd396c8c7e9763-FRA content-encoding br content-type text/html; charset=UTF-8 date Thu, 03 Oct 2024 13:19:32 GMT link <https://www.securonix.com/wp-json/>; rel="https://api.w.org/" <https://www.securonix.com/wp-json/wp/v2/blog/20127>; rel="alternate"; title="JSON"; type="application/json" <https://www.securonix.com/?p=20127>; rel=shortlink permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() referrer-policy strict-origin-when-cross-origin server cloudflare strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache MISS x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options SAMEORIGIN x-powered-by WP Engine
GET H2	200	jquery.powertip.min.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	2 KB 524 B	26ms 23ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/jquery.powertip.min.css?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 814189be4de21d42597f62ffcc0ee1d28b6326d795bbad2e922952cad4dabab1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66da1c61-70d" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 05 Sep 2024 21:02:25 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb669763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	maps_points.css www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/	7 KB 2 KB	28ms 25ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/css/maps_points.css?ver=1.2.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash a55a1504046635db1567af44c96b2a820151041a3d384726e32dad566684d899 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fd8f31-1c2f" age 67540 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Wed, 02 Oct 2024 18:21:37 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb699763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	default.css www.securonix.com/wp-content/plugins/tablepress/css/build/	6 KB 2 KB	96ms 93ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress/css/build/default.css?ver=2.4.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 515c6aeb5bbc4d469db65515d4ddaf33154927aeee13b2637239343c097ccab8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66e49b7b-17fe" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Fri, 13 Sep 2024 20:07:23 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb6c9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	tablepress-responsive.min.css www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/	9 KB 1 KB	78ms 75ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/tablepress-responsive-tables/css/tablepress-responsive.min.css?ver=1.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 27e54854af25b175f482f4acc3c32a5dfd363ae62292e66b9212764d323af2db Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66334865-22aa" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 02 May 2024 08:01:41 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb6f9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	addtoany.min.css www.securonix.com/wp-content/plugins/add-to-any/	2 KB 598 B	95ms 93ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66aab13e-644" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Wed, 31 Jul 2024 21:48:46 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb709763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	css2 fonts.googleapis.com/	2 KB 932 B	47ms 18ms	Stylesheet text/css	2a00:1450:4001:806::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 09ba5df6e121c4577cac7addaca7ab9f189e8c1afd745652396b05f8e45baf0a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:32 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css; charset=utf-8 last-modified Thu, 03 Oct 2024 13:19:32 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H3	200	select2.min.css cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/	15 KB 2 KB	50ms 24ms	Stylesheet text/css	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/select2/4.1.0-beta.1/css/select2.min.css?ver=1.2.58 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 907f4395f54e25a1da1181672f1a498e98b26f7bfc6dcb6c209a737472451e49 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5ecc8659-3dcf" age 111789 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AeyZ0hoC0Qm2vkg12xHVAOaABkn0iBq0oj7E0qxOuYX6SeY%2BfxHjjjkSmkjRGzHP2qXvPQZ4GnuunUHyC8VIQgYrRX83gnM6SAynHjgnhe2mCwZNQNQRaRsfoWEko1hywlQWDGr"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Tue, 23 Sep 2025 13:19:32 GMT date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css; charset=utf-8 last-modified Tue, 26 May 2020 03:00:41 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8ccd3976e8201c38-FRA accept-ranges bytes access-control-allow-origin * content-length 1676 server cloudflare
GET H2	200	single-common.css www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/	21 KB 4 KB	33ms 31ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/single-common.css?ver=1.2.58 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 9f841581ffe22a4cbefabfed9e15456d709300e5697d6f6e2d97141ae48d6cbb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fc5dbb-55ef" age 146070 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Tue, 01 Oct 2024 20:38:19 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb719763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66fc5e0697fa8.css www.securonix.com/wp-content/uploads/dynamic_avia/	130 KB 22 KB	34ms 33ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-merged-styles-94efa23150892c40c49b4533e9e1e1bc---66fc5e0697fa8.css Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 9f83ac4e3a99ff0d0321131306b32423e82c05e2909192b97f63f9a5b9384f44 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fc5e06-206c8" age 145604 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Tue, 01 Oct 2024 20:39:34 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb729763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H3	200	page.js Show response static.addtoany.com/menu/	3 KB 2 KB	35ms 19ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/page.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ebe2359f7106a99a4d5f17f482ca7efe495dcc7090fb121f56f8cf0055d562e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br cf-bgj minify etag W/"b57737a151d7fd411c90e2eb8cdb171e" age 24146 cf-cache-status HIT report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jrUU31gFFV4B5OWiaQbzX0TYZV8NWTgyShjL7KSkXI7qrkXA6w7lHxuDggH2PSDS%2FzK8ZNceRhJJ%2FCOHGiwfDvGtlhHu4J%2BFVIA%2FnErl2tWLjGXOMaF8n%2FYX9CL32SJpdJzMCOfx"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400, stale-while-revalidate=30, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39778fe1d265-FRA access-control-allow-origin * server cloudflare
GET H2	200	jquery.min.js Show response www.securonix.com/wp-includes/js/jquery/	86 KB 31 KB	66ms 64ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"64ecd5ef-15601" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Mon, 28 Aug 2023 17:14:23 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb739763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	jquery-migrate.min.js Show response www.securonix.com/wp-includes/js/jquery/	13 KB 5 KB	86ms 84ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"6482bd64-3509" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Fri, 09 Jun 2023 05:49:24 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb749763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	addtoany.min.js Show response www.securonix.com/wp-content/plugins/add-to-any/	129 B 197 B	136ms 134ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66aab13e-81" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding last-modified Wed, 31 Jul 2024 21:48:46 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39777c679763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	Securonix-logo.webp www.securonix.com/wp-content/uploads/2024/04/	14 KB 14 KB	75ms 74ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo.webp Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2bf92d09ea70e1745242a22e86adb8088bc17c61a744c2f3d984601f6bd4e423 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-cache-status HIT etag "6633485a-3870" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type image/webp last-modified Thu, 02 May 2024 08:01:30 GMT vary Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976bb759763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 14448 server cloudflare
GET H2	200	hero-coverage-advisory-okta-breach-1440x227-1.png www.securonix.com/wp-content/uploads/2022/03/	4 KB 4 KB	93ms 91ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2022/03/hero-coverage-advisory-okta-breach-1440x227-1.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d44eefafcf28bcb6cd3b0645864bdd8ef36f06a5d2390f3cec1b3b026f0ece9a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-bgj imgq:100,h2pri etag "6633485f-2aa4" age 105243 cf-cache-status HIT x-content-type-options nosniff cf-polished origFmt=png, origSize=10916 date Thu, 03 Oct 2024 13:19:32 GMT content-type image/webp content-disposition inline; filename="hero-coverage-advisory-okta-breach-1440x227-1.webp" vary Accept last-modified Thu, 02 May 2024 08:01:35 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976cb7a9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 3586 server cloudflare
