redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

9 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://t.co/TsSByPHrRC Page URL
2. https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=3693097596249936513

Request Chain 75

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1673502527204%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fintelligence-insights-december-2022%252F%253Futm_source%253Dtwitter%2526utm_medium%253Dsocial%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&cookiesTest=true&liSync=true

113 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	TsSByPHrRC t.co/	465 B 724 B	460ms 258ms	Document text/html	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Full URL https://t.co/TsSByPHrRC Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_l / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=0 X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control private,max-age=300 content-encoding gzip content-length 242 content-type text/html; charset=utf-8 date Thu, 12 Jan 2023 05:48:41 GMT expires Thu, 12 Jan 2023 05:53:42 GMT perf 7626143928 server tsa_l strict-transport-security max-age=0 vary Origin x-connection-hash 0cd76bc2000ec9d9bffcbf14d1d6c36cf7fdf7b8a62f63bb88dd62054a343390 x-response-time 159 x-transaction-id 9523c6e2561ce78d x-xss-protection 0
GET H2	200	Primary Request / Show response redcanary.com/blog/intelligence-insights-december-2022/	158 KB 27 KB	1515ms 555ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Requested by Host: t.co URL: https://t.co/TsSByPHrRC Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 724ba8e963ae234d0d0ce4c3c6e64d8fea1bf6952e2da1b0a3d9766a355829af Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Referer https://t.co/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Thu, 12 Jan 2023 05:48:43 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=33056>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security "max-age=63072000; includeSubDomains; preload"; vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding x-cache HIT: 6 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.1/	88 KB 31 KB	578ms 192ms	Script text/javascript	142.251.12.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.12.95 , United States, ASN15169 (GOOGLE, US), Reverse DNS se-in-f95.1e100.net Software sffe / Resource Hash a3cf00c109d907e543bc4f6dbc85eb31068f94515251347e9e57509b52ee3d74 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:02:06 GMT content-encoding gzip x-content-type-options nosniff age 2798 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31100 x-xss-protection 0 last-modified Thu, 08 Sep 2022 18:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 12 Jan 2024 05:02:06 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	208 KB 69 KB	1359ms 113ms	Script application/x-javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 6933 etag "2d4002b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 78839add3b95dfb3-SYD expires Thu, 12 Jan 2023 09:48:45 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	413ms 99ms	Script application/x-javascript	152.195.58.59 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.58.59 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nwa/E78A) / Resource Hash 1ae740ebbe1a0c68cdf60b2d5df40126d47e6c69d19bf794b8a99ad5ceb81992 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip last-modified Mon, 09 Jan 2023 19:32:36 GMT server ECS (nwa/E78A) age 29956 etag "c79199206124d91:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32327
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	6 KB 2 KB	323ms 108ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b944086ceb975b223f03d7c7a7564877a1034b35378ae07866771f2ab4f9cbe6 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip cf-cache-status HIT age 3225 cf-polished origSize=6088 ce-version 11.5.16 cf-bgj minify last-modified Thu, 12 Jan 2023 04:55:00 GMT server cloudflare vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 78839ae00bb0a971-SYD
GET H2	200	js Show response www.googletagmanager.com/gtag/	227 KB 79 KB	589ms 201ms	Script application/javascript	142.250.4.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f97.1e100.net Software Google Tag Manager / Resource Hash d646c51d77ae3468412ef644231d143105f76ea253c9131d96565e297f0fc8be Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 80023 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Thu, 12 Jan 2023 05:48:45 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	581ms 195ms	Stylesheet text/css	142.251.10.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.10.95 , United States, ASN15169 (GOOGLE, US), Reverse DNS sd-in-f95.1e100.net Software ESF / Resource Hash c89486a0c4b8c91529d5d3e2ce14f8501c467c13b3e571f613e1932590279bf9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 12 Jan 2023 05:48:44 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 12 Jan 2023 05:48:44 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 12 Jan 2023 05:48:44 GMT
GET H2	200	qualified.js Show response js.qualified.com/	197 KB 61 KB	316ms 108ms	Script text/javascript	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b0a981b555b918e3a83798ee840317b2004d283ea15d60ff21826d6dfdaed132 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip via 1.1 spaces-router (e13668ca8eb7) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status HIT x-content-type-options nosniff x-permitted-cross-domain-policies none age 13850 x-xss-protection 1; mode=block x-request-id b3c086c6-16f4-9852-228c-e646f9774ac4 x-runtime 0.018885 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"d4557783f3283337c8b21cbcb342242c" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 78839ae07b9aa892-SYD expires Thu, 12 Jan 2023 09:48:45 GMT
