redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 68

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=1721967417024414272

Request Chain 80

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2&e_ipv6=AQLFMbrFYM-mtQAAAZNCighrqj0Kx4ujXDGBOb9a5fVHcokKstQTE7k6hlc8lmkkime8wC32Zs1_CcuKcLkYeadi8s4I8Q

140 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/	352 KB 63 KB	607ms 303ms	Document text/html	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash bc9b44b977b96cc403c0c830709617f2df44ac23a2f063433c62feec38da8241 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Tue, 19 Nov 2024 03:49:20 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=35826>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security "max-age=63072000; includeSubDomains; preload"; vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding x-cache HIT: 1 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	otSDKStub.js Show response cdn.cookielaw.org/scripttemplates/	22 KB 8 KB	77ms 30ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ade920fd5b00cd298aae7978673a9a64d0bb3fa593d23e91994ec6b6723ebace Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Vo/d0f3ZefkwyML/PnJnjg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DD077813C3F8C9 x-ms-lease-status unlocked cf-cache-status HIT age 268 x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:20 GMT content-type application/javascript last-modified Mon, 18 Nov 2024 02:24:06 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 1687f468-d01e-0063-478d-39d5af000000 cf-ray 8e4d3ad52eded2cf-FRA accept-ranges bytes access-control-allow-origin * content-length 7212 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.7.1/	85 KB 30 KB	74ms 23ms	Script text/javascript	2a00:1450:4001:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip age 257427 report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} x-content-type-options nosniff expires Sun, 16 Nov 2025 04:18:53 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Sat, 16 Nov 2024 04:18:53 GMT last-modified Tue, 12 Sep 2023 02:38:22 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding cache-control public, max-age=31536000, stale-while-revalidate=2592000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers accept-ranges bytes access-control-allow-origin * content-length 30462 x-xss-protection 0 server sffe
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	199 KB 67 KB	226ms 37ms	Script application/x-javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=14400 content-encoding gzip cf-cache-status HIT etag "2d803a3-31b73-6265f6525d19f" age 408 x-content-type-options nosniff cf-ray 8e4d3ad6184cdc50-FRA expires Tue, 19 Nov 2024 07:49:20 GMT date Tue, 19 Nov 2024 03:49:20 GMT content-type application/x-javascript last-modified Fri, 08 Nov 2024 04:43:40 GMT vary Accept-Encoding server cloudflare
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	67 KB 25 KB	149ms 31ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BA7) / Resource Hash be3efb305c8998b5773f331a735243d5112df20d1e6a90d859ee3b65dc77bbc7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control max-age=86400 content-encoding gzip etag "961cde537134db1:0" age 23565 accept-ranges bytes x-cache HIT content-length 25392 date Tue, 19 Nov 2024 03:49:21 GMT content-type application/x-javascript last-modified Mon, 11 Nov 2024 19:38:48 GMT server ECS (amb/6BA7) vary Accept-Encoding
GET H2	200	js Show response www.googletagmanager.com/gtag/	446 KB 138 KB	107ms 47ms	Script application/javascript	2a00:1450:4001:81c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7a4724698f7ec038b6c8046e55a949f34fd1f258bf74b581c4e0c955bbbdb99d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Tue, 19 Nov 2024 03:49:21 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 140323 x-xss-protection 0 server Google Tag Manager
GET H2	200	qualified.js Show response js.qualified.com/	1 MB 245 KB	93ms 31ms	Script text/javascript	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash aaaa046cd3bfd7f2f4d5b2ab6b955a40a85880b4c669c9c0fca509023b296d6e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-request-id b5fc3892-36bd-4677-a2e5-c29f2347e3b2 content-encoding gzip cf-cache-status HIT etag W/"47e9bf9aca26d34886c08b670b895489" age 12190 x-permitted-cross-domain-policies none x-content-type-options nosniff x-cache miss date Tue, 19 Nov 2024 03:49:21 GMT content-type text/javascript; charset=utf-8 vary Accept,Accept-Encoding x-runtime 0.034417 x-frame-options SAMEORIGIN strict-transport-security max-age=63072000; includeSubDomains cache-control max-age=60, public, stale-while-revalidate=60, stale-if-error=300, s-maxage=86400 x-envoy-upstream-service-time 60 referrer-policy strict-origin-when-cross-origin x-download-options noopen cf-ray 8e4d3ad6fbf6d2db-FRA x-xss-protection 1; mode=block server cloudflare
GET H3	200	jquery.matchHeight-min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/	3 KB 2 KB	54ms 29ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery.matchHeight/0.7.2/jquery.matchHeight-min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fa87904726726364ad19a7c4b2f2b20ee10637325601b5aa88ed8bfdcb7117a7 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "5eb03ec3-d34" age 977027 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=El5FyZPf7tNQBe%2FMJhF43BsZ8xAezxRzS8j7FRTL2P5%2B4oBX0PT75XSF3y%2BUyuGXTwo7v9QTgtPGifaIdobecBHwMKhFvRI0Dgmz%2F2oUYw0gJIDsAwadSos7KXrSZbDBSkk%2BcWijo7tBh%2Fl9zDDqKgFn"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sun, 09 Nov 2025 03:49:20 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:20 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 04 May 2020 16:11:47 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4d3ad509b2dbdf-FRA accept-ranges bytes access-control-allow-origin * content-length 1221 server cloudflare
GET H2	200	40393661-0639-4e13-9774-ba9e2ae459fa.json Show response cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/	5 KB 2 KB	152ms 41ms	XHR application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/40393661-0639-4e13-9774-ba9e2ae459fa.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4e7669e92e0d052b6940b1c108fe488fc344e33e92615ee396c98573ea7e94c8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Of+LW11tRgwbWqX5gaZ5fw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DCF76BB61C7510 age 25423 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Wed, 20 Nov 2024 03:49:20 GMT date Tue, 19 Nov 2024 03:49:20 GMT content-type application/json last-modified Mon, 28 Oct 2024 16:15:16 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id a3f6edea-001e-00c0-2e54-2919ce000000 cf-ray 8e4d3ad619254db9-FRA accept-ranges bytes access-control-allow-origin * content-length 1782 x-ms-blob-type BlockBlob server cloudflare
GET H3	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	45ms 44ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-20801" age 470023 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ldUMm9g3rpzbrqc9cPWjjHAOk0ioJYFQ6L1igjlypzhFIv1lHt0Qi25lJVez9Wn4DROqzCSh%2BVF6U%2B6DooVMlf9H%2FfF1aq%2F0AVeRWX6iZJzKzE8Usi8KjQDV6Vqa0s%2FLFS45YezpnWNw%2BFiafWgv1FNn"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sun, 09 Nov 2025 03:49:20 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:20 GMT content-type application/javascript; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4d3ad5c89dd27e-FRA accept-ranges bytes access-control-allow-origin * content-length 33250 server cloudflare
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	1205ms 406ms	Script application/x-js	52.218.253.8 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.218.253.8 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Cache-Control public ETag "bab0c2b3523f8244564b675fe34db610" x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO x-amz-request-id 9CKZ7GT7NCJEBNNC Accept-Ranges bytes Content-Length 41617 Date Tue, 19 Nov 2024 03:49:22 GMT Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Content-Type application/x-js Server AmazonS3 x-amz-id-2 N5H1AI84wHwgT83guX+s2fOT0M3Cqvf9b6q5/D8nxSl85KQjMTT9TsmelpLtJy1Vz/NxWQbM1+M=
GET H2	200	autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js Show response redcanary.com/wp-content/cache/autoptimize/js/	262 KB 76 KB	154ms 152ms	Script application/javascript	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_7b38ca29273224c4ecb2a43fdd286ea7.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 18b368af8e8679b39c6fbbdde36542f3fc345bc9230a35cd1bd06595c1e73608 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"672bc673-4165d" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 06 Nov 2024 19:41:39 GMT
GET H2	200	location Show response geolocation.onetrust.com/cookieconsentpub/v1/geo/	59 B 295 B	83ms 36ms	XHR application/json	2606:4700:4400::ac40:9b77 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 accept application/json Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip access-control-allow-methods GET, OPTIONS cf-ray 8e4d3ad6aacfd356-FRA access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type application/json vary Accept-Encoding server cloudflare access-control-allow-headers Content-Type
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	129ms 33ms	Script application/x-javascript	104.82.89.248 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.82.89.248 Hamburg, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-82-89-248.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2091f1ff92cc073e178dca31707853e0cc6cd913a5344a8978f040fa373efa6 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Content-Encoding gzip ETag "e75e5ba140b1c7e6ea79786633c1ba0d:1731465879.778595" Connection keep-alive Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 741 Date Tue, 19 Nov 2024 03:49:21 GMT Content-Type application/x-javascript Last-Modified Wed, 13 Nov 2024 02:44:39 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	gtm.js Show response www.googletagmanager.com/	393 KB 124 KB	136ms 90ms	Script application/javascript	2a00:1450:4001:81c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash ea53f1db9dae3b0379747508f33aeb745ed810654069072b85517ca41b7e6455 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Tue, 19 Nov 2024 03:49:21 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Tue, 19 Nov 2024 03:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 126773 x-xss-protection 0 server Google Tag Manager