GET H2	200	jquery.powertip.min.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	11 KB 4 KB	85ms 84ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/jquery.powertip.min.js?ver=1.2.0 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 80b41604ed76eb37787a40ba315a3af3a5c83b3bce68e39037deb9202582abc8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66da1c61-2ae5" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 05 Sep 2024 21:02:25 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3976cb7b9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	maps_points.js Show response www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/	996 B 560 B	25ms 25ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/devvn-image-hotspot/frontend/js/maps_points.js?ver=1.2.8 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 63a96f9cfd4742a3c061e96dd849083e4fcc8c62cf5aaf98503a4f2ba34e9a6c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fd8f31-3e4" age 67541 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Wed, 02 Oct 2024 18:21:37 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39775c409763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	new-tab.js Show response www.securonix.com/wp-content/plugins/page-links-to/dist/	34 KB 13 KB	30ms 29ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/page-links-to/dist/new-tab.js?ver=3.3.7 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6dceecf8eaa03968e40b767206be8a36a13d7444557fced227454ae4f100e5c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66334868-8687" age 146228 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 02 May 2024 08:01:44 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39775c439763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	smush-lazy-load.min.js Show response www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/	8 KB 4 KB	27ms 26ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.16.6 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 807419d5f60f78d0c2d04b0bf5e3f80410fe7ffaa2bfee30646e4c6f47838b4f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66da1c3a-2016" age 146228 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 05 Sep 2024 21:01:46 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39776c5c9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	dropdown.js Show response www.securonix.com/wp-content/plugins/gtranslate/js/	13 KB 4 KB	28ms 26ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/plugins/gtranslate/js/dropdown.js?ver=6.6.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3fcc408630bdf993595abbcc2a7ace8a55058dd7a3107236a68cd76a690e1ae9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fd8f31-326d" age 65977 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Wed, 02 Oct 2024 18:21:37 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39777c699763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---66fc5e0755f8b.js Show response www.securonix.com/wp-content/uploads/dynamic_avia/	12 KB 3 KB	32ms 29ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/dynamic_avia/avia-footer-scripts-580cdc29960fb4a0f1ab0c8168a4daf0---66fc5e0755f8b.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash b0ebb3b6ada96f146ecd30e306c06b52413d015437b658fe57581a50133ad24b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66fc5e07-31a1" age 146070 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Tue, 01 Oct 2024 20:39:35 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39777c639763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET		6bfddcad-0daa-4a63-a122-73c4d2549d77 https://www.securonix.com/ Frame	0 0
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	25 KB 9 KB	43ms 17ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=915442&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&vn=2.1&x=true Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra3 / Resource Hash 6e34791a162d1ca4dd4f49965fb37a467cfc42b32984b6cb5171d72890a91953 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control public, max-age=0, no-cache, must-revalidate timing-allow-origin * content-encoding gzip access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.securonix.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding server gfra3
GET H3	200	worker-6d1d3402798a97502f58574ce4f177f8br.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	262 KB 63 KB	23ms 8ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-6d1d3402798a97502f58574ce4f177f8br.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash f1233eeb6e0d16acfcd70fa10fed1b48a2d1390db28d02773d66cfb13b66d211 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=a3TDhw==, md5=65lN/UMsfAp0nRreqSHxGA== etag "eb994dfd432c7c0a749d1adea921f118" age 6247 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 64936 date Thu, 03 Oct 2024 11:35:26 GMT last-modified Thu, 03 Oct 2024 09:38:28 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AD-8ljs6o_hUkWjhkKWm8WV81Q9lQnS6RH9_mja_F1O3DmUG4r4K5Qiz1BzSPwRFtqClr0DPcQ cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1727948308466535 content-length 64936 content-language en server UploadServer
GET H3	200	va_gq-408c889168c11cff1c56051445206cafbr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	271 KB 70 KB	24ms 9ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-408c889168c11cff1c56051445206cafbr.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 56191343a87d944aaea26791d1799d069f00b8f3f13838947cfceae42e73d7e9 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=nLnz0w==, md5=SVQuXl32ZFPrbiTSbPPRNA== etag "49542e5e5df66453eb6e24d26cf3d134" age 1616 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 72052 date Thu, 03 Oct 2024 12:52:37 GMT last-modified Thu, 03 Oct 2024 12:00:22 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AD-8ljum-7hILLhA1YTWTG3Idwnlh-Mc6Es3J9MqE6rScqnN2tsJHoPUD7nQ6_ui_63KYnbknQQ cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1727956822218362 content-length 72052 content-language en server UploadServer
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 146 B	104ms 103ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=915442&d=securonix.com&u=D3C71D48CF25865693DCBB261536CBCA1&h=73e7670e51ffe12b9dc9ea7708c6c6cf&t=false Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control public, max-age=43200 x-content-type-options nosniff via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/gif server gnv01c
GET H2	200	gtm.js Show response www.googletagmanager.com/	336 KB 112 KB	70ms 32ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 86d5a5f5c8e38410ff5a9c0754a707566b8ce7c48e2a725cfd02321fd69dc587 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Thu, 03 Oct 2024 13:19:33 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 03 Oct 2024 12:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 113500 x-xss-protection 0 server Google Tag Manager
GET H3	200	QGYsz_wNahGAdqQ43Rh_fKDp.woff2 fonts.gstatic.com/s/worksans/v19/	49 KB 50 KB	23ms 7ms	Font font/woff2	142.250.185.163 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/worksans/v19/QGYsz_wNahGAdqQ43Rh_fKDp.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Work+Sans:ital,wght@0,300..700;1,300..700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.163 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s51-in-f3.1e100.net Software sffe / Resource Hash 6912f7388531e949bd5406b5668cd6b55fea4cc7e2d123dbaed489054dd98438 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://fonts.googleapis.com/ Response headers age 190019 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Wed, 01 Oct 2025 08:32:34 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 01 Oct 2024 08:32:34 GMT last-modified Thu, 14 Sep 2023 01:13:52 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 50668 x-xss-protection 0 server sffe
GET H2	200	securonix-icons.woff2 www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/	13 KB 13 KB	73ms 72ms	Font font/woff2	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/avia_fonts/securonix-icons/securonix-icons.woff2?ver=1.2.58 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d137bc7b7127aaf5d686f13af5fefc562b4bf4d92cb4b0365171530fdfa9465c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-cache-status HIT etag "66621328-32b8" age 146228 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type font/woff2 last-modified Thu, 06 Jun 2024 19:51:04 GMT vary Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3977dce89763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 12984 server cloudflare
GET H2	200	fa-fontello.woff2 www.securonix.com/wp-content/themes/punch/assets/fonts/	5 KB 5 KB	39ms 38ms	Font font/woff2	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/punch/assets/fonts/fa-fontello.woff2?ver=1.2.58 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 6e67d703e0c13b20be535d048fac3610238856ddda14cfb9cb5aa8c4a77486b1 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-cache-status HIT etag "66334863-121c" age 146228 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type font/woff2 last-modified Thu, 02 May 2024 08:01:39 GMT vary Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3977dceb9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 4636 server cloudflare
GET DATA	200 OK	truncated /	37 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type image/gif
GET H2	200	Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.png www.securonix.com/wp-content/uploads/2024/04/	98 KB 99 KB	28ms 27ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 70d874aaef4d2cdd3b25081afc3a7311d6163d7903467c374cfad24c60b7d8bd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-bgj imgq:100,h2pri etag "66ba6e88-24839" age 144424 cf-cache-status HIT x-content-type-options nosniff cf-polished origFmt=png, origSize=149561 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/webp content-disposition inline; filename="Securonix-EON-Data-Sheet-Featured-Image-%E2%80%93-1.webp" vary Accept last-modified Mon, 12 Aug 2024 20:20:24 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3977dcf19763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 100686 server cloudflare