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	3 KB 1 KB	1329ms 781ms	Script application/javascript	18.65.216.9 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.65.216.9 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-216-9.nrt57.r.cloudfront.net Software envoy / Resource Hash d3afb61225cf41fb7e950369d6097cd1457b283b333100a0952aed1efdf62f78 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:44 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 80814d3806accb83cfb901833749383e.cloudfront.net (CloudFront) server envoy x-amz-cf-pop NRT57-P4 etag W/"7a0c9912f0babd17cf2b2081b4f7f3f7" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id NvvEeDTrbf2KQ7sXETTuSnsoYaxqfXoYZFxh5I9O16vfMEehgh-qDQ==
GET H2	200	autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css redcanary.com/wp-content/cache/autoptimize/css/	3 MB 191 KB	287ms 286ms	Stylesheet text/css	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash b4e6e7e244249d3452c9c3e1144b80c103b453363a483d9f3bf8cab075977eb3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:43 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Fri, 06 Jan 2023 19:07:56 GMT server nginx etag W/"63b8718c-364817" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	844ms 289ms	Script application/x-js	52.92.213.32 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.92.213.32 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:45 GMT x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Server AmazonS3 x-amz-request-id 1S02YQQ3NH2M53V9 ETag "bab0c2b3523f8244564b675fe34db610" Content-Type application/x-js Cache-Control public Accept-Ranges bytes Content-Length 41617 x-amz-id-2 fVXuYNL9KHkiwrSFFKTDdvPKuq2R5MQNFbuC9YxFXrcMGlQf6SjV67qlJSKh9UlhGoClaKcdNHk=
GET H2	200	autoptimize_3074cc154d59b86167832e47a794beb1.js Show response redcanary.com/wp-content/cache/autoptimize/js/	295 KB 84 KB	287ms 285ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_3074cc154d59b86167832e47a794beb1.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c68e7883087b31afe16d1b095644182e84f8228f0b6f60289b6072c00697ec22 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Fri, 06 Jan 2023 19:07:56 GMT server nginx etag W/"63b8718c-49c02" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	772ms 253ms	Script application/x-javascript	23.9.178.224 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.9.178.224 , Singapore, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-9-178-224.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:45 GMT Content-Encoding gzip Last-Modified Fri, 09 Sep 2022 01:18:39 GMT Server AkamaiNetStorage ETag "92b41a298690c047b0c4602dd843cba4:1662686319.691662" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Content-Length 728
GET H2	200	gtm.js Show response www.googletagmanager.com/	267 KB 89 KB	976ms 589ms	Script application/javascript	142.250.4.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f97.1e100.net Software Google Tag Manager / Resource Hash 8dc0e9eefa45a28f9a2b0983cc5d01cc8eb0e8098884e8437d19e82ffa374590 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 90859 x-xss-protection 0 last-modified Thu, 12 Jan 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 12 Jan 2023 05:48:45 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	31 KB 10 KB	856ms 270ms	Script application/javascript	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash eea93734d5f0032479fa252394415d53cbcd4e7bd6d54764543eaa8b7c9fd10c Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 01 Dec 2022 20:20:43 GMT server nginx/1.14.0 (Ubuntu) etag "63890c9b-7ad6" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 10143 expires Thu, 12 Jan 2023 05:48:45 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	0 29 B	1003ms 599ms	Script application/javascript	122.248.209.238 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 122.248.209.238 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-122-248-209-238.ap-southeast-1.compute.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT cache-control private, max-age=600 x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	168 KB 45 KB	808ms 404ms	Script application/javascript	122.248.209.238 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 122.248.209.238 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-122-248-209-238.ap-southeast-1.compute.amazonaws.com Software envoy / Resource Hash 6ff2617dfab351552a5eba560038571ee65a568c6dbe2ab301235c0100f1d968 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
GET H2	404	forms.js x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	0 0	807ms 403ms	Script application/javascript	122.248.209.238 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/forms.js?page_path=%2Fblog%2Fintelligence-insights-december-2022%2F Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 122.248.209.238 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-122-248-209-238.ap-southeast-1.compute.amazonaws.com Software envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	source-sans-pro-v21-latin-regular.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	546ms 543ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Origin https://redcanary.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:25 GMT server nginx etag "6298f2c1-32ec" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13036
GET H2	200	source-sans-pro-v21-latin-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	545ms 542ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Origin https://redcanary.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:24 GMT server nginx etag "6298f2c0-327c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12924
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	1054ms 1053ms	Script application/javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F&callback=jQuery112404771889903119584_1673502525190&_=1673502525191 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 03637b54484ee7c0fc636a7e52177f716a773b316c6fa1c41b5dbaef58d02897 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare vary Accept-Encoding content-type application/javascript; charset=utf-8 x-form-service-request-id 17e23#185a48609ac x-marketo-source Form Service cf-ray 78839adf6e40dfb3-SYD cached false