GET H2	200	css fonts.googleapis.com/	8 KB 1 KB	95ms 34ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:21 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Tue, 19 Nov 2024 03:40:37 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	j.php Show response dev.visualwebsiteoptimizer.com/	27 KB 9 KB	111ms 42ms	XHR application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/j.php?a=906194&u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&vn=2.1&x=true Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 3aebdfff0fe7475a72b994037db7d7a4c97c9d5d920dc46c52cee4802381602d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=0, no-cache, must-revalidate timing-allow-origin * content-encoding gzip access-control-allow-credentials true via 1.1 google access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:20 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding server gfra1
GET H2	200	autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css redcanary.com/wp-content/cache/autoptimize/css/	5 MB 250 KB	298ms 297ms	Stylesheet text/css	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"672bc674-53ed07" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 06 Nov 2024 19:41:40 GMT
GET H2	200	5354.js Show response tracking.g2crowd.com/attribution_tracking/conversions/	2 KB 2 KB	254ms 192ms	Script text/javascript	2606:4700::6812:1eb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/&e= Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7ebe484ad4d30747fa24197c78a9bb28055fccf7502dfa7982cef1447a184d31 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br x-permitted-cross-domain-policies none x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:21 GMT content-type text/javascript;charset=UTF-8 content-disposition inline vary Origin, Accept-Encoding x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains x-dns-prefetch-control off cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin referrer-policy no-referrer x-download-options noopen cf-ray 8e4d3ad6fb585d98-FRA access-control-allow-origin * x-xss-protection 0 origin-agent-cluster ?1 server cloudflare
GET DATA	200 OK	truncated /	67 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6e0408f7fbaf5216b577287b7654be1388d933b9b41dbd95dc733d5b5020f67a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H3	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 874 B	29ms 29ms	Stylesheet text/css	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-2fb" age 373186 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=doAJEr62am1uTqWmWMv64XYUrgjJ2%2FzvteXc9AClWZYSDWW1edwNsNTMAteXA754tqvkke%2BJ9%2BA91711nEuAF94Uv9LCvYCfC%2BiuG7syHf%2BSn%2FtrmjG%2BJ6zPJENHdGOYQnNbwkB468hWSMt%2Bv1kksAB0"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sun, 09 Nov 2025 03:49:21 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding strict-transport-security max-age=15780000 cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4d3ad6a998d27e-FRA accept-ranges bytes access-control-allow-origin * content-length 271 server cloudflare
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 581 B	281ms 280ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"5c76b1e9-15e" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 27 Feb 2019 15:51:05 GMT
GET H2	200	bullet-square.svg redcanary.com/wp-content/themes/redcanary/assets/img/	443 B 616 B	280ms 279ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/bullet-square.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6217f642930c0d2411329fb00cf9a7e2e138a98f56eece6e82b3a7359f20cb11 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"6123d0cf-1bb" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Mon, 23 Aug 2021 16:46:07 GMT
GET H2	200	CanarySans-Text-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	263ms 263ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06305-5acc" accept-ranges bytes access-control-allow-origin * content-length 23244 date Tue, 19 Nov 2024 03:49:21 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:25 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Text-400.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	261ms 261ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-400.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06303-5a48" accept-ranges bytes access-control-allow-origin * content-length 23112 date Tue, 19 Nov 2024 03:49:21 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:23 GMT server nginx vary Accept-Encoding
GET H2	200	otBannerSdk.js Show response cdn.cookielaw.org/scripttemplates/202409.2.0/	461 KB 112 KB	31ms 31ms	Script application/javascript	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7d9c9ad349c47e81a545ff3e3bdb0a8df5ebe959da9b52cadd9440d92f7ef359 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 uGd5VTJp/PFmoOURmUW/IQ== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719E1819D6B x-ms-lease-status unlocked cf-cache-status HIT age 84335 x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript last-modified Mon, 28 Oct 2024 06:29:30 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id ec98eb99-d01e-00e0-4b63-297502000000 cf-ray 8e4d3ad6e8d2d2cf-FRA accept-ranges bytes access-control-allow-origin * content-length 114311 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	70ms 70ms	Script application/javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&callback=jQuery37106971286037470297_1731988161021&_=1731988161022 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ae298f7cd8d368d35b362d46b9e6ed4f7688053c3fb7dfd1ce40d6efff767cec Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-ray 8e4d3ad70934dc50-FRA cached true content-encoding gzip date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding server cloudflare
GET H2	200	css fonts.googleapis.com/	8 KB 0	0ms 0ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:21 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Tue, 19 Nov 2024 03:40:37 GMT x-frame-options SAMEORIGIN link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H3	200	6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	15 KB 15 KB	68ms 31ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 17591 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Tue, 18 Nov 2025 22:56:10 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 22:56:10 GMT last-modified Thu, 01 Jun 2023 22:52:56 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14892 x-xss-protection 0 server sffe
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	14 KB 14 KB	63ms 26ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 416565 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Fri, 14 Nov 2025 08:06:36 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Thu, 14 Nov 2024 08:06:36 GMT last-modified Thu, 01 Jun 2023 22:52:57 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14712 x-xss-protection 0 server sffe
GET H3	200	6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 fonts.gstatic.com/s/sourcesanspro/v22/	14 KB 14 KB	74ms 37ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c3de27b2cbd6deda629c9b442700cf54c0dda74e494b1c75a57d822068a047f8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://fonts.googleapis.com/ Response headers age 36157 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Tue, 18 Nov 2025 17:46:44 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 17:46:44 GMT last-modified Thu, 01 Jun 2023 22:52:58 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 14780 x-xss-protection 0 server sffe
GET H3	200	worker-099913a84ceb27d206f0a53d1546a6f5br.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	264 KB 64 KB	62ms 35ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/worker-099913a84ceb27d206f0a53d1546a6f5br.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash b474f45de8cb58c109ac4f0317e9844a524e857dda61dce742b8f535964572cd Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=Oo/Pfg==, md5=qMs2DlAj53V2APbzkbTVMw== etag "a8cb360e5023e7757600f6f391b4d533" age 66490 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 65225 date Mon, 18 Nov 2024 09:21:11 GMT last-modified Mon, 18 Nov 2024 08:09:27 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC5V4itRXVN-3HZiPVvW9-gaV9xvpifQBPK31_nWUF8wfX00WYgMQS2GvjxSE0Uze4ro2O6uPrbT8Q cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917367486486 content-length 65225 content-language en server UploadServer
GET H3	200	va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	276 KB 71 KB	55ms 28ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/va_gq-01ab96ecc7852b4725bb68afe149c7dfbr.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 4dc938ac1478b3c05be5e7ce8a59481f532743dbaf1641cca4445786f28c500b Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=yxmZrQ==, md5=A06VLJiKmqk1uDWpPm/E+w== etag "034e952c988a9aa935b835a93e6fc4fb" age 63557 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 73122 date Mon, 18 Nov 2024 10:10:04 GMT last-modified Mon, 18 Nov 2024 08:09:54 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC7k0kgEqwFhMDx7yRQMZXJ60orvvpIH3bLBu4_NsD9ZqI6Ea908vVjyOfsRtZrmHkfwgPA cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917394426091 content-length 73122 content-language en server UploadServer
GET H2	200	v.gif dev.visualwebsiteoptimizer.com/	35 B 146 B	125ms 123ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=906194&d=redcanary.com&u=D99819B83EF8948FAB1A46FA76ACE4261&h=700aaba7c6b96305a8d416748ade6920&t=false Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=43200 x-content-type-options nosniff via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Tue, 19 Nov 2024 03:49:21 GMT content-type image/gif server gnv02c
GET H2	200	en.json Show response cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7b56-a219-15caf79db780/	85 KB 16 KB	38ms 38ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/40393661-0639-4e13-9774-ba9e2ae459fa/019243fc-61e4-7b56-a219-15caf79db780/en.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d63a700995ae394d95bff31531a3492a2392adcf2733dd5df74016b64a689394 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 9Xv1ejeZ+95nBH1dFm+7FA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip cf-cache-status HIT etag 0x8DCF76BB8992A0A age 25823 x-ms-lease-status unlocked x-content-type-options nosniff x-ms-version 2009-09-19 expires Wed, 20 Nov 2024 03:49:21 GMT date Tue, 19 Nov 2024 03:49:21 GMT content-type application/json last-modified Mon, 28 Oct 2024 16:15:21 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=86400 cross-origin-resource-policy cross-origin, cross-origin x-ms-request-id 61b2b900-901e-00ce-5554-29f5c5000000 cf-ray 8e4d3ad769b04db9-FRA accept-ranges bytes access-control-allow-origin * content-length 16231 x-ms-blob-type BlockBlob server cloudflare