GET H2	200	644157ce42f0d.png www.securonix.com/wp-content/uploads/2023/04/	432 KB 433 KB	261ms 260ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/04/644157ce42f0d.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2de9891d573e32a6af24287b75d5cb6c09974840b9f9bd55e242b3c07b5f2331 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-bgj imgq:100,h2pri etag "6633485c-87855" cf-cache-status HIT x-content-type-options nosniff cf-polished origFmt=png, origSize=555093 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/webp content-disposition inline; filename="644157ce42f0d.webp" vary Accept last-modified Thu, 02 May 2024 08:01:32 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3977dcf29763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 442266 server cloudflare
GET H2	200	6441580b33d7d.png www.securonix.com/wp-content/uploads/2023/04/	607 KB 608 KB	290ms 290ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2023/04/6441580b33d7d.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash c6a5868274305da81e21e17438428d9d708c20411f5c1eaa8e132bebf4377ec0 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-bgj imgq:100,h2pri etag "6633485c-ad70c" cf-cache-status HIT x-content-type-options nosniff cf-polished origFmt=png, origSize=710412 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/webp content-disposition inline; filename="6441580b33d7d.webp" vary Accept last-modified Thu, 02 May 2024 08:01:32 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3977dcf39763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 621908 server cloudflare
GET		7933de2e-541d-44e8-9a36-907ae3395b08 https://www.securonix.com/ Frame	0 0
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	97ms 96ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=915442&u=D3C71D48CF25865693DCBB261536CBCA1&s=1727961572&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1727961573138%2C%22tO%22%3A-2%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1727961572146&v=ae9ca0095 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/gif server gnv01c
GET H2	200	body.css www.securonix.com/wp-content/themes/punch/assets/css/	6 KB 1 KB	29ms 29ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/punch/assets/css/body.css?v=1.0.94 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 585855ece0f56ae59cf584f5068fc0b2f0742d9e55d6b1ef79b6e54916afbe5e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66334863-160c" age 146226 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 02 May 2024 08:01:39 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3978de339763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	ecef1e1d-da84-47a8-9b0f-cd1203fb284a.js Show response j.6sc.co/j/	5 KB 5 KB	521ms 496ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/ecef1e1d-da84-47a8-9b0f-cd1203fb284a.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 6bf4b704aeaf53e261ae34a4f8c870a375c31bea1cafb2bc016f8cd592d3b565 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-amz-server-side-encryption AES256 content-type application/javascript cache-control private, max-age=1800 x-amz-version-id T0WUScV009kIdR1nm2gAPdAo1RR77NlX etag "93c8d61fdb478a961fc42ae75ac0df23" expires Thu, 03 Oct 2024 13:49:33 GMT accept-ranges bytes content-length 4761 x-amz-cf-id ry99V4EbSqSxNeo7H79-YMEa91-0q5tCDJfUnV55cYPbY4EOFNBZ6g== date Thu, 03 Oct 2024 13:19:33 GMT last-modified Wed, 07 Aug 2024 17:45:09 GMT vary Accept-Encoding server AmazonS3 x-amz-cf-pop FRA60-P8 x-amz-meta-content-type application/json
GET H2	200	base.js Show response embed.formhq.net/v1/	6 KB 3 KB	50ms 18ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/base.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d7495655518a178afcfca8f950660f990e6169eb01960dd2bc8c9a19fd533557 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br cf-bgj minify etag W/"63612f3e-18f1" age 473 cf-cache-status HIT report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=npH8HHFpCWHxV2BYFY8mvBI3lFji9U%2Bs4A%2FmSEjsCSGcJQ1Whpq4vp1D5XyTPEZ9%2FJb0x6UxzZeDmKfphUNLFOg44aN2LRklFFlk9veK6u0kTpdkEH359JKYZNTQGU3Z7PKYfXf1YgbmmbaFO%2FT5"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff cf-polished origSize=6385 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 last-modified Tue, 01 Nov 2022 14:37:50 GMT vary Accept-Encoding x-frame-options SAMEORIGIN cache-control max-age=1800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ccd39791b07d9cf-FRA x-xss-protection 1; mode=block server cloudflare
GET H2	200	js Show response www.googletagmanager.com/gtag/	289 KB 99 KB	25ms 25ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 16ae7bd6e0664f7e4cad16db3cbba15104c7b53dd24eac48dc3479844e24937f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Thu, 03 Oct 2024 13:19:33 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 101537 x-xss-protection 0 server Google Tag Manager
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	29ms 8ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3a600a8b86e938acf4c39f392719678cbeee228d2ee698fbf3f310e99db4347a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "66f5de53-111c3" x-content-type-options nosniff expires Thu, 03 Oct 2024 16:19:33 GMT accept-ranges bytes content-length 18820 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 26 Sep 2024 22:21:07 GMT
GET H2	200	attributor.min.js Show response cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/	7 KB 3 KB	32ms 10ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/derekcavaliero/attributor@latest/dist/attributor.min.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 435c1051149272e940e0bfbda1b4e09662f4408e658aa0ee899177819c9b8008 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1da1-KfePJ46ikK9jPpNwOZncE3ivfdg" age 42352 x-content-type-options nosniff x-jsd-version-type branch alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230156-FRA vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 2823 x-jsd-version master
GET H2	200	destination Show response www.googletagmanager.com/gtag/	273 KB 94 KB	26ms 26ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-1004449086&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 92d39559a31b9e18e6e85d81977bc1aba1e82287d13012d5802bb6245cd04892 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Thu, 03 Oct 2024 13:19:33 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Thu, 03 Oct 2024 12:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 96088 x-xss-protection 0 server Google Tag Manager
GET H2	200	bat.js Show response bat.bing.com/	49 KB 15 KB	61ms 29ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 73aaa4e6bfc1dbed5f3f934710d1ada545f4068742235e59d0cb74f0eaf0a3c4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "803483b3aaadb1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 6832AE1695D144C0AD1D5A8A4131BEFA Ref B: FRAEDGE1612 Ref C: 2024-10-03T13:19:33Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14402 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript last-modified Thu, 19 Sep 2024 15:43:41 GMT vary Accept-Encoding
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	45ms 14ms	Script application/javascript	2a02:26f0:3500:10::210:a9a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a9a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=20229 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Thu, 03 Oct 2024 13:19:33 GMT last-modified Thu, 22 Aug 2024 10:43:55 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	88 KB 28 KB	40ms 8ms	Script text/javascript	2600:9000:2644:ac00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:ac00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 0641409d1c3cdd9d398534537a3e3d0e158460b7c1e4238cbcd3f14d401a4896 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers Access-Control-Max-Age 600 Content-Encoding gzip X-Amz-Version-Id .Fua6NBvbeFgt3YS8TrI.AAUhGMnBc.Y Etag W/"134913a92e99352a5bf756fefc528ffc" Age 992 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id TaH_Nr9r1k8J4q8nzY7IZwG5dNNA7dBm2rrDj8OrwL-yR9anB4qAuQ== Date Thu, 03 Oct 2024 13:03:02 GMT Content-Type text/javascript Vary Accept-Encoding Last-Modified Mon, 30 Sep 2024 15:57:53 GMT Access-Control-Allow-Headers * Transfer-Encoding chunked Cache-Control max-age=3600, must-revalidate Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Access-Control-Allow-Origin * X-Amz-Cf-Pop FRA60-P6 Server AmazonS3 X-Amz-Server-Side-Encryption AES256
GET H2	200	web-vitals.iife.js Show response unpkg.com/web-vitals@4.2.3/dist/ Redirect Chain https://unpkg.com/web-vitals/dist/web-vitals.iife.js https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js	7 KB 3 KB	23ms 23ms	Script application/javascript	2606:4700::6811:f5cb CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://unpkg.com/web-vitals@4.2.3/dist/web-vitals.iife.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Server 2606:4700::6811:f5cb , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e6b3272816c9b6efeb0b3ccc16326c123d9860f38d7c7c4fc215334559996e2 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br cf-cache-status HIT etag "1c28-4f+2/GWZhXlozjo2GiBA+7VB9Ow" age 200646 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 last-modified Sat, 26 Oct 1985 08:15:00 GMT fly-request-id 01J93972KYYHR48ZP01B52WFV6-fra vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000 via 1.1 fly.io cf-ray 8ccd39794cb4d9dc-FRA access-control-allow-origin * server cloudflare Redirect headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, s-maxage=600, max-age=60 location /web-vitals@4.2.3/dist/web-vitals.iife.js content-encoding br cf-cache-status HIT age 332 x-content-type-options nosniff via 1.1 fly.io cf-ray 8ccd39792c10d9dc-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type text/plain; charset=utf-8 vary Accept, Accept-Encoding fly-request-id 01J99885DFW41R7YFNF7XW1ZDD-fra server cloudflare