GET H2	200	/ redcanary.com/blog/intelligence-insights-december-2022/	128 KB 128 KB	526ms 525ms	Image text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT x-cache-group normal x-content-type-options nosniff content-security-policy upgrade-insecure-requests x-cacheable SHORT x-permitted-cross-domain-policies master-only strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-encoding br x-powered-by WP Engine x-cache HIT: 1 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin server nginx vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options deny content-type text/html; charset=UTF-8 cache-control max-age=600, must-revalidate feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=33056>; rel=shortlink
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	526ms 526ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 265634
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 435 B	524ms 524ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	source-sans-pro-v21-latin-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	524ms 524ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Origin https://redcanary.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Thu, 02 Jun 2022 17:26:22 GMT server nginx etag "6298f2be-329c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12956
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/site/	6 KB 2 KB	308ms 108ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e2054dc478009ffd8e5b5894f09406acd2957b78ff292365aa833ec0a9710789 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip cf-cache-status HIT age 180 ce-version 11.5.16 content-length 1831 last-modified Thu, 12 Jan 2023 05:45:45 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 78839ae1fb8da8d1-SYD
GET H2	200	ipv cdn.bizible.com/m/	43 B 303 B	100ms 99ms	Image image/gif	152.195.58.59 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=https%3A%2F%2Ft.co%2F&_biz_h=-1906410348&_biz_u=cbe8d80965144cb08c294a9f2739bb2c&_biz_s=4b42d0&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&_biz_t=1673502525533&_biz_i=Intelligence%20Insights%3A%20December%202022&_biz_n=0&a=redcanary.com&rnd=26978&cdn_o=a&_biz_z=1673502525534 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.58.59 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nwa/E789) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:45 GMT last-modified Tue, 10 Jan 2023 22:40:43 GMT server ECS (nwa/E789) age 112083 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 206 B	109ms 100ms	Image image/gif	152.195.58.59 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=cbe8d80965144cb08c294a9f2739bb2c&_biz_s=4b42d0&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&_biz_t=1673502525537&_biz_i=Intelligence%20Insights%3A%20December%202022&a=redcanary.com&rnd=496582&cdn_o=a&_biz_z=1673502525537 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.58.59 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nwa/E78C) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:45 GMT last-modified Thu, 05 Jan 2023 16:45:44 GMT server ECS (nwa/E78C) age 565381 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	FW_CTA.png redcanary.com/wp-content/uploads/2021/12/	10 KB 10 KB	500ms 499ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/12/FW_CTA.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 189ad7a7020dd6c9ea981356dd3984efa36851e4eead327f5c94110e139d08c2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Tue, 21 Dec 2021 02:58:51 GMT server nginx etag "61c142eb-286e" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 10350
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	500ms 500ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 6680
GET H2	200	II_9.14.21_975x975.jpg redcanary.com/wp-content/uploads/2021/09/	60 KB 61 KB	501ms 500ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/09/II_9.14.21_975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ec354f3c8c40717968bf9dee475e544582ed912d52c3281ea8598d9b55b6e4a6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Tue, 21 Sep 2021 14:59:22 GMT server nginx etag "6149f34a-f146" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 61766
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 511 B	288ms 288ms	Script text/javascript	152.195.58.59 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=cbe8d80965144cb08c294a9f2739bb2c&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.28&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.58.59 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (nwa/E789) / Resource Hash 97a4497918f6510753c4427d14c41badea4fb684eccd21705169270969c8de8f Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip server ECS (nwa/E789) etag 4ACA97B9 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 218
GET H2	200	91184d02a87923a014c1209f71972a90.js Show response script.crazyegg.com/pages/versioned/common-scripts/	77 KB 26 KB	112ms 112ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2286f307668c84511e2271af5e2805b4400511bca2a28edbabd32fcdcea17c7c Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:45 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 21 Dec 2022 12:59:21 GMT server cloudflare age 128872 vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes timing-allow-origin * cf-ray 78839ae2af90a971-SYD content-length 26887
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/sampling/ Frame 8A2A	161 B 258 B	107ms 107ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=464861 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 70ea7a2495d0eea311ccba190ac06699474389c18a25f3d5553b7c27e1879d22 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT content-encoding gzip cf-cache-status HIT age 180 ce-version 11.5.16 content-length 147 last-modified Thu, 12 Jan 2023 05:45:46 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 78839ae3acf4a8d1-SYD