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	37ms 36ms	Script application/x-javascript	104.82.89.248 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.82.89.248 Hamburg, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-82-89-248.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Cache-Control max-age=8640000 Content-Encoding gzip ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Connection keep-alive Expires Thu, 27 Feb 2025 03:49:21 GMT Accept-Ranges bytes P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Length 4741 Date Tue, 19 Nov 2024 03:49:21 GMT Content-Type application/x-javascript Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage Vary Accept-Encoding
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	40ms 39ms	Stylesheet text/css	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=14400 content-encoding gzip cf-cache-status HIT etag "28e04f9-3437-62370c030d900" age 6781 x-content-type-options nosniff cf-ray 8e4d3ad789c1dc50-FRA expires Tue, 19 Nov 2024 07:49:21 GMT accept-ranges bytes content-length 2623 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css last-modified Tue, 01 Oct 2024 21:10:28 GMT vary Accept-Encoding server cloudflare
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 393 B	36ms 35ms	Stylesheet text/css	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=14400 content-encoding gzip cf-cache-status HIT etag "28e0500-33c-62370c030d900" age 6781 x-content-type-options nosniff cf-ray 8e4d3ad789c2dc50-FRA expires Tue, 19 Nov 2024 07:49:21 GMT accept-ranges bytes content-length 246 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css last-modified Tue, 01 Oct 2024 21:10:28 GMT vary Accept-Encoding server cloudflare
POST H2	204	collect region1.analytics.google.com/g/	0 0	455ms 29ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835za200&_p=1731988161035&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=1975869849.1731988161&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1731988161&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1118 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 552 B	466ms 30ms	Ping text/plain	2a00:1450:400c:c0d::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-T3K4MTNQJN&cid=1975869849.1731988161&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0d::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/plain server Golfe2
POST H2	204	collect region1.analytics.google.com/g/	0 0	448ms 28ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835za200&_p=1731988161035&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=1975869849.1731988161&ecid=2041907332&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EA&_s=1&sid=1731988161&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1124 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 57 B	461ms 31ms	Ping text/plain	2a00:1450:400c:c0d::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S6W6WXK4G8&cid=1975869849.1731988161&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0d::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/plain server Golfe2
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	77ms 35ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-T3K4MTNQJN&cid=1975869849.1731988161&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=1322902751 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Tue, 19 Nov 2024 03:49:21 GMT x-xss-protection 0 content-type image/gif server cafe
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	75ms 33ms	Image image/gif	2a00:1450:4001:82f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S6W6WXK4G8&cid=1975869849.1731988161&gtm=45je4be0v874113835za200&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102077855&tag_exp=101925629~102067555~102067808~102077855&z=1925321355 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Tue, 19 Nov 2024 03:49:21 GMT x-xss-protection 0 content-type image/gif server cafe
GET		cf38b4a6-2e48-4fa9-bde8-3152b93e1672 https://redcanary.com/ Frame	0 0
GET H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	114ms 113ms	Image image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=D99819B83EF8948FAB1A46FA76ACE4261&s=1731988160&ed=%7B%22sr%22%3A%221600x1200%22%2C%22sc%22%3A24%2C%22de%22%3A%22UTF-8%22%2C%22ul%22%3A%22de-de%22%2C%22r%22%3A%22%22%2C%22lt%22%3A1731988161826%2C%22tO%22%3A-1%2C%22tz%22%3A%22Europe%2FBerlin%22%7D&cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&r=0&p=1&cq=0&vn=undefined&vns=undefined&vno=undefined&eTime=1731988160832&v=d1d41ec36 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Tue, 19 Nov 2024 03:49:21 GMT content-type image/gif server gnv02c
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	1239ms 195ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1731988161837&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1731988161836-39172&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers Transfer-Encoding chunked X-Request-Id fb586b54-03ce-42f3-b124-a376862d471b Content-Encoding gzip Connection keep-alive Access-Control-Allow-Origin * Date Tue, 19 Nov 2024 03:49:22 GMT Content-Type text/plain; charset=UTF-8 Server nginx/1.20.1
GET H2	200	otFlat.json Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/	13 KB 3 KB	33ms 32ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otFlat.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d890abf66010907c7a0a61236d25c3c98bcb7edec34b13dc887f5be122bfef7e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 CDHNBOyaHPNE3EDr/Gzy5w== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719DDD38B75 x-ms-lease-status unlocked cf-cache-status HIT age 71173 x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:21 GMT content-type application/json last-modified Mon, 28 Oct 2024 06:29:24 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 6ad5bc0e-201e-00ba-3054-297383000000 cf-ray 8e4d3adb9b4a4db9-FRA accept-ranges bytes access-control-allow-origin * content-length 3003 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otPcTab.json Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/	64 KB 14 KB	31ms 30ms	Fetch application/json	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/v2/otPcTab.json Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4016f0eb8333275dd19d417256d10f1baeb5185536d43503f5e0f54e3253e71d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 J9cjcrf32jBnxJwfqNot4g== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCF719DF6146F7 x-ms-lease-status unlocked cf-cache-status HIT age 86130 x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:21 GMT content-type application/json last-modified Mon, 28 Oct 2024 06:29:27 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id fb4b6dae-d01e-00c9-3f54-290340000000 cf-ray 8e4d3adb9b4c4db9-FRA accept-ranges bytes access-control-allow-origin * content-length 13789 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	otCommonStyles.css Show response cdn.cookielaw.org/scripttemplates/202409.2.0/assets/	24 KB 4 KB	36ms 36ms	Fetch text/css	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/scripttemplates/202409.2.0/assets/otCommonStyles.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e2afa04c9a3e080712c94d68b9c1d33587fddcbaeaba9dfcaf1d53d19f6a280a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 A9jekd5UoO8SyzJ6LiStug== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 71247 content-encoding gzip x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css last-modified Mon, 28 Oct 2024 06:29:35 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id f24689cd-a01e-00e4-4f54-298080000000 cf-ray 8e4d3adb9b4e4db9-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css redcanary.com/wp-content/cache/autoptimize/css/	5 MB 0	0ms 0ms	Stylesheet text/css	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6438b16f2375488bf0208a69b27fe17b3119b1772be376966663f9014b7e14e6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"672bc674-53ed07" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 06 Nov 2024 19:41:40 GMT
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame CF35	2 KB 890 B	280ms 280ms	Document text/html	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control max-age=3600 cf-cache-status DYNAMIC cf-ray 8e4d3adc1f48dc50-FRA content-encoding gzip content-type text/html; charset=utf-8 date Tue, 19 Nov 2024 03:49:22 GMT server cloudflare vary Accept-Encoding x-content-type-options nosniff
GET H2	200	CanarySans-Display-400.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	414ms 410ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-400.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c8794253f4669bc181f3401651637f6a14f68ea3ffd1bd18a8e46abaac6308ac Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fc-5b10" accept-ranges bytes access-control-allow-origin * content-length 23312 date Tue, 19 Nov 2024 03:49:22 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:16 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Text-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 0	5ms 5ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 2920a21f3d5f1c34cc38823f2c4422d1a0d23cba63233e5e8c382852aa7ada7c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06305-5acc" accept-ranges bytes access-control-allow-origin * content-length 23244 date Tue, 19 Nov 2024 03:49:21 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:25 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Display-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	271ms 268ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash df064dd6edad0cdc26f0a3abc83b8d5d5b173a41d6b88d8d242823055da2124d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fe-5b1c" accept-ranges bytes access-control-allow-origin * content-length 23324 date Tue, 19 Nov 2024 03:49:22 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:18 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Display-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	415ms 412ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 52ce30c1ca4a370f850fadf51868d1792a6e6a81f9488f67b993cc7d2921d187 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fb-5acc" accept-ranges bytes access-control-allow-origin * content-length 23244 date Tue, 19 Nov 2024 03:49:22 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:15 GMT server nginx vary Accept-Encoding
GET H2	200	CanarySans-Text-400.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 0	5ms 5ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-400.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 9a5b8f66f586ce4d9566503535595800d6d4c8b6e1651ab8b2fbf8f02819ef42 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06303-5a48" accept-ranges bytes access-control-allow-origin * content-length 23112 date Tue, 19 Nov 2024 03:49:21 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:23 GMT server nginx vary Accept-Encoding