GET H2	200	o4omknd0z9 Show response www.clarity.ms/tag/	501 B 758 B	233ms 191ms	Script application/x-javascript	2620:1ec:bdf::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/tag/o4omknd0z9?ref=gtm Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-N56FZ8X Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 2650c8661da13c8225df7c9f901411ede8c3302449ac46d0dde2aee326b4bd8b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control no-cache, no-store request-context appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8 expires -1 accept-ranges bytes x-cache CONFIG_NOCACHE content-length 501 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/x-javascript x-azure-ref 20241003T131933Z-176d4fdd79chrddt35yyuwybzg0000000n4000000000z7yx
GET H2	200	r32rm8p2zmht.js Show response js.driftt.com/include/1727961600000/	221 KB 62 KB	359ms 315ms	Script application/javascript	18.245.86.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/include/1727961600000/r32rm8p2zmht.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-77.fra60.r.cloudfront.net Software istio-envoy / Resource Hash 635c69243b34e95bb6c714cb6c43815c7b4c50d0e2ef76354df4cb2b4a1325af Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding gzip x-amz-version-id niaeQgibZo8hMzsw.EaO8mU9srmtoti3 etag W/"f832ffabf78fe78b7d496fd5029e9a5a" access-control-allow-methods GET, POST, OPTIONS x-cache RefreshHit from cloudfront x-amz-cf-id TRdB6zK4gjJT3H2EoJ9d52li5FdulvsLgNBCbFYzst4t7eI5qEPuaw== date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding last-modified Tue, 24 Sep 2024 17:33:41 GMT access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains cache-control no-cache x-envoy-upstream-service-time 35 access-control-allow-credentials true via 1.1 9d1f21fface75767578955e1853e754e.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA60-P6 server istio-envoy x-amz-server-side-encryption AES256
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/	9 KB 3 KB	70ms 69ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/settings.js?a=915442&settings_type=1&vn=&eventArch=1&uuid=&tS=1&ec=1438131&exc=2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra3 / Resource Hash 69d0f422be2de3ba5a055368960596e59983bf95002fbcb1f6a447a080875a25 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control public, max-age=0, no-cache, must-revalidate content-encoding gzip etag W/"1727959956_EA" via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript; charset=UTF-8 server gfra3
GET H2	200	body.css www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/	34 KB 7 KB	25ms 25ms	Stylesheet text/css	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.58 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e34679d8497bb8cbfd3211d8856a2140373ea8f9e53a8325be8026b15d35aa3d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"66f6d958-897a" age 146067 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Fri, 27 Sep 2024 16:12:08 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39792eab9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H2	200	bWFya2V0bw.js Show response embed.formhq.net/v1/platforms/	422 B 573 B	20ms 20ms	Script application/javascript	2606:4700:3108::ac42:283b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://embed.formhq.net/v1/platforms/bWFya2V0bw.js Requested by Host: embed.formhq.net URL: https://embed.formhq.net/v1/base.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3108::ac42:283b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8737f50e2aa546ff4baeb4492fdd334a75dfc93e292aba2ab7a45a8c3a73e4c4 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br cf-bgj minify etag W/"62e92e06-1a7" age 1517 cf-cache-status HIT report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4IpDHwakLALtmJbUi1wxGOWaNz8E3WBYVaooMY6ucDuYcH89Q1aGSzVsb%2BM0aDfZv2tWrpPwOV%2FJnJKfDYboZ0nJ73JQUwUPeOHWH5Q6xrKn9fAxIUP5OqavyiIrsM66quSJOoqwMDjrZOYFnsM"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff cf-polished origSize=423 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 last-modified Tue, 02 Aug 2022 14:00:38 GMT vary Accept-Encoding x-frame-options SAMEORIGIN cache-control max-age=1800 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8ccd39793b9dd9cf-FRA x-xss-protection 1; mode=block server cloudflare
POST H2	204	collect region1.analytics.google.com/g/	0 0	47ms 15ms	Fetch text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-JPYDLXGD3Q&gtm=45je4a10v891181397za200&_p=1727961573.332&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101671035~101747727&cid=1378366761.1727961573&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&cu=USD&dl=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&sid=1727961573&sct=1&seg=0&dt=Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2099 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.securonix.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 556 B	75ms 23ms	Ping text/plain	2a00:1450:400c:c0d::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-JPYDLXGD3Q&cid=1378366761.1727961573&gtm=45je4a10v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101671035~101747727 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-JPYDLXGD3Q&l=improvedGA4dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0d::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.securonix.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/plain server Golfe2
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	58ms 42ms	Image image/gif	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-JPYDLXGD3Q&cid=1378366761.1727961573&gtm=45je4a10v891181397za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101671035~101747727&tag_exp=101671035~101747727&z=1530657297 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Thu, 03 Oct 2024 13:19:33 GMT x-xss-protection 0 content-type image/gif server cafe
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/ Redirect Chain https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/fpconsent.js https://s.adroll.com/j/pre/index.js	0 756 B	9ms 9ms	Script application/javascript	2600:9000:2644:ac00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/index.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol HTTP/1.1 Server 2600:9000:2644:ac00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers Access-Control-Max-Age 600 X-Amz-Version-Id nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy Etag "d41d8cd98f00b204e9800998ecf8427e" Age 31083 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id MC_iZXI7Y9sOWl2FFZPtk1VnGYN8cEVj2Z5b9H8v-tf2f2V0DDEMcQ== Date Thu, 03 Oct 2024 04:41:31 GMT Content-Type application/javascript Vary Accept-Encoding Last-Modified Wed, 15 Jan 2020 23:54:18 GMT Access-Control-Allow-Headers * Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Accept-Ranges bytes Access-Control-Allow-Origin * Content-Length 0 X-Amz-Cf-Pop FRA60-P6 Server AmazonS3 X-Amz-Server-Side-Encryption AES256 Redirect headers Access-Control-Max-Age 600 Age 29253 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id JaEnmj5mSacQubWfdwpvJRzqrrO2GGBNcBkdQ9AgP7VeR8vuih_TJA== Date Thu, 03 Oct 2024 05:11:59 GMT Content-Type application/xml Access-Control-Allow-Headers * Location https://s.adroll.com/j/pre/index.js Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Access-Control-Allow-Origin * Content-Length 0 X-Amz-Cf-Pop FRA60-P6 Server AmazonS3
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/	9 KB 4 KB	25ms 10ms	Script text/javascript	2600:9000:2644:ac00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/pre/VJKZ2AZ6BRDQFPNHOW6CAP/4OKRMX7MDFHPZJ45XTA2IN/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:ac00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 9a7616157191cea33870e61c8f37b9842c4a63088c5821eeee34e570679e904f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers Access-Control-Max-Age 600 Content-Encoding gzip X-Amz-Version-Id Wjy4uMdKnXiJxH_i_94et_G_EcjqvzRn Etag W/"706be4fd28aeb971d2ff83a528c2073a" Age 328 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id e73xikGMdPHk2vwAFPyymFY8goDd7TClD4y-FL3iduRPaskDEko3GQ== Date Thu, 03 Oct 2024 13:18:53 GMT Content-Type text/javascript; charset=utf-8 Vary Accept-Encoding Last-Modified Wed, 02 Oct 2024 22:08:56 GMT Access-Control-Allow-Headers * Transfer-Encoding chunked Cache-Control max-age=3600, must-revalidate Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Access-Control-Allow-Origin * X-Amz-Cf-Pop FRA60-P6 Server AmazonS3 X-Amz-Server-Side-Encryption AES256
GET H2	200	loading.svg www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/svg/	713 B 490 B	27ms 27ms	Image image/svg+xml	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/img/svg/loading.svg Requested by Host: www.securonix.com URL: https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.58 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 861f97da530c1a839539852f52b211b44a6cf9af4ae389bffc0d53920640c2fc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/wp-content/themes/securonix-hybrid/assets/css/body.css?v=1.2.58 Response headers content-encoding br cf-cache-status HIT etag W/"6634030b-2c9" age 32 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 02 May 2024 21:18:03 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39797ef79763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 621 B	174ms 153ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: F5866B468D264955AD089AB90FEE800B Ref B: FRAEDGE1213 Ref C: 2024-10-03T13:19:33Z x-li-fabric prod-ltx1 access-control-allow-credentials true x-li-uuid AAYjkmfFPFGw1UuhV7atNQ== x-li-proto http/2 access-control-allow-origin https://www.securonix.com x-cache CONFIG_NOCACHE date Thu, 03 Oct 2024 13:19:33 GMT vary Origin