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/162/	11 KB 5 KB	256ms 256ms	Script application/x-javascript	23.9.178.224 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/162/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.9.178.224 , Singapore, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-9-178-224.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:46 GMT Content-Encoding gzip Last-Modified Fri, 01 Jul 2022 00:59:12 GMT Server AkamaiNetStorage ETag "75daf56f6191efe42577301908659c29:1656637152.894482" Vary Accept-Encoding Content-Type application/x-javascript P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4677 Expires Sat, 22 Apr 2023 05:48:46 GMT
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 8A2A	19 B 460 B	876ms 289ms	XHR application/json	18.65.202.68 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.65.202.68 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-202-68.nrt57.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Sun, 20 Nov 2022 01:45:48 GMT via 1.1 2e09729c09747cfaa237f08151b53d06.cloudfront.net (CloudFront) x-amz-cf-pop NRT57-P3 age 4593779 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id -_qTS-a27WADF9vt_qd09xV7o__hi-i3ONoHy0t9HgOFbJRQic11iQ==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 8A2A	19 B 462 B	879ms 293ms	XHR application/json	18.65.216.117 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.65.216.117 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-216-117.nrt57.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 15 Dec 2022 01:45:56 GMT via 1.1 bd9e75a01c94b1e728afae7d6a1a6db4.cloudfront.net (CloudFront) x-amz-cf-pop NRT57-P4 age 2433771 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id PqdBmMzrIDH01HySO_DxRJq5hKXO7WsnaYpXl1qL6fV_BuU4N2tIDA==
GET BLOB	200 OK	322e5603-7ecd-44d2-8c6c-566209df1109 https://redcanary.com/	45 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/322e5603-7ecd-44d2-8c6c-566209df1109 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Length 45 Content-Type text/javascript
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 817 B	592ms 195ms	XHR application/json	103.43.90.178 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 103.43.90.178 , Singapore, ASN29990 (ASN-APPNEX, US), Reverse DNS 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Thu, 12 Jan 2023 05:48:46 GMT AN-X-Request-Uuid 5fe08ca5-9d62-43f0-bfe9-f2939a4c47ad Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 173.245.209.46; 173.245.209.46; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	401ms 275ms	XHR text/html	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	4 B 224 B	903ms 252ms	XHR text/html	125.56.233.143 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 125.56.233.143 , Singapore, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a125-56-233-143.deploy.static.akamaitechnologies.com Software / Resource Hash 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:46 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 null server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 4 expires Thu, 12 Jan 2023 05:48:46 GMT
POST H2	204	collect www.google-analytics.com/g/	0 336 B	580ms 194ms	Ping text/plain	142.250.4.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oe1a1&_p=851749141&cid=1346799797.1673502526&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1673502526&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&dr=https%3A%2F%2Ft.co%2F&dt=Intelligence%20Insights%3A%20December%202022&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f100.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:46 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	804ms 404ms	XHR application/json	122.248.209.238 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 122.248.209.238 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-122-248-209-238.ap-southeast-1.compute.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers date Thu, 12 Jan 2023 05:48:46 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://redcanary.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://api.segment.io https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	1884ms 273ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1673502526314&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1673502526313-40732&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fintelligence-insights-december-2022%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Ft.co%2F&_mchQp=utm_source%3Dtwitter__-__utm_medium%3Dsocial Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/162/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:48 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id b03da7bf-b3c5-4686-8350-5dba7c18c3bf
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	705ms 688ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A46%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	276ms 276ms	Stylesheet text/css	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare etag "2d4004c-3437-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 78839ae60847dfb3-SYD content-length 2623 expires Thu, 12 Jan 2023 09:48:46 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 377 B	731ms 730ms	Stylesheet text/css	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status REVALIDATED last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare etag "2da060b-33c-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 78839ae60848dfb3-SYD content-length 246 expires Thu, 12 Jan 2023 09:48:47 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	272ms 271ms	XHR text/html	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	750ms 250ms	Script application/javascript	199.232.44.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.44.157 , Singapore, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 15:55:14 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kjyo7100040-IAD, cache-qpg1241-QPG