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	161ms 156ms	Image image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "5c76b1ef-40da2" accept-ranges bytes access-control-allow-origin * content-length 265634 date Tue, 19 Nov 2024 03:49:22 GMT content-type image/png last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx vary Accept-Encoding
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 435 B	306ms 301ms	Image image/svg+xml	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"61394254-a1" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:22 GMT content-type image/svg+xml vary Accept-Encoding, Accept-Encoding server nginx last-modified Wed, 08 Sep 2021 23:08:04 GMT
GET H2	200	CanarySans-Text-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	22 KB 23 KB	416ms 413ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 6a2fae6141cd3c337ae20368ec6c6d16bcd1774b42c9cf6ef2b79f4ce7a67710 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06302-5998" accept-ranges bytes access-control-allow-origin * content-length 22936 date Tue, 19 Nov 2024 03:49:22 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:22 GMT server nginx vary Accept-Encoding
GET H2	200	destination Show response www.googletagmanager.com/gtag/	287 KB 99 KB	38ms 37ms	Script application/javascript	2a00:1450:4001:81c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/destination?id=AW-759876114&l=dataLayer&cx=c&gtm=45He4be0v813277038za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fa62b207ac101380738c75575bf560013cc33ca4f8c3fdcab7b0c1a0feed1996 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],} expires Tue, 19 Nov 2024 03:49:22 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Tue, 19 Nov 2024 03:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 100724 x-xss-protection 0 server Google Tag Manager
POST H3	200	collect www.google.com/ccm/	0 0	158ms 33ms	Ping text/plain	2a00:1450:4001:80b::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=218317117.1731988162&auid=271651845.1731988162&npa=1&gtm=45He4be0v813277038za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&tft=1731988162041&tfd=1886&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	145ms 22ms	Script application/javascript	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Tue, 19 Nov 2024 03:49:22 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H2	200	bat.js Show response bat.bing.com/	50 KB 15 KB	171ms 48ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding gzip etag "028e0691d20db1:0" accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: DA28C9E5F6BF4756BB5060A1BA73C41C Ref B: FRA31EDGE0707 Ref C: 2024-11-19T03:49:22Z accept-ranges bytes x-cache CONFIG_NOCACHE content-length 14570 date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript last-modified Wed, 16 Oct 2024 22:47:44 GMT vary Accept-Encoding
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	189ms 37ms	Script application/javascript	2a02:26f0:3500:10::210:a99 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:10::210:a99 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=41340 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Tue, 19 Nov 2024 03:49:22 GMT last-modified Thu, 22 Aug 2024 10:43:55 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	139ms 28ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Tue, 19 Nov 2024 03:49:22 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 00:10:26 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kiad7000084-IAD, cache-fra-etou8220137-FRA x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	113ms 25ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 43a683165a27224ef2d2717bd57c8c203aa570ce39140504d086562eefbb0f1f Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-4XMnEEP0' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-4XMnEEP0' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups;report-to="coop_report" x-fb-connection-quality EXCELLENT; q=0.9, rtt=24, rtx=0, c=23, mss=1232, tbw=4560, tp=11, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug TQNCA1HHs3a2KOrWQaTvs97Gt3QEiWIKtrkkiirv+9Pbn18ep/1JmY0nOUSR5AOUyaBt+QWPcozL0gPY/ogvdw== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62152 x-xss-protection 0 origin-agent-cluster ?1
POST H2	204	collect region1.analytics.google.com/g/	0 0	30ms 29ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-S6W6WXK4G8&gtm=45je4be0v874113835z8813277038za200&_p=1731988161035&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=1975869849.1731988161&ecid=2041907332&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&ec_mode=a&_eu=EAAC&_s=2&sid=1731988161&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&en=page_view&_et=806&tfd=1936 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:22 GMT content-type text/plain server Golfe2
POST H2	200	assign tracking.g2crowd.com/attribution_tracking/conversions/	0 0	146ms 140ms	Ping text/html	2606:4700::6812:1eb0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://tracking.g2crowd.com/attribution_tracking/conversions/assign Requested by Host: tracking.g2crowd.com URL: https://tracking.g2crowd.com/attribution_tracking/conversions/5354.js?p=https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/&e= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1eb0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryGjEneWfMrJZXSCAC Referer https://redcanary.com/ Response headers
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=1721967417024414272	4 B 280 B	525ms 372ms	Image application/json	2600:9000:206f:c200:5:7a81:86c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=1721967417024414272 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Server 2600:9000:206f:c200:5:7a81:86c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers via 1.1 980059f199bdd603b925d049efedf130.cloudfront.net (CloudFront) apigw-requestid BeaekguhoAMEbgw= alt-svc h3=":443"; ma=86400 x-cache Miss from cloudfront content-length 4 x-amz-cf-id yrKvz9bs_eH3X3blISeAcYKHl79Stfm_Qw9O-lZHhz4k7uGfxhx4UQ== date Tue, 19 Nov 2024 03:49:23 GMT content-type application/json x-amz-cf-pop FRA56-C1 Redirect headers cache-control no-store, no-cache, private location https://attr.ml-api.io/?domain=redcanary.com&pId=1721967417024414272 pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 217.114.215.131; 217.114.215.131; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin * an-x-request-uuid 4be0176c-1ff2-4f20-9821-00df1f737820 content-length 0 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Tue, 19 Nov 2024 03:49:22 GMT x-xss-protection 0 content-type text/html; charset=utf-8 server nginx/1.23.4
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4al0/ Frame A13D	0 0	102ms 22ms	Document text/html	2a00:1450:4001:81c::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4al0/sw_iframe.html?origin=https%3A%2F%2Fredcanary.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 6245 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Tue, 19 Nov 2024 02:05:17 GMT expires Wed, 19 Nov 2025 02:05:17 GMT last-modified Mon, 21 Oct 2024 16:58:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame CF35	199 KB 0	0ms 0ms	Script application/x-javascript	104.17.74.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0e1bfe53260b5fa35318df2850a20f74c97d41af88b7d233d331811d842f26d3 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://resource.redcanary.com/index.php/form/XDFrame Response headers cache-control public, max-age=14400 content-encoding gzip cf-cache-status HIT etag "2d803a3-31b73-6265f6525d19f" age 408 x-content-type-options nosniff cf-ray 8e4d3ad6184cdc50-FRA expires Tue, 19 Nov 2024 07:49:20 GMT date Tue, 19 Nov 2024 03:49:20 GMT content-type application/x-javascript last-modified Fri, 08 Nov 2024 04:43:40 GMT vary Accept-Encoding server cloudflare
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_5kac730w/	3 B 124 B	176ms 32ms	XHR application/json	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_5kac730w/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/json
GET H2	200	t2_5kac730w_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	91ms 37ms	XHR application/json	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_5kac730w_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	278ms 135ms	Image image/gif	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1731988162425&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=315d10de-edc9-43aa-add0-df2f4422999e&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Tue, 19 Nov 2024 03:49:22 GMT content-type image/gif server Varnish
GET H2	200	adsct t.co/1/i/	43 B 626 B	293ms 154ms	Image image/gif	172.66.0.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2612%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=2df6a45e-73bd-4173-98b0-f20dec4c18ac&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f668141f-d491-41c1-89ca-d8a8c8ad6542&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=0 x-transaction-id 0c29393629a5a6d5 cache-control no-cache, no-store, max-age=0 x-connection-hash 519cdf97e4da8c677cc0cbaa5d091877695f6232ec9c24d9f7d2892465ee16ac cf-cache-status DYNAMIC cf-ray 8e4d3ae01a29dcb5-FRA x-response-time 114 content-length 43 date Tue, 19 Nov 2024 03:49:22 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 725 B	241ms 140ms	Image image/gif	104.244.42.3 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FBerlin%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2612%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=2df6a45e-73bd-4173-98b0-f20dec4c18ac&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f668141f-d491-41c1-89ca-d8a8c8ad6542&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tw_iframe_status=0&txn_id=o015g&type=javascript&version=2.3.31 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.3 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id fe7cb67f26d22c15 cache-control no-cache, no-store, max-age=0 x-connection-hash 765cedabc4046a62833256f61959cd455c2c2e2e2dddb52ab21f23d67c61e1f3 x-response-time 112 content-length 43 date Tue, 19 Nov 2024 03:49:21 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H3	200	1042590016249604 Show response connect.facebook.net/signals/config/	69 KB 14 KB	78ms 78ms	Script application/x-javascript	2a03:2880:f083:100:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.177&r=stable&domain=redcanary.com&hme=c3e4904c1dde42d643265ef909b9e193c41cedcd6f559a3ff5e1b178e36647fa&ex_m=70%2C121%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C172%2C175%2C187%2C183%2C184%2C186%2C29%2C101%2C53%2C77%2C185%2C167%2C170%2C180%2C181%2C188%2C131%2C41%2C189%2C190%2C34%2C143%2C15%2C50%2C195%2C194%2C133%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C168%2C171%2C140%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 8997c9dfaa3dc538dac8929c403a166a5366fc508954435e7b6ec0940153ead7 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-ymp3RVj0' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-ymp3RVj0' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=22, rtx=0, c=77, mss=1232, tbw=70510, tp=68, tpl=0, uplat=51, ullat=0 pragma public x-fb-debug 1AsoySeVWHAt5oKxUaQ8lzx5I8KSpC7JAbLFoWhglBvVM0ytP3UZWUgr4Se33TBfQhXzlfST9QdrEevi2Dz4dQ== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