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 816 B	128ms 113ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept * Referer https://www.securonix.com/ Response headers x-li-pop afd-prod-lva1-x content-encoding gzip x-fs-uuid 0006239267c5293931d7e395448e09a8 x-msedge-ref Ref A: 904CE189BEAE4D83877643683E847CCF Ref B: FRAEDGE1115 Ref C: 2024-10-03T13:19:33Z x-li-fabric prod-lva1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYjkmfFKTkx1+OVRI4JqA== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Thu, 03 Oct 2024 13:19:32 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-mod... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-mo...	0 265 B	134ms 104ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&tm=gtmv2&e_ipv6=AQLjaXa4UqYR1AAAAZJSiSgwLFDWLBre-uyg44PZ_m5SA9LyQXWWJJ_mizNUa18vp09WQgc Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: CEE8CDFD858F43F689A231122A8A6423 Ref B: FRAEDGE1513 Ref C: 2024-10-03T13:19:33Z x-li-fabric prod-lva1 x-li-uuid AAYjkmfG9P4lDBVB5YpZUQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Thu, 03 Oct 2024 13:19:32 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lva1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=61924&time=1727961573372&url=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&tm=gtmv2&e_ipv6=AQLjaXa4UqYR1AAAAZJSiSgwLFDWLBre-uyg44PZ_m5SA9LyQXWWJJ_mizNUa18vp09WQgc x-msedge-ref Ref A: 7F63CCC18C5843DE8EA244F11A7A97FA Ref B: FRAEDGE1213 Ref C: 2024-10-03T13:19:33Z x-li-fabric prod-lva1 x-li-uuid AAYjkmfE42u3VTbq6xXIMg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Thu, 03 Oct 2024 13:19:33 GMT
GET H3	200	sm.25.html static.addtoany.com/menu/ Frame AE4D	0 0	38ms 30ms	Document text/html	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/sm.25.html Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-origin * age 24146 cache-control max-age=315360000, immutable cf-cache-status HIT cf-ray 8ccd3979babf901e-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 03 Oct 2024 13:19:33 GMT last-modified Thu, 03 Oct 2024 06:37:07 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B2ssBKTyp1it6vKj2URZrlfQ9mse0Dh2FykXSvHfhLDhqPXEprdODAdObzr1on8kWA2aYQ2l22w2f%2FSeT2ATolv8g4hIvjDyUco%2B0IaPV%2BeIyyc8VEYjVBKMBiSJr3UmlON2wS%2FP"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-content-type-options nosniff
GET H3	200	core.D0Uc7kY6.js Show response static.addtoany.com/menu/modules/	70 KB 26 KB	48ms 38ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/page.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d07ac60d7d494f8688e4844d51b988f6a2f95b5e9435880e628eb8966e091382 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://www.securonix.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=315360000, immutable nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED etag W/"6fea96ea56ee4fff557b8776f9c8c3a6" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cglTfYevz0pelRzL%2Fownh7StCK07NVlbb4Hi8HOqS%2BEUT5mxnn8I2tKsgyYlaysRGtqYozbI1qBOuTBD91%2FIpxk5Vj1RaR22O0wjemyGoE7h4T8thJRYh%2Bx%2BwX3%2Foct4Xy9tbZJj"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979a9e3dbc8-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server cloudflare
GET H2	200	wp-emoji-release.min.js Show response www.securonix.com/wp-includes/js/	18 KB 5 KB	67ms 64ms	Script application/javascript	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-includes/js/wp-emoji-release.min.js?ver=6.6.2 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding br cf-cache-status HIT etag W/"667d6e6f-4926" age 64032 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding last-modified Thu, 27 Jun 2024 13:51:43 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979bf4a9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() access-control-allow-origin * server cloudflare
GET H3	200	nc-2f451653cdc750b821c88867ff757cfbbr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	17 KB 5 KB	8ms 8ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-2f451653cdc750b821c88867ff757cfbbr.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash efbd2227c1306d9ab01b6b6d05a02cda2c76c921e0391cd6ce3b0397fdcf6e17 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=YJwQhA==, md5=nVyAqmIEZaWUCProh9oobw== etag "9d5c80aa620465a59408fae887da286f" age 1616 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 5568 date Thu, 03 Oct 2024 12:52:37 GMT last-modified Thu, 03 Oct 2024 12:01:24 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AD-8ljvD2iqQCj-txU_Wjxyq8l9b4tqhdApahKA8_13t13HXt8Ms4g-8hreuUaodO3P1rY0eZ3M cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1727956884348687 content-length 5568 content-language en server UploadServer
GET H2	200	27010718.js Show response bat.bing.com/p/action/	369 B 424 B	31ms 30ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/27010718.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 1436939ed29c528098b948903ff835b1f1066a45afc277c43053a25964d1761c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 9F315A5FFDE64BA0A560F3FF6D384F61 Ref B: FRAEDGE1612 Ref C: 2024-10-03T13:19:33Z x-cache CONFIG_NOCACHE date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
GET H3	200	de.js Show response static.addtoany.com/menu/locale/	750 B 1005 B	19ms 19ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/locale/de.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e26044e4f60fab991ddde9378091a990f77cad49dadf8d6b4bd96c632428546c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-encoding br cf-bgj minify etag W/"86610d84a116a5704d658324728b063f" age 24145 cf-cache-status HIT report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nSxKrh6qChbhyDjpg05W%2Fl243qS2FiNh823iwh2mmBzNWHJhuV0X3lLdwG1%2Bwv2mTnxuRnF6HA4sLjI07pRfB7TOgwXFHhGWZIsOBdKzMt2NgZNr686Uh5%2FFP8iWXYhfokOORfFq"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff cf-polished origSize=902 alt-svc h3=":443"; ma=86400 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cache-control max-age=86400, stale-while-revalidate=30, public referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979f8b1d265-FRA access-control-allow-origin * server cloudflare
GET H3	200	linkedin.js Show response static.addtoany.com/menu/svg/icons/	435 B 798 B	48ms 48ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/linkedin.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ce5dbb2cdb85126fdc9d774971a56f8848dbee977a382bd512a5f8b49ea8c727 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=7776000, stale-while-revalidate=30, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED etag W/"00b1b78053ab07c79bfea2e5a1db9d70" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BYN5OtCdJE%2FLcSRqBiNsX%2FSMBcYPz69XLFfHP5NYwMSmAtE2EknWtx2D4N%2Fh2968ebjxpSyawN2jg%2BI7vd8NzRGDTjWYd6ceuqsUqeZ6j0s%2FBcLFksN8u0WKF1ltutjilTg9%2FAta"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979fb00dbc8-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server cloudflare
GET H3	200	x.js Show response static.addtoany.com/menu/svg/icons/	297 B 722 B	47ms 47ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/x.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 122ed4db2019348aef89a605e3eb79c6004f5727f16144dc46b61f31ee131764 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=864000, stale-while-revalidate=30, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED etag W/"7cdbf2d5d94ad6e7bf6e7cc1418dd608" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bjPe63Z09axys6%2FTxrNv26VQI37jbX8GnNC0kKgkp7MB67rpiSwXttA9ENhQMjMOwxaqUo7lpElE0xrgenz80CUCMOBD1RPZm6iY0gqDLVcPH7mVW3j54gf4c5SE598dWuyKY8F6"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979fb06dbc8-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server cloudflare
GET H3	200	a2a.js Show response static.addtoany.com/menu/svg/icons/	182 B 649 B	35ms 35ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/a2a.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=7776000, stale-while-revalidate=30, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED etag W/"0aca4ea1e5f8f250126a8e0c597dd969" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kXvVvjuEBbKRwRR8SRBzgpgLq40%2FQomTFXuduDZ4JsnrrV7fRs0vrGKOX5TG94Wz73ApZJvQRrb%2Fs3aH%2FEEHBEbnaPVF9lKSlOvkn9q2Q578ryOg2e3QOGPLmrJLr30pAYUSDZZW"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979fb09dbc8-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server cloudflare
GET H3	200	email.js Show response static.addtoany.com/menu/svg/icons/	415 B 790 B	38ms 38ms	Script application/javascript	172.67.39.148 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://static.addtoany.com/menu/svg/icons/email.js Requested by Host: static.addtoany.com URL: https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.39.148 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d432ad1988efa5b258294f52dae3d1b4c10660aec15e49017e21a1ee74bfd453 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://www.securonix.com Referer https://static.addtoany.com/menu/modules/core.D0Uc7kY6.js Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=7776000, stale-while-revalidate=30, public nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding br cf-cache-status EXPIRED etag W/"eb2119ad4221a9d01abc336e06962867" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2rVuprzp58tJEak%2BM0cvJZQn%2Fv0IJle%2Feon7x5k5%2FnXhbylL%2F9AKc858X6lpCo8lsJhPiaEGsapGTvBZKSVGV4AWSvfjSb%2BXNjDSx3X6otlwgcDCQyGFz%2Bej9NS1hBlNd54VKWj0"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin cf-ray 8ccd3979fb0cdbc8-FRA access-control-allow-origin * date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server cloudflare