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	684ms 202ms	Script application/x-javascript	42.99.140.192 ASN-TELSTRA-GLOBA...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 42.99.140.192 , Japan, ASN4637 (ASN-TELSTRA-GLOBAL Telstra Global, HK), Reverse DNS ip-42-99-140-192.pacnet.net Software / Resource Hash f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT content-encoding gzip last-modified Tue, 10 Jan 2023 17:22:56 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=33028 accept-ranges bytes content-length 4777
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	25 KB 8 KB	319ms 99ms	Script application/javascript	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 4b4e80032e1c164685d3ff6eb4c606785ebaebaa648d3984478b0cc8d114190b Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 07 Nov 2022 16:45:46 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "3528fd00b652f61a266eb584d96f4fcc" vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7722
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	2 KB 2 KB	587ms 200ms	Script text/javascript	74.125.24.157 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1673502526517&cv=11&fst=1673502526517&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&ref=https%3A%2F%2Ft.co%2F&tiba=Intelligence%20Insights%3A%20December%202022&auid=1704866400.1673502527&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 74.125.24.157 , United States, ASN15169 (GOOGLE, US), Reverse DNS sf-in-f157.1e100.net Software cafe / Resource Hash 0d92b494cc6234da9f14d3b3e06a8050faa6027c68e79d46b310350eaff8caf2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:47 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 935 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	453ms 249ms	Script application/javascript	13.107.21.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash f2c4b7d20ff42a433d0c76631c460cd75128f8f0436d052ce2cf79dc4fa6a244 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Thu, 12 Jan 2023 05:48:46 GMT last-modified Mon, 05 Dec 2022 17:15:50 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 05A589195161459AB6E6D642FE64E081 Ref B: SYD03EDGE2109 Ref C: 2023-01-12T05:48:46Z etag "027e538cd8d91:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 11460
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	105 KB 28 KB	591ms 196ms	Script application/x-javascript	157.240.235.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: t.co URL: https://t.co/TsSByPHrRC Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.235.1 , Singapore, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-04-sin6.fbcdn.net Software / Resource Hash cba8862bc0eeff77ab390c0669021b95055e809f226aa0e7dc438d79e3ad399f Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 12 Jan 2023 05:48:47 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27613 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug OGpaqu1i8JLCTc7S4NkvfRzB2mk0v1d7FpdWOzQwdgKtjLYlFDx/ohQqzbLJD012GtBhaSijXnMGIQo686LOhw== x-fb-trip-id 548340344 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=3693097596249936513	0 234 B	1656ms 821ms	Image application/json	18.65.168.86 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=3693097596249936513 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Server 18.65.168.86 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-168-86.nrt57.r.cloudfront.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:49 GMT via 1.1 6b3df82b11020ffd9f07adedfc60be70.cloudfront.net (CloudFront) x-amz-cf-pop NRT57-P1 x-cache Miss from cloudfront content-type application/json x-amz-cf-id r8t6_N0vq8reWWE-KaAUp9dwGMRmFWiBc94bsLKYA5UsgQoDYWk1XQ== content-length 0 apigw-requestid enXSOiKmoAMEapw= Redirect headers Date Thu, 12 Jan 2023 05:48:47 GMT P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 173.245.209.46; 173.245.209.46; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com Content-Length 0 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid a1675d71-890e-4dcf-8f07-69675f169c8a Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type text/html; charset=utf-8 Access-Control-Allow-Origin * Location https://attr.ml-api.io/?domain=redcanary.com&pId=3693097596249936513 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 817 B	381ms 194ms	XHR application/json	103.43.90.178 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 103.43.90.178 , Singapore, ASN29990 (ASN-APPNEX, US), Reverse DNS 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Thu, 12 Jan 2023 05:48:46 GMT AN-X-Request-Uuid cebf535b-0036-4b3e-b12d-a73611b18e2d Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 173.245.209.46; 173.245.209.46; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	271ms 270ms	XHR text/html	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	4 B 224 B	497ms 253ms	XHR text/html	125.56.233.143 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 125.56.233.143 , Singapore, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a125-56-233-143.deploy.static.akamaitechnologies.com Software / Resource Hash 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:46 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 null server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 4 expires Thu, 12 Jan 2023 05:48:46 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 817 B	575ms 194ms	XHR application/json	103.43.90.178 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 103.43.90.178 , Singapore, ASN29990 (ASN-APPNEX, US), Reverse DNS 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Pragma no-cache Date Thu, 12 Jan 2023 05:48:47 GMT AN-X-Request-Uuid 9b9ac03b-79e1-4851-b640-7cb606487c8c Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 173.245.209.46; 173.245.209.46; 591.bm-nginx-loadbalancer.