POST H2	204	/ Show response px.ads.linkedin.com/wa/	0 615 B	330ms 206ms	XHR text/plain	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/wa/ Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://redcanary.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Content-Type text/plain;charset=UTF-8 Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 585B68A2E91C45A5978DB9119FDC0754 Ref B: FRAEDGE1107 Ref C: 2024-11-19T03:49:22Z x-li-fabric prod-lor1 access-control-allow-credentials true x-li-uuid AAYnO+swy89ywg/MrAJyAg== x-li-proto http/2 access-control-allow-origin https://redcanary.com x-cache CONFIG_NOCACHE date Tue, 19 Nov 2024 03:49:22 GMT vary Origin
GET H2	200	56383426.js Show response bat.bing.com/p/action/	363 B 412 B	49ms 48ms	Script application/javascript	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a1fec7acc9e28feaa2280cd08d30cab4cac8e9557fb8fb35ab6ffcd1e28fade8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 content-encoding br accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 3608995A61204DA68998FEF98DFD39C6 Ref B: FRA31EDGE0707 Ref C: 2024-11-19T03:49:22Z x-cache CONFIG_NOCACHE date Tue, 19 Nov 2024 03:49:21 GMT content-type application/javascript; charset=utf-8 vary Accept-Encoding
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 1 KB	287ms 176ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept * Referer https://redcanary.com/ Response headers content-encoding gzip x-li-fabric prod-ltx1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} access-control-allow-methods GET, OPTIONS x-li-proto http/2 x-cache CONFIG_NOCACHE date Tue, 19 Nov 2024 03:49:22 GMT content-type application/json access-control-allow-headers * x-li-pop afd-prod-ltx1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-fs-uuid 0006273beb309df9a10d81f63ec54839 x-msedge-ref Ref A: 578BAEAA51114B918EC522DEB1525F42 Ref B: FRAEDGE2015 Ref C: 2024-11-19T03:49:22Z x-restli-protocol-version 1.0.0 x-li-uuid AAYnO+swnfmhDYH2PsVIOQ== access-control-allow-origin *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2 https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2&e_ipv6=AQLFMb...	0 266 B	273ms 183ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2&e_ipv6=AQLFMbrFYM-mtQAAAZNCighrqj0Kx4ujXDGBOb9a5fVHcokKstQTE7k6hlc8lmkkime8wC32Zs1_CcuKcLkYeadi8s4I8Q Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers linkedin-action 1 x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 810AC7808D3F41AA84F3499C524E672B Ref B: DUS30EDGE0820 Ref C: 2024-11-19T03:49:22Z x-li-fabric prod-ltx1 x-li-uuid AAYnO+s03nrevmuZoCdXMw== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 19 Nov 2024 03:49:22 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-ltx1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1731988162456&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&tm=gtmv2&e_ipv6=AQLFMbrFYM-mtQAAAZNCighrqj0Kx4ujXDGBOb9a5fVHcokKstQTE7k6hlc8lmkkime8wC32Zs1_CcuKcLkYeadi8s4I8Q x-msedge-ref Ref A: 072F0D5815414B938816856B33C858ED Ref B: FRAEDGE1107 Ref C: 2024-11-19T03:49:22Z x-li-fabric prod-ltx1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-uuid AAYnO+swxC+5MgAkYdmkdg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 19 Nov 2024 03:49:22 GMT
GET H3	200	/ www.facebook.com/tr/	0 19 B	134ms 23ms	Image text/plain	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&rl=&if=false&ts=1731988162531&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731988162530.931750743280998787&ler=empty&cdl=API_unavailable&it=1731988162439&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=20, rtx=0, c=23, mss=1232, tbw=4612, tp=12, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Tue, 19 Nov 2024 03:49:22 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 195 B	304ms 193ms	Image image/png	2a03:2880:f176:181:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&rl=&if=false&ts=1731988162531&sw=1600&sh=1200&v=2.9.177&r=stable&ec=0&o=12318&fbp=fb.1.1731988162530.931750743280998787&ler=empty&cdl=API_unavailable&it=1731988162439&coo=false&rqm=FGET Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f176:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7438832514004118008"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:22 GMT content-type image/png vary Accept-Encoding x-fb-debug gQMi5ml0+c5du6CiOZxCDvtB57jpLXmAmD8KpvUcxIkvDkac+9ia/OOJtqBGYDsCm0rYsYZ9nhJGcmdVLFFS/A== priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7438832514004118008", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality EXCELLENT; q=0.9, rtt=20, rtx=0, c=23, mss=1232, tbw=4980, tp=15, tpl=0, uplat=171, ullat=0 cross-origin-opener-policy same-origin-allow-popups pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top cross-origin-opener-policy-report-only restrict-properties;report-to="coop_report" x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ipv cdn.bizible.com/	43 B 328 B	34ms 34ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=fe9fbd8b1eef479890b0f9fbca97d2c4&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&_biz_t=1731988161051&_biz_i=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&_biz_n=0&a=redcanary.com&rnd=917734&cdn_o=a&_biz_z=1731988163106 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B77) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 282832 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Tue, 19 Nov 2024 03:49:23 GMT content-type Image/GIF last-modified Fri, 15 Nov 2024 21:15:31 GMT server ECS (amb/6B77)
GET H2	200	u cdn.bizibly.com/	43 B 204 B	47ms 33ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=fe9fbd8b1eef479890b0f9fbca97d2c4&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&_biz_t=1731988163108&_biz_i=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&a=redcanary.com&rnd=213686&cdn_o=a&_biz_z=1731988163109 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B7E) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 282797 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Tue, 19 Nov 2024 03:49:23 GMT content-type Image/GIF last-modified Fri, 15 Nov 2024 21:16:06 GMT server ECS (amb/6B7E)
GET H3	200	nc-61dc49ec658dadeff970ff1e789f1da4br.js Show response dev.visualwebsiteoptimizer.com/cdn/edrv/	18 KB 5 KB	30ms 29ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/edrv/nc-61dc49ec658dadeff970ff1e789f1da4br.js Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 8b1e99a837f85ce645c80aae729f6009d78c6ae46386b4b0fcf149d167f3ef26 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=OuqLZw==, md5=9sJwJdJwW7FryJfWU4IxfA== etag "f6c27025d2705bb16bc897d65382317c" age 66495 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 5596 date Mon, 18 Nov 2024 09:21:08 GMT last-modified Mon, 18 Nov 2024 08:10:39 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC47e72lPG0GGPWq5nAEfns-vGDmXidn2W32BMDIfgS9mgW0DMiHB8PHhd6SA6nWSdjRYygt-mKzlg cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731917439347272 content-length 5596 content-language en server UploadServer
GET H2	200	ot_close.svg cdn.cookielaw.org/logos/static/	651 B 625 B	34ms 31ms	Image image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/ot_close.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 pcXWFGpuVeSg/jVnYCseRg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 73321 content-encoding gzip x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:23 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 264b949d-801e-00bc-094a-3784fb000000 cf-ray 8e4d3ae43f0dd2cf-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	CanarySans-Display-600.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	153ms 149ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Display-600.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 3af06755c87e9490cafd32e49064834e94096021de3b7b53458e3384dcf7bf47 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f062fe-5bf4" accept-ranges bytes access-control-allow-origin * content-length 23540 date Tue, 19 Nov 2024 03:49:23 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:18 GMT server nginx vary Accept-Encoding
GET H2	200	ot_guard_logo.svg Show response cdn.cookielaw.org/logos/static/	497 B 518 B	36ms 34ms	Fetch image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/scripttemplates/202409.2.0/otBannerSdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 tXyZydHjxQshFMbbBT1/8A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 86129 content-encoding gzip x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:23 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id d60f72d6-101e-00f6-6a20-37b49c000000 cf-ray 8e4d3ae46f754db9-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	200	ot_company_logo.png cdn.cookielaw.org/logos/static/	4 KB 4 KB	44ms 39ms	Image image/png	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/ot_company_logo.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a335fc1da4a5ffc1fcacfa3eab57506faa41f026954496becb59cf5fbcd99d0e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 E8+sk/ECzKgTUVtDLikiIA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DD04E9B945DA9C age 85199 cf-cache-status HIT x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:23 GMT content-type image/png last-modified Thu, 14 Nov 2024 20:20:03 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 590207a8-101e-003a-1f91-37d029000000 cf-ray 8e4d3ae47f5fd2cf-FRA accept-ranges bytes access-control-allow-origin * content-length 4036 x-ms-blob-type BlockBlob server cloudflare
GET H2	200	powered_by_logo.svg cdn.cookielaw.org/logos/static/	5 KB 2 KB	45ms 40ms	Image image/svg+xml	2606:4700::6812:572a CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.cookielaw.org/logos/static/powered_by_logo.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:572a , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-md5 Y+c301RBZNK39PvKQWrIBw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked cf-cache-status HIT age 76628 content-encoding gzip x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:23 GMT content-type image/svg+xml last-modified Thu, 14 Nov 2024 20:20:04 GMT vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control max-age=86400 cross-origin-resource-policy cross-origin x-ms-request-id 73a8f2e6-f01e-003b-5eea-36d1d4000000 cf-ray 8e4d3ae47f60d2cf-FRA access-control-allow-origin * x-ms-blob-type BlockBlob server cloudflare