GET H2	204	0 bat.bing.com/action/	0 285 B	33ms 33ms	Image text/plain	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=27010718&tm=gtm002&Ver=2&mid=72437ffc-f7ba-4bde-8d58-d2c3120d2222&sid=21365540818a11efa7cc1b393b554b00&vid=213670b0818a11ef9f4227b416d9d22b&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix&p=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&r=&lt=2148&evt=pageLoad&sv=1&cdb=AQoV&rn=706850 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: EF1195A9C9C3491E9AA4D8C3A553E7D7 Ref B: FRAEDGE1612 Ref C: 2024-10-03T13:19:33Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Thu, 03 Oct 2024 13:19:33 GMT
GET H2	200	VJKZ2AZ6BRDQFPNHOW6CAP Show response d.adroll.com/consent/check/	563 B 656 B	116ms 31ms	Script application/javascript	2a05:d018:cc3:fe04:62dd:8a7d:d52d:569e AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/VJKZ2AZ6BRDQFPNHOW6CAP?flg=1&pv=27235035208.16726&arrfrr=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&_s=134f0dd778bd4fa82e44ecbc7859e851&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe04:62dd:8a7d:d52d:569e Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash fc336c5d5ad6a44fa1c4e228f1c8bad2668d9529f59a9ccbdde9e82616df78b6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers content-length 563 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript server nginx/1.22.1
GET H2	200	clarity.js Show response www.clarity.ms/s/0.7.47/	64 KB 27 KB	14ms 14ms	Script application/javascript	2620:1ec:bdf::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://www.clarity.ms/s/0.7.47/clarity.js Requested by Host: www.clarity.ms URL: https://www.clarity.ms/tag/o4omknd0z9?ref=gtm Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 30adbc7e799238c336b56a1e20db67910f2a114fc3bc6ced6c550b4c873318aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-azure-ref 20241003T131933Z-176d4fdd79chrddt35yyuwybzg0000000n4000000000z7zn cache-control public, max-age=86400 x-ms-version 2018-03-28 content-encoding br etag W/"0x8DCE0B797FA7824" x-fd-int-roxy-purgeid 51562430 x-ms-request-id 45761000-c01e-0066-5b2d-1361fb000000 access-control-allow-origin * x-cache TCP_HIT date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding last-modified Sun, 29 Sep 2024 18:50:31 GMT
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	418 KB 85 KB	8ms 8ms	Script text/javascript	2600:9000:2644:ac00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:ac00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash dc8d80275b5424166b5d382894515535e167388cfbad6ae3008b18ea0f1e172c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers Access-Control-Max-Age 600 Content-Encoding gzip X-Amz-Version-Id 8ETCE8t9zap6ixXqEEaKFHCQITOmoal5 Etag W/"4fa0fae27db5bad9bb2635e3a23d52e1" Age 259 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id kZfBTw-UjKcs44tAVyh5eqjM7e59YiHDLT-5Dcu4l9Oa402eyjjtBg== Date Thu, 03 Oct 2024 13:15:15 GMT Content-Type text/javascript Vary Accept-Encoding Last-Modified Mon, 30 Sep 2024 16:15:47 GMT Access-Control-Allow-Headers * Transfer-Encoding chunked Cache-Control max-age=300, must-revalidate Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Access-Control-Allow-Origin * X-Amz-Cf-Pop FRA60-P6 Server AmazonS3 X-Amz-Server-Side-Encryption AES256
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	9ms 8ms	Image image/png	2600:9000:2644:ac00:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2644:ac00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers Access-Control-Max-Age 600 X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Age 28640 Access-Control-Allow-Methods GET X-Cache Hit from cloudfront X-Amz-Cf-Id RPFV38IJKFt8t78pPzyhJHQ4NZ2E9kNjG_uv27wjsTjQevILEziCNg== Date Thu, 03 Oct 2024 05:22:14 GMT Content-Type image/png Vary Accept-Encoding Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Access-Control-Allow-Headers * Connection keep-alive Access-Control-Allow-Credentials false Via 1.1 a2ce61e5ddc66736c9e2bfb6581fa2da.cloudfront.net (CloudFront) Accept-Ranges bytes Access-Control-Allow-Origin * Content-Length 1615 X-Amz-Cf-Pop FRA60-P6 Server AmazonS3 X-Amz-Server-Side-Encryption AES256
POST H/1.1	204 No Content	collect Show response w.clarity.ms/	0 281 B	594ms 356ms	XHR text/plain	23.96.124.156 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://w.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.47/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.96.124.156 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept application/x-clarity-gzip Referer https://www.securonix.com/ Response headers Request-Context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12 Access-Control-Allow-Origin https://www.securonix.com Date Thu, 03 Oct 2024 13:19:34 GMT Vary Origin Server nginx Connection keep-alive Access-Control-Allow-Credentials true
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 0	0ms 0ms	Script application/javascript	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/ecef1e1d-da84-47a8-9b0f-cd1203fb284a.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 3a600a8b86e938acf4c39f392719678cbeee228d2ee698fbf3f310e99db4347a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "66f5de53-111c3" x-content-type-options nosniff expires Thu, 03 Oct 2024 16:19:33 GMT accept-ranges bytes content-length 18820 date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 26 Sep 2024 22:21:07 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 195 B	100ms 99ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://www.securonix.com content-length 7 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	19 B 309 B	32ms 9ms	XHR text/html	2a02:26f0:7100::210:180 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 200d74a734a345df63aae0a13c86291186b12f3f2a1e074c470db5d52c16a057 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:20:271::1e expires Thu, 03 Oct 2024 13:19:33 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727961573869_34603388_417122653_20_970_5_10_219";dur=1 access-control-allow-origin https://www.securonix.com content-length 19 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/html vary Origin
GET H2	200	/ Show response c.6sc.co/	7 B 195 B	110ms 13ms	XHR text/html	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://www.securonix.com content-length 7 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	19 B 309 B	40ms 9ms	XHR text/html	2a02:26f0:7100::210:180 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:180 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 200d74a734a345df63aae0a13c86291186b12f3f2a1e074c470db5d52c16a057 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:20:271::1e expires Thu, 03 Oct 2024 13:19:33 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1727961573890_34603388_417122656_46_1212_5_0_219";dur=1 access-control-allow-origin https://www.securonix.com content-length 19 date Thu, 03 Oct 2024 13:19:33 GMT content-type text/html vary Origin
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	146ms 146ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&v=1.1.28 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:33 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	141ms 141ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%2205b12115ad17914938bf7667643ca0d3%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEndpoint%5C%22%2C%5C%22value%5C%22%3A%5C%22b.6sc.co%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%2245bc92abc111f3fccbf9c8779059ecfc1d69c9e6%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&v=1.1.28 Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:33 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:33 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	core js.driftt.com/ Frame AE4A	0 0	123ms 111ms	Document text/html	18.245.86.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core?d=1&embedId=r32rm8p2zmht&eId=r32rm8p2zmht&region=US&forceShow=false&skipCampaigns=false&sessionId=2303928c-0934-4f6f-bfd7-f63504673cd7&sessionStarted=1727961573.861&campaignRefreshToken=c7f3a2f0-0c4f-4a6a-9999-9fe80a27ab21&hideController=false&pageLoadStartTime=1727961572904&mode=CHAT&driftEnableLog=false&secureIframe=false&u=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1727961600000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-87.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Thu, 03 Oct 2024 13:19:33 GMT etag W/"e02707ecde812f324896e0f17b53fd15" last-modified Tue, 24 Sep 2024 17:33:10 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 57bc54093a2e2c99ca194f2955ba3d1c.cloudfront.net (CloudFront) x-amz-cf-id A2oh8HlACpsM10WBsSo8E-bVBpcC4Tbhshwuu9OrUCmUqYRUAvmABg== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id YN8CatGloOim4_XmQKZzVgY7V1fWMNRE x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 21
GET H2	200	chat js.driftt.com/core/ Frame B7AF	0 0	128ms 118ms	Document text/html	18.245.86.87 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/core/chat?d=1&region=US&driftEnableLog=false&pageLoadStartTime=1727961572904 Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1727961600000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.87 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-87.fra60.r.cloudfront.net Software istio-envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache content-encoding gzip content-type text/html; charset=utf-8 date Thu, 03 Oct 2024 13:19:33 GMT etag W/"e02707ecde812f324896e0f17b53fd15" last-modified Tue, 24 Sep 2024 17:33:10 GMT server istio-envoy strict-transport-security max-age=31536000; includeSubDomains vary Accept-Encoding via 1.1 57bc54093a2e2c99ca194f2955ba3d1c.cloudfront.net (CloudFront) x-amz-cf-id PWs6Scd6pekoAl-60xYYCQv0weV236qlbF2EIfeUwG-7jvavAXvF3g== x-amz-cf-pop FRA60-P6 x-amz-server-side-encryption AES256 x-amz-version-id YN8CatGloOim4_XmQKZzVgY7V1fWMNRE x-cache RefreshHit from cloudfront x-envoy-upstream-service-time 62