GET H2	204	0 bat.bing.com/action/	0 288 B	52ms 51ms	Image text/plain	2620:1ec:33:1::10 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=77509ba1-6b2d-45a0-8ddb-bbfc901535b2&bo=1&sid=43c59940a62911efa04301079130578b&vid=43c5bbd0a62911ef8427b51c1f02ea88&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&r=&lt=3104&evt=pageLoad&sv=1&cdb=AQET&rn=121645 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, must-revalidate pragma no-cache accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: D9F0EA3F8A99491D8C41FA49BB59C692 Ref B: FRA31EDGE0707 Ref C: 2024-11-19T03:49:23Z expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * x-cache CONFIG_NOCACHE date Tue, 19 Nov 2024 03:49:22 GMT
GET H2	200	f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Show response j.6sc.co/j/	5 KB 2 KB	566ms 421ms	Script application/javascript	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 805ce4322a9be88ec58266cf40c95f62920aadea2a0d00f6ddeda8f82df66b09 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip etag "e32c5c81f0cda4121d7ac50a6fa46548" x-amz-version-id ZP_GnDytUL9NRU7xM5CP6PgfirMXR58J expires Tue, 19 Nov 2024 04:19:23 GMT x-amz-cf-id hXNxXdSy60RAXtCMi4aF4F85DbwRAHrCbVWpIoBrHOEZ-_fC7crgTQ== date Tue, 19 Nov 2024 03:49:23 GMT last-modified Thu, 15 Feb 2024 19:15:51 GMT vary Accept-Encoding content-type application/javascript x-amz-meta-content-type application/json cache-control private, max-age=1800 accept-ranges bytes content-length 1566 x-amz-cf-pop FRA60-P8 server AmazonS3 x-amz-server-side-encryption AES256
GET H3	200	track-26c93666cadd42d35a525458cedd33edbr.js Show response dev.visualwebsiteoptimizer.com/cdn/7.0/	17 KB 5 KB	40ms 39ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/7.0/track-26c93666cadd42d35a525458cedd33edbr.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 18ee167e628f3d1637fc06e5fa234d5eb464088a3f233a679859ec23c21e179a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=96Q88g==, md5=yd7Se2BKGY2G8QE6t1jSTA== etag "c9ded27b604a198d86f1013ab758d24c" age 64620 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 4842 date Mon, 18 Nov 2024 09:52:23 GMT last-modified Mon, 18 Nov 2024 08:38:09 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC6ZIZk3erWmjPiRv5OJizxOHyFFu-VO6e7xMMomTZNabOojIv1H_q8kCFAYsuckihKaUvoVdIcIJQ cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731919089501557 content-length 4842 content-language en server UploadServer
GET H3	200	opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	157 KB 40 KB	41ms 41ms	Script text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 32f40b8bc8e2ca8b2a2822d6378716b9b130575afe39b51e764bcaa5d357575a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=Md5CSQ==, md5=BY3q3XFcoJRgei/SQSwWMA== etag "058deadd715ca094607a2fd2412c1630" age 41464 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 40448 date Mon, 18 Nov 2024 16:18:19 GMT last-modified Mon, 18 Nov 2024 15:33:22 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC4Sna8RIzWmEv0OptU_43Q3Eu-xFmHplVGLPk4TPBi90fTyHxAEulK-AWtkq_RxOItBfbEuZsAeMg cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731944002067936 content-length 40448 content-language en server UploadServer
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 323 B	139ms 139ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=fe9fbd8b1eef479890b0f9fbca97d2c4&_biz_h=-1906410348&cdn_o=a&jsVer=4.24.11.11&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BC3) / Resource Hash 9a41434bed9c1942f895e711a674ba1f3f00d0b53394eb8ad622fe1eef24b1f7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control private, must-revalidate, max-age=21600 content-encoding gzip etag BA9D7793 p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 216 date Tue, 19 Nov 2024 03:49:23 GMT content-type text/javascript; charset=utf-8 vary Accept-Encoding server ECS (amb/6BC3)
GET H2	200	Forrester-Wave-Featured-Nav2_203x203-1.jpg redcanary.com/wp-content/uploads/2023/08/	13 KB 13 KB	164ms 150ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2023/08/Forrester-Wave-Featured-Nav2_203x203-1.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 5a7e4301988674bdfde552e51053fba690337f07233420265674976ee40dabe5 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "64d7fa0b-3273" accept-ranges bytes access-control-allow-origin * content-length 12915 date Tue, 19 Nov 2024 03:49:23 GMT content-type image/jpeg last-modified Sat, 12 Aug 2023 21:30:51 GMT server nginx vary Accept-Encoding
GET H2	200	product-cta4.jpg redcanary.com/wp-content/uploads/2024/05/	105 KB 106 KB	161ms 148ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2024/05/product-cta4.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7b386ad2debb9b701ec71427b4ec08dce25b898555d9c5d42e6d70bd2bf39fcc Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "6651228c-1a587" accept-ranges bytes access-control-allow-origin * content-length 107911 date Tue, 19 Nov 2024 03:49:23 GMT content-type image/jpeg last-modified Fri, 24 May 2024 23:28:12 GMT server nginx vary Accept-Encoding
GET H2	200	975x975_RedCanaryIntel.jpg redcanary.com/wp-content/uploads/2023/11/	28 KB 28 KB	330ms 317ms	Image image/jpeg	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2023/11/975x975_RedCanaryIntel.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 4a5982dad38a37c77bbd8973c94003e5cc8cd6425371606921858f662af52e92 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "654be4b6-7039" accept-ranges bytes access-control-allow-origin * content-length 28729 date Tue, 19 Nov 2024 03:49:23 GMT content-type image/jpeg last-modified Wed, 08 Nov 2023 19:42:46 GMT server nginx vary Accept-Encoding
GET H2	200	red-canary-logo.png redcanary.com/wp-content/themes/redcanary/assets/img/	13 KB 13 KB	162ms 149ms	Image image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/red-canary-logo.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash fdde1a262315097f4ff5b5ed0a1d2fcdd4b569ff0faa9a82aaeb5e7007781147 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65e68ad2-3404" accept-ranges bytes access-control-allow-origin * content-length 13316 date Tue, 19 Nov 2024 03:49:23 GMT content-type image/png last-modified Tue, 05 Mar 2024 03:00:34 GMT server nginx vary Accept-Encoding
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 665 B	1014ms 986ms	XHR text/html	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Accept */* Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers x-robots-tag noindex content-encoding br x-permitted-cross-domain-policies master-only x-content-type-options nosniff, nosniff expires Wed, 11 Jan 1984 05:00:00 GMT date Tue, 19 Nov 2024 03:49:24 GMT content-type text/html; charset=UTF-8 feature-policy microphone 'none'; geolocation 'none' vary Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN, deny strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control no-cache, must-revalidate, max-age=0, no-store access-control-allow-credentials true referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin access-control-allow-origin https://redcanary.com x-xss-protection 1; mode=block x-powered-by WP Engine server nginx
POST H3	200	s.gif dev.visualwebsiteoptimizer.com/	35 B 53 B	134ms 126ms	Ping image/gif	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/s.gif?account_id=906194&u=D99819B83EF8948FAB1A46FA76ACE4261&s=1731988160&p=1&update=1&cq=1&ttl=90&vn=undefined&vns=undefined&vno=undefined&eTime=1731988162337&v=d1d41ec36&_cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&random=0.4335837592131515 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff via 1.1 google expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 35 date Tue, 19 Nov 2024 03:49:22 GMT content-type image/gif server gnv02c
GET H2	200	u cdn.bizible.com/	43 B 86 B	52ms 28ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1731988161836-39172&_biz_u=fe9fbd8b1eef479890b0f9fbca97d2c4&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&_biz_t=1731988163109&_biz_i=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&_biz_n=1&a=redcanary.com&rnd=631506&cdn_o=a&_biz_z=1731988163382 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B7E) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSub Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers strict-transport-security max-age=31536000; includeSub cache-control no-cache, no-store pragma no-cache age 282797 expires -1 accept-ranges bytes x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-length 43 date Tue, 19 Nov 2024 03:49:23 GMT content-type Image/GIF last-modified Fri, 15 Nov 2024 21:16:06 GMT server ECS (amb/6B7E)
GET H3	200	worker-70faafffa0475802f5ee03ca5ff74179br.js Show response dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/	46 KB 13 KB	31ms 31ms	XHR text/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/worker-70faafffa0475802f5ee03ca5ff74179br.js Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software UploadServer / Resource Hash 09b67475f266dbf552159ca9f6b44d9dc3ea04842b2bd6e8b09d74f6b21897d0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers x-goog-metageneration 1 content-encoding br x-goog-hash crc32c=t9nekA==, md5=OTBW++nqbotSERjfhuer5A== etag "393056fbe9ea6e8b521118df86e7abe4" age 112363 x-goog-stored-content-encoding br alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-goog-stored-content-length 13401 date Sun, 17 Nov 2024 20:36:40 GMT last-modified Wed, 13 Nov 2024 11:34:11 GMT content-type text/javascript; charset=UTF-8 x-guploader-uploadid AFiumC4zEyPZTZxtmrJbsmFx9vY4EKX32RwKnzILeuDvqFW4ISoZXmOjnP5j9Enwe49RnLxefFoFAnzXFg cdn_cache_status hit cache-control public, max-age=31536000 x-goog-storage-class STANDARD accept-ranges bytes access-control-allow-origin * x-goog-generation 1731497651250858 content-length 13401 content-language en server UploadServer
GET H3	200	css fonts.googleapis.com/	8 KB 794 B	90ms 38ms	Stylesheet text/css	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 07ffe99bbad6a01eefc554124b34927e60911ed74c21b5bb4e7361ddfc4e2845 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:23 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:23 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Tue, 19 Nov 2024 03:24:05 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET		forms2.css resource.redcanary.com/js/forms2/css/	0 0
GET		forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	0 0
GET H3	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 0	0ms 0ms	Stylesheet text/css	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/ Response headers cf-cdnjs-via cfworker/kv content-encoding br cf-cache-status HIT etag "60215473-2fb" age 373186 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=doAJEr62am1uTqWmWMv64XYUrgjJ2%2FzvteXc9AClWZYSDWW1edwNsNTMAteXA754tqvkke%2BJ9%2BA91711nEuAF94Uv9LCvYCfC%2BiuG7syHf%2BSn%2FtrmjG%2BJ6zPJENHdGOYQnNbwkB468hWSMt%2Bv1kksAB0"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff expires Sun, 09 Nov 2025 03:49:21 GMT alt-svc h3=":443"; ma=86400 date Tue, 19 Nov 2024 03:49:21 GMT content-type text/css; charset=utf-8 last-modified Mon, 08 Feb 2021 15:10:43 GMT vary Accept-Encoding cache-control public, max-age=30672000 timing-allow-origin * nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} cross-origin-resource-policy cross-origin cf-ray 8e4d3ad6a998d27e-FRA accept-ranges bytes access-control-allow-origin * content-length 271 server cloudflare
GET H2	200	messenger app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame AFC8	0 0	442ms 350ms	Document text/html	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=bbb87e89-81aa-47bd-b3db-bd9e517ba0c5 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers cache-control max-age=0, private, must-revalidate cf-cache-status DYNAMIC cf-ray 8e4d3aea6cb44dc5-FRA content-encoding gzip content-security-policy content-type text/html; charset=utf-8 date Tue, 19 Nov 2024 03:49:24 GMT link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-ea37ea0f.chunk.css>; rel=preload; as=style; nopush referrer-policy strict-origin-when-cross-origin server cloudflare server-timing cfCacheStatus;desc="DYNAMIC" strict-transport-security max-age=63072000; includeSubDomains vary Accept-Encoding x-cache miss x-content-type-options nosniff x-download-options noopen x-envoy-upstream-service-time 24 x-permitted-cross-domain-policies none x-request-id 8a00a189-4bcb-4d7e-8307-d4263b5ed823 x-runtime 0.022794 x-xss-protection 1; mode=block
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	33ms 33ms	Script application/javascript	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/f3744a5e-342b-429c-9d2c-2c1b7b45310a.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash d5ecf2f6d5b7937dd1aa50165b89193436347d55cb130951d41e028b1f09d3af Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "66fb91ae-111bb" x-content-type-options nosniff expires Tue, 19 Nov 2024 06:49:23 GMT accept-ranges bytes content-length 18819 date Tue, 19 Nov 2024 03:49:23 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Tue, 01 Oct 2024 06:07:42 GMT
GET		7092dd17-11cd-4ed7-9521-3c40cef89054 https://redcanary.com/ Frame	0 0
GET H2	200	getuidj Show response secure.adnxs.com/	29 B 1 KB	49ms 37ms	XHR application/json	185.89.210.82 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.23.4 / Resource Hash c6592fd8f3faec09bb5df56b25582e4897a2becac9b3580ea9c247fc65062e71 Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 217.114.215.131; 217.114.215.131; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://redcanary.com an-x-request-uuid 5c8c2b4f-96ff-46f3-ae03-fd67fe99f099 content-length 29 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Tue, 19 Nov 2024 03:49:24 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H2	200	/ Show response c.6sc.co/	7 B 191 B	48ms 34ms	XHR text/html	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers access-control-max-age 86400 access-control-allow-credentials true access-control-allow-methods GET,POST access-control-allow-origin https://redcanary.com content-length 7 date Tue, 19 Nov 2024 03:49:24 GMT content-type text/html access-control-allow-headers *
GET H2	200	/ Show response ipv6.6sc.co/	36 B 333 B	132ms 21ms	XHR text/html	2a02:26f0:7100::210:172 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::210:172 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash af80fc0b1f9076e5a910d6fd9e5944c741e4d395cd5de8d56d7f3dc0289fa745 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:1b60:1010:3:1011:6015:2374:5cab expires Tue, 19 Nov 2024 03:49:24 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1731988164177_34603374_2338143_17_658_22_58_219";dur=1 access-control-allow-origin https://redcanary.com content-length 36 date Tue, 19 Nov 2024 03:49:24 GMT content-type text/html vary Origin
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	146ms 120ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:24 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:24 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	162ms 136ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22565ffb1efc5e75f417d1fe1c2134f835%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22e8bebcdaa132f727ae8d16d9967447769318945e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22f3744a5e-342b-429c-9d2c-2c1b7b45310a%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableMapCookieCapture%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:24 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:24 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	132ms 130ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:24 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:24 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	details Show response eps.6sc.co/v3/company/	784 B 670 B	112ms 64ms	XHR application/json	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 410393946a5d786f532cc1ae838af674c6f24a1b32e1f258b946024b968508f8 Request headers Authorization Token e8bebcdaa132f727ae8d16d9967447769318945e X-6s-CustomID WebTag f3744a5e-342b-429c-9d2c-2c1b7b45310a Referer https://redcanary.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://redcanary.com content-length 413 date Tue, 19 Nov 2024 03:49:24 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details eps.6sc.co/v3/company/ Frame	0 0	121ms 26ms	Preflight	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Tue, 19 Nov 2024 03:49:24 GMT timing-allow-origin https://6sense.com x-6si-region
POST H2	200	analyze Show response r5.visualwebsiteoptimizer.com/	0 143 B	784ms 216ms	XHR application/javascript	35.186.187.8 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://r5.visualwebsiteoptimizer.com/analyze?_a=906194&_u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.186.187.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 8.187.186.35.bc.googleusercontent.com Software r5 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryR5EETCVWnDQNPJBz Referer https://redcanary.com/ Response headers access-control-allow-origin * content-encoding gzip date Tue, 19 Nov 2024 03:49:24 GMT content-type application/javascript; charset=UTF-8 server r5
GET H2	200	analytics.js Show response www.google-analytics.com/	52 KB 21 KB	98ms 23ms	Script text/javascript	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers content-encoding gzip age 1157 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],} x-content-type-options nosniff expires Tue, 19 Nov 2024 05:30:07 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:30:07 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 20994 server Golfe2
POST H3	204	collect region1.analytics.google.com/g/	0 0	38ms 37ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835z8813277038za200&_p=1731988161035&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=1975869849.1731988161&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EAAC&_s=2&sid=1731988161&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&en=page_view&_et=793&tfd=4365 Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H3 Security QUIC, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:24 GMT content-type text/plain server Golfe2
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 419 B	40ms 35ms	XHR text/plain	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1960506560&t=event&ni=1&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&ul=de-de&de=UTF-8&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAACAAI~&jid=792715232&gjid=1930295633&cid=1975869849.1731988161&tid=UA-52702906-1&_gid=699927906.1731988165&_r=1&_slc=1&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&npa=1&z=1343631736 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain Referer https://redcanary.com/ Response headers report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],} x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:24 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type text/plain cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0 access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 3 server Golfe2
GET H3	200	collect www.google-analytics.com/	35 B 58 B	38ms 38ms	Image image/gif	2a00:1450:4001:800::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j101&a=1960506560&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&ul=de-de&de=UTF-8&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAACAAI~&jid=&gjid=&cid=1975869849.1731988161&tid=UA-52702906-1&_gid=699927906.1731988165&gtm=45He4be0n81PXWC8JWv813277038za200&cd4=&cd5=&cd10=&cd11=&cd20=&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cd6=Germany&cd7=North%20Rhine-Westphalia&cd8=Sprockhoevel&cd9=&cd12=&cd13=&cd14=&cd18=null&npa=1&z=901163785 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers age 66799 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:163:0"}],} x-content-type-options nosniff expires Mon, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 18 Nov 2024 09:16:05 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:163:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 server Golfe2
GET H3	200	settings.js Show response dev.visualwebsiteoptimizer.com/dcdn/	17 KB 5 KB	38ms 37ms	Script application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/dcdn/settings.js?a=906194&settings_type=4&ts=1731968539&dt=desktop&cc=DE Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gfra1 / Resource Hash 54d22ecdaa288f30684260e84f6b5b436888934d1535a35620329ff55c10f7e1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cdn_cache_status revalidated cache-control public, max-age=1800, s-maxage=1800 content-encoding gzip etag W/"1731968539_EA" age 0 via 1.1 google not-modified true access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 5208 date Tue, 19 Nov 2024 03:49:24 GMT content-type application/javascript; charset=UTF-8 server gfra1
GET H2	200	favicon.png redcanary.com/wp-content/themes/redcanary/assets/img/	16 KB 16 KB	304ms 302ms	Other image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8b4532ddd365937e2ee31a95189a447d45881cf4dadf2ab66c850786f87774d8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "5c76b1ec-3fb8" accept-ranges bytes access-control-allow-origin * content-length 16312 date Tue, 19 Nov 2024 03:49:25 GMT content-type image/png last-modified Wed, 27 Feb 2019 15:51:08 GMT server nginx vary Accept-Encoding