GET H3	200	zi-tag.js Show response js.zi-scripts.com/	9 KB 3 KB	49ms 28ms	Script application/javascript	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/zi-tag.js Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e779904e434d50e426e79dfac680cdb8a04564e67121c257974278a02979e407 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers server cloudflare content-encoding gzip cf-cache-status DYNAMIC x-amz-version-id PTl7rnF_EEhUwyN5J882FhdYw1E0brGf etag W/"b2877da906a3216c4f3fc4030b205e54" age 42441 via 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront) cf-ray 8ccd397d0ad44d2e-FRA x-cache Hit from cloudfront x-amz-cf-id 2UaLJss2RJal0dJuq1h5WI9cg9ArOWbM87h8F-GBVjI5_WR6Sej_Lg== date Thu, 03 Oct 2024 13:19:33 GMT content-type application/javascript last-modified Thu, 18 Jul 2024 08:13:46 GMT vary Accept-Encoding x-amz-cf-pop FRA56-P4
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	117ms 117ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A271%3A%3A1e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3Aac8%3A20%3A271%3A%3A1e&v=1.1.28 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:34 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:34 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H3	200	getSubscriptions Show response js.zi-scripts.com/unified/v1/master/	203 B 587 B	191ms 178ms	Fetch application/json	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 3e3f0753f454ca9b8aba1745a513f00835a4bb2e3bdedfa1b62412b9e5244b03 Request headers Authorization Bearer 3e8e82dad11669757953 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type application/json visited_url https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers content-encoding gzip cf-cache-status DYNAMIC etag W/"cb-0FOZCBSDXXMGjM7IhwsDzWGqZos" apigw-requestid fEz8BhmGvHcEMVw= alt-svc h3=":443"; ma=86400 x-cache Miss from cloudfront x-amz-cf-id k8bu_iJ-pMsdLUvZflHWpmVKixYtFi_9wYaNblvYJPb1boACD9uBGQ== date Thu, 03 Oct 2024 13:19:34 GMT content-type application/json; charset=utf-8 vary Origin via 1.1 2ba7b49ec4c4de4e67297e603c89a5e4.cloudfront.net (CloudFront) cf-ray 8ccd397e9da65d91-FRA access-control-allow-origin https://www.securonix.com x-amz-cf-pop FRA56-P4 x-powered-by Express server cloudflare
OPTIONS H3	204	getSubscriptions js.zi-scripts.com/unified/v1/master/ Frame	0 0	205ms 191ms	Preflight	104.18.37.212 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.zi-scripts.com/unified/v1/master/getSubscriptions Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.37.212 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,content-type,visited_url Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-headers Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken access-control-allow-methods POST, GET, OPTIONS, PATCH, DELETE, PUT access-control-allow-origin https://www.securonix.com alt-svc h3=":443"; ma=86400 apigw-requestid fEz7_j66vHcEMgg= cf-cache-status DYNAMIC cf-ray 8ccd397d4c575d91-FRA date Thu, 03 Oct 2024 13:19:34 GMT server cloudflare vary Origin via 1.1 f8f9f25f837c0ce4e62b6d917642b56a.cloudfront.net (CloudFront) x-amz-cf-id vNy7Q7iNLF5Y0xL3k4LL1iZazjbBuZJ0AScuOLrrdL9nFMYwK2M9ZQ== x-amz-cf-pop FRA56-P4 x-cache Miss from cloudfront x-powered-by Express
GET H2	200	details Show response epsilon.6sense.com/v3/company/	634 B 590 B	80ms 64ms	XHR application/json	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 8aa55e23264576a3203c911220c574fe36367136dbdc755c10dc6224767c4eb5 Request headers Authorization Token ed71c2ff74493da228496ca2b3f1e44ce78a83d7 X-6s-CustomID WebTag ecef1e1d-da84-47a8-9b0f-cd1203fb284a Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region eu-central-1 access-control-allow-credentials true access-control-allow-origin https://www.securonix.com content-length 320 date Thu, 03 Oct 2024 13:19:34 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	57ms 0ms	Preflight	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.securonix.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Thu, 03 Oct 2024 13:19:34 GMT timing-allow-origin https://6sense.com x-6si-region eu-central-1
GET H2	200	cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png www.securonix.com/wp-content/uploads/2021/12/	676 B 903 B	63ms 58ms	Other image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Full URL https://www.securonix.com/wp-content/uploads/2021/12/cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d381f3799814c3df53d341b475363a0c9116fb644fdd96b953d93950a6c1155b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-bgj imgq:100,h2pri etag "6633485f-344" age 138055 cf-cache-status HIT x-content-type-options nosniff cf-polished origFmt=png, origSize=836 date Thu, 03 Oct 2024 13:19:34 GMT content-type image/webp content-disposition inline; filename="cropped-cropped-cropped-cropped-Securonix-Logo_ForWeb-RGB_Icon-3-32x32.webp" vary Accept last-modified Thu, 02 May 2024 08:01:35 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd397ebdb99763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 676 server cloudflare
GET H3	200	formcomplete.js Show response ws-assets.zoominfo.com/	90 KB 27 KB	107ms 57ms	Script application/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws-assets.zoominfo.com/formcomplete.js Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b1a4915e59e76e65870b9b2fe38250746fd0eaa301b836516e71bc7c6dd8ae4 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-goog-metageneration 1 x-goog-hash crc32c=p5SAHw==, md5=AGRVvUTtKJ3cxAPQ7NlqsA== cf-cache-status DYNAMIC etag W/"006455bd44ed289ddcc403d0ecd96ab0" age 997 content-encoding gzip x-goog-stored-content-encoding identity expires Thu, 03 Oct 2024 14:02:57 GMT x-goog-stored-content-length 91778 date Thu, 03 Oct 2024 13:19:34 GMT content-type application/javascript last-modified Thu, 16 May 2024 10:14:37 GMT x-guploader-uploadid AD-8ljvXtnFaPh8QMMueoAYWyg6i6BVue1XFq3itTMSEBryK1q_Xoa28prwcu6Pgk47_5lRyHRg cache-control public, max-age=3600 x-goog-storage-class STANDARD cf-ray 8ccd39801cd5d252-FRA x-goog-generation 1715854477710382 server cloudflare
GET H3	200	/ Show response ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/	3 KB 2 KB	193ms 192ms	Fetch text/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 57fdc7fb2d7dc9c769e14d0e44db03c3822c30276cd74641a16291b1260a5918 Security Headers Name Value X-Content-Type-Options nosniff Request headers _zitok 71039e57629b4fead29e1727961574 _vtok MTQ2LjcwLjExNy43MQ== visited-url https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/javascript Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC access-control-allow-credentials true x-content-type-options nosniff via 1.1 google cf-ray 8ccd39814df9d252-FRA access-control-allow-origin https://www.securonix.com date Thu, 03 Oct 2024 13:19:34 GMT content-type text/javascript vary Accept-Encoding x-powered-by Express server cloudflare access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
OPTIONS H3	200	/ ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/ Frame	0 0	247ms 197ms	Preflight text/html	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62ffe38de2e537008ecb115f/?iszitag=true Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers _vtok,_zitok,content-type,visited-url Access-Control-Request-Method GET Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url access-control-allow-origin https://www.securonix.com allow GET,HEAD cf-cache-status DYNAMIC cf-ray 8ccd3980192a18ed-FRA content-encoding gzip content-type text/html; charset=utf-8 date Thu, 03 Oct 2024 13:19:34 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
POST H3	200	forms Show response ws.zoominfo.com/formcomplete-v2/	320 B 597 B	153ms 152ms	Fetch application/json	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Requested by Host: ws-assets.zoominfo.com URL: https://ws-assets.zoominfo.com/formcomplete.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash def1ad6278532b1e7ae1b77b4964f48a12b5acc33872eab663855483997b718e Security Headers Name Value X-Content-Type-Options nosniff Request headers Authorization bearer f0ddbd6ba8265551bbe95c25bdf2a9 Referer https://www.securonix.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type application/json Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC etag W/"140-/3+OW/4aU4/AnqAmyrwCzrd9buM" access-control-allow-credentials true x-content-type-options nosniff via 1.1 google cf-ray 8ccd39818e26d252-FRA access-control-allow-origin https://www.securonix.com date Thu, 03 Oct 2024 13:19:34 GMT content-type application/json; charset=utf-8 vary Accept-Encoding x-powered-by Express server cloudflare access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
OPTIONS H3	200	forms ws.zoominfo.com/formcomplete-v2/ Frame	0 0	160ms 160ms	Preflight text/html	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/formcomplete-v2/forms Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers authorization,content-type Access-Control-Request-Method POST Origin https://www.securonix.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok access-control-allow-origin https://www.securonix.com allow POST cf-cache-status DYNAMIC cf-ray 8ccd3980899f18ed-FRA content-encoding gzip content-type text/html; charset=utf-8 date Thu, 03 Oct 2024 13:19:34 GMT server cloudflare via 1.1 google x-content-type-options nosniff x-powered-by Express x-robots-tag noindex, nofollow