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	121ms 117ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A24%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%221003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:25 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:25 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	analyze r5.visualwebsiteoptimizer.com/	35 B 257 B	325ms 108ms	Image image/gif	35.186.187.8 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://r5.visualwebsiteoptimizer.com/analyze?a=906194&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&duration=0&session_id=1731988160&recording_id=1&vn=4.0.340&rand=0.9989386781973255&end_time=1731988162136&jsonEn=%7B%22b64%22%3A%7B%22key%22%3A%220%252052%27%253E%253C%2Fsvg%253E%22%2C%22value%22%3A%22data%3Aimage%2Fsvg%2Bxml%2C%253Csvg%2520xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%2520viewBox%3D%270%25200%2520210%252052%27%253E%253C%2Fsvg%253E%22%7D%7D&eTime=1731988164136&fRS=true&re=%7B%222%22%3A%22D99819B83EF8948FAB1A46FA76ACE4261%22%7D&he=%7B%221%22%3A%22D99819B83EF8948FAB1A46FA76ACE4261%22%7D&v2=true&count=2 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.186.187.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 8.187.186.35.bc.googleusercontent.com Software r5 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate pragma no-cache x-content-type-options nosniff expires Mon, 10 Jan 2005 00:00:01 GMT access-control-allow-origin * content-length 35 date Tue, 19 Nov 2024 03:49:25 GMT content-type image/gif server r5
GET H2	200	favicon.ico redcanary.com/wp-content/themes/redcanary/assets/img/	1 KB 812 B	151ms 151ms	Other image/x-icon	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c3096f016b56aa58ea27707e5636618495175ed50b77c09b91c9cb5c014b79e2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 content-encoding br etag W/"65e68ad0-47e" access-control-allow-origin * date Tue, 19 Nov 2024 03:49:25 GMT content-type image/x-icon vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding server nginx last-modified Tue, 05 Mar 2024 03:00:32 GMT
GET H2	200	favicon-32x32.png redcanary.com/wp-content/themes/redcanary/assets/img/	1 KB 2 KB	149ms 149ms	Other image/png	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/favicon-32x32.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash a19b17e3c318b115a7531fd404bd12a49d65104d57a1efd064f5ae80b457f52f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65e68ad0-5c9" accept-ranges bytes access-control-allow-origin * content-length 1481 date Tue, 19 Nov 2024 03:49:25 GMT content-type image/png last-modified Tue, 05 Mar 2024 03:00:32 GMT server nginx vary Accept-Encoding
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	117ms 115ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A25%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:26 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:26 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	135ms 126ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A26%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%223007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:27 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:27 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	136ms 136ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A27%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:28 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:28 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	114ms 114ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A28%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:29 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:29 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
POST H3	204	collect region1.analytics.google.com/g/	0 0	31ms 30ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=45je4be0v874113835z8813277038za200&_p=1731988161035&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102077855&cid=1975869849.1731988161&ul=de-de&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=3&sid=1731988161&sct=1&seg=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&dt=Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware&en=company_details_6si&_et=2424&up.company_name_6si=(Non-company%20Visit)&up.country_6si=Germany&up.state_6si=North%20Rhine-Westphalia&up.city_6si=Sprockhoevel&up.industry_v2_6si=&up.segment_666498_6si=false&up.segment_673397_6si=false&tfd=9366 Requested by Host: dev.visualwebsiteoptimizer.com URL: https://dev.visualwebsiteoptimizer.com/cdn/analysis/4.0/opa-ecf25b21ebb11aef88a2f98af67e5f85br.js Protocol H3 Security QUIC, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://redcanary.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:29 GMT content-type text/plain server Golfe2
POST H3	200	t dev.visualwebsiteoptimizer.com/events/	0 36 B	118ms 117ms	Ping application/javascript	34.96.102.137 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://dev.visualwebsiteoptimizer.com/events/t?en=vwo_errorOnPage&a=906194&v=d1d41ec36&_cu=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F Requested by Host: redcanary.com URL: https://redcanary.com/blog/threat-intelligence/confluence-exploit-ransomware/ Protocol H3 Security QUIC, , AES_128_GCM Server 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 137.102.96.34.bc.googleusercontent.com Software gnv02c / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://redcanary.com/ Response headers content-encoding gzip access-control-allow-methods GET, POST via 1.1 google access-control-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 19 Nov 2024 03:49:29 GMT content-type application/javascript; charset=UTF-8 server gnv02c access-control-allow-headers X-Device-User-Agent, Vwo-X-Forwarded-For
GET H2	200	98d95a423523306377f329f65410715dcbec610d14f2704afe66fce2c32247b9.png customer-assets.qualified.com/cdn-cgi/image/trim.left=0,trim.top=0,trim.width=1000,trim.height=1000/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/	409 KB 410 KB	61ms 41ms	Image image/png	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://customer-assets.qualified.com/cdn-cgi/image/trim.left=0,trim.top=0,trim.width=1000,trim.height=1000/uploads/7TUwM7shunt8z54WksUhaTzw8iRAHyAXobDVq/98d95a423523306377f329f65410715dcbec610d14f2704afe66fce2c32247b9.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7e8172af5137c21d52d9c84f62af871d691538ffb44348bba54e43502aebb6c7 Security Headers Name Value Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none' X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cf-cache-status HIT etag "cfwz85l6NqsIMaZMm_SN95lolJW9ZcwGWLRAQEkXgADQ:ecc2f2e45c425530c12e247c1eba9378" cf-bgj imgq:0,h2pri cf-resized internal=ok/h q=0 n=30+5 c=4+1 v=2024.10.6 l=418627 f=false x-content-type-options nosniff date Tue, 19 Nov 2024 03:49:29 GMT content-type image/png last-modified Mon, 18 Nov 2024 15:18:23 GMT vary Accept, Accept-Encoding priority u=4;i=?0,cf-chb=(58;u=5;i) content-security-policy default-src 'none'; navigate-to 'none'; form-action 'none' cache-control Cache-Control: public, max-age=31536000 cf-ray 8e4d3b0d2869d2db-FRA accept-ranges bytes content-length 418627 server cloudflare
GET H2	200	CanarySans-Text-600.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	23 KB 23 KB	300ms 296ms	Font font/woff2	104.198.136.223 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/CanarySans-Text-600.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 62d02c88b4232d936a5d2554226d043540fe3f4b4822aba7f82eb4c72c7eda51 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://redcanary.com Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_1aff4dedf8fd1385415cadd1fc9459fa.css Response headers strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-security-policy upgrade-insecure-requests cache-control public, max-age=31536000 etag "65f06305-5af4" accept-ranges bytes access-control-allow-origin * content-length 23284 date Tue, 19 Nov 2024 03:49:29 GMT content-type font/woff2 last-modified Tue, 12 Mar 2024 14:13:25 GMT server nginx vary Accept-Encoding
POST H2	200	analyze Show response r5.visualwebsiteoptimizer.com/	0 142 B	120ms 107ms	XHR application/javascript	35.186.187.8 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://r5.visualwebsiteoptimizer.com/analyze?_a=906194&_u=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.186.187.8 Washington, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 8.187.186.35.bc.googleusercontent.com Software r5 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryjMqLfDBVDiG1FUBg Referer https://redcanary.com/ Response headers access-control-allow-origin * content-encoding gzip date Tue, 19 Nov 2024 03:49:29 GMT content-type application/javascript; charset=UTF-8 server r5
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	117ms 114ms	Image image/gif	2.17.100.193 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=80a33713-5e3d-4824-8714-8edc6fb05bfc&session=c3da2369-dd9d-4bac-8b9e-6fb8ced218d7&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2019%20Nov%202024%2003%3A49%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226008%22%7D&isIframe=false&m=%7B%22description%22%3A%22Red%20Canary%20has%20detected%20apparent%20exploitation%20of%20Atlassian%20Confluence%20CVE-2023-22518%20in%20an%20attempted%20Cerber%20ransomware%20campaign.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Adversaries%20exploit%20Confluence%20vulnerability%20to%20deploy%20ransomware%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fthreat-intelligence%2Fconfluence-exploit-ransomware%2F&pageViewId=cf8575aa-7bd9-44a5-8669-d06052d5615c&an_uid=1721967417024414272&webTagId=f3744a5e-342b-429c-9d2c-2c1b7b45310a&ipv6=2001%3A1b60%3A1010%3A3%3A1011%3A6015%3A2374%3A5cab&v=1.1.29 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2.17.100.193 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-193.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://redcanary.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 19 Nov 2024 03:49:30 GMT accept-ranges bytes content-length 43 date Tue, 19 Nov 2024 03:49:30 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

redcanary.com

URL

blob:https://redcanary.com/cf38b4a6-2e48-4fa9-bde8-3152b93e1672

Domain

resource.redcanary.com

URL

https://resource.redcanary.com/js/forms2/css/forms2.css

Domain

resource.redcanary.com

URL

https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css

Domain

redcanary.com

URL

blob:https://redcanary.com/7092dd17-11cd-4ed7-9521-3c40cef89054