POST H/1.1	204 No Content	collect Show response w.clarity.ms/	0 281 B	205ms 203ms	XHR text/plain	23.96.124.156 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://w.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.47/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.96.124.156 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept application/x-clarity-gzip Referer https://www.securonix.com/ Response headers Request-Context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12 Access-Control-Allow-Origin https://www.securonix.com Date Thu, 03 Oct 2024 13:19:34 GMT Vary Origin Server nginx Connection keep-alive Access-Control-Allow-Credentials true
GET BLOB	200 OK	ee8dffe3-be93-479d-a154-99c8d80baec9 Show response https://www.securonix.com/	3 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://www.securonix.com/ee8dffe3-be93-479d-a154-99c8d80baec9 Requested by Host: js.zi-scripts.com URL: https://js.zi-scripts.com/zi-tag.js Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 57fdc7fb2d7dc9c769e14d0e44db03c3822c30276cd74641a16291b1260a5918 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer Response headers Content-Type text/javascript Content-Length 3033
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	107ms 107ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A33%20GMT%22%2C%22timeSpent%22%3A%221547%22%2C%22totalTimeSpent%22%3A%221547%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3Aac8%3A20%3A271%3A%3A1e&v=1.1.28 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:34 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:34 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	Securonix-logo-alt.webp www.securonix.com/wp-content/uploads/2024/04/	14 KB 14 KB	24ms 23ms	Image image/webp	141.193.213.20 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://www.securonix.com/wp-content/uploads/2024/04/Securonix-logo-alt.webp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 195ead3f2c695bbc2891e27e0f4fb3d31f08097370ed4fc66abfe75b07fc238b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Response headers cf-cache-status HIT etag "6633485a-382a" age 146227 x-content-type-options nosniff date Thu, 03 Oct 2024 13:19:34 GMT content-type image/webp last-modified Thu, 02 May 2024 08:01:30 GMT vary Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=31536000; includeSubDomains cache-control public, max-age=31536000 referrer-policy strict-origin-when-cross-origin cf-ray 8ccd39837baf9763-FRA permissions-policy geolocation=(), midi=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), fullscreen=(self), payment=() accept-ranges bytes access-control-allow-origin * content-length 14378 server cloudflare
POST H3	200	u dev.visualwebsiteoptimizer.com/events/t/	0 36 B	137ms 136ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t/u?en=chat_playbook_fired&a=915442&v=ae9ca0095&_cu=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-levera Requested by Host: www.securonix.com URL: https://www.securonix.com/blog/threat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv01c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.securonix.com/ Response headers content-encoding gzip access-control-allow-methods GET, POST via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 03 Oct 2024 13:19:35 GMT content-type application/javascript; charset=UTF-8 server gnv01c access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For
GET H2	200	3.ee35dea2.chunk.js Show response js.driftt.com/conductor/assets/	158 B 852 B	7ms 7ms	Script application/javascript	18.245.86.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/3.ee35dea2.chunk.js Requested by Host: js.driftt.com URL: https://js.driftt.com/include/1727961600000/r32rm8p2zmht.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-77.fra60.r.cloudfront.net Software istio-envoy / Resource Hash 3005a54fc57fc2d8c70cc41e4ca7fcaaed7514b03f28581082c454e6a2d11f3b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers x-amz-version-id rYV3Tk3yEytdzde9thJ_AN9ul6xSrvB. etag "e6714addd36102488fb27a980401fd36" age 1429531 access-control-allow-methods GET, POST, OPTIONS x-cache Hit from cloudfront x-amz-cf-id 35f-q2nDO9npZUIU0ujY0wEVKfk7SefAKajjivQIultiLf7bDHEVng== date Tue, 17 Sep 2024 00:14:04 GMT content-type application/javascript; charset=utf-8 last-modified Tue, 10 Sep 2024 14:51:22 GMT access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains cache-control max-age=31536000 x-envoy-upstream-service-time 13 access-control-allow-credentials true via 1.1 9d1f21fface75767578955e1853e754e.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 158 x-amz-cf-pop FRA60-P6 server istio-envoy x-amz-server-side-encryption AES256
GET H2	206	notification.5f7c6014.mp3 js.driftt.com/conductor/assets/media/	8 KB 8 KB	8ms 7ms	Media audio/mpeg	18.245.86.77 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.driftt.com/conductor/assets/media/notification.5f7c6014.mp3 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.245.86.77 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-245-86-77.fra60.r.cloudfront.net Software istio-envoy / Resource Hash bf06f41bb3a1429115fa2dcfbee9986234d6d319da3597648e4e980340d52027 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://www.securonix.com/ Accept-Encoding identity;q=1, *;q=0 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Range bytes=0- Response headers x-amz-version-id AJ3ftWhvW2h954Q3Lc0BJKBcX87AS953 etag "5f7c6014cf73831f91963a668b71fbb9" age 6358126 access-control-allow-methods GET, POST, OPTIONS x-cache Hit from cloudfront x-amz-cf-id 6dQdlfgqkr5ij7gyYsemF7IXLsSMzMtZhF2Be-CjXcVbjwZsecFSkw== date Mon, 23 Sep 2024 18:12:32 GMT content-type audio/mpeg last-modified Mon, 18 Sep 2023 19:58:12 GMT access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type strict-transport-security max-age=31536000; includeSubDomains cache-control max-age=31536000 x-envoy-upstream-service-time 16 access-control-allow-credentials true Content-Range bytes 0-7754/7755 via 1.1 9d1f21fface75767578955e1853e754e.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * Content-Length 7755 x-amz-cf-pop FRA60-P6 server istio-envoy x-amz-server-side-encryption AES256
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	118ms 118ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A34%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222548%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3Aac8%3A20%3A271%3A%3A1e&v=1.1.28 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:35 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:35 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	106ms 105ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A36%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A35%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223548%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3Aac8%3A20%3A271%3A%3A1e&v=1.1.28 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:36 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:36 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
POST H/1.1	204 No Content	collect Show response w.clarity.ms/	0 281 B	116ms 115ms	XHR text/plain	23.96.124.156 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://w.clarity.ms/collect Requested by Host: www.clarity.ms URL: https://www.clarity.ms/s/0.7.47/clarity.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.96.124.156 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Accept application/x-clarity-gzip Referer https://www.securonix.com/ Response headers Request-Context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12 Access-Control-Allow-Origin https://www.securonix.com Date Thu, 03 Oct 2024 13:19:37 GMT Vary Origin Server nginx Connection keep-alive Access-Control-Allow-Credentials true
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	128ms 128ms	Image image/gif	2.17.100.184 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=05b12115ad17914938bf7667643ca0d3&svisitor=null&visitor=ed4dc2dc-d88c-49ff-8de0-a130513136f1&session=0ff58bd6-b0f7-465f-8fb0-b4293456e103&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A37%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2003%20Oct%202024%2013%3A19%3A36%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224548%22%7D&isIframe=false&m=%7B%22description%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%20details%20the%20Detection%20of%20a%20New%20OCX%23HARVESTER%20Attack%20Campaign%20that%20Leverages%20a%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Securonix%20Threat%20Labs%20Security%20Advisory%3A%20New%20OCX%23HARVESTER%20Attack%20Campaign%20Leverages%20Modernized%20More_eggs%20Suite%20to%20Target%20Victims%20-%20Securonix%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.securonix.com%2Fblog%2Fthreat-labs-security-advisory-new-ocxharvester-attack-campaign-leverages-modernized-more_eggs-suite&pageViewId=ca438cdd-b1a4-4ab8-8ad6-1324e45c5d86&webTagId=ecef1e1d-da84-47a8-9b0f-cd1203fb284a&ipv6=2001%3Aac8%3A20%3A271%3A%3A1e&v=1.1.28 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://www.securonix.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Thu, 03 Oct 2024 13:19:37 GMT accept-ranges bytes content-length 43 date Thu, 03 Oct 2024 13:19:37 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.securonix.com

URL

blob:https://www.securonix.com/6bfddcad-0daa-4a63-a122-73c4d2549d77

Domain

www.securonix.com

URL

blob:https://www.securonix.com/7933de2e-541d-44e8-9a36-907ae3395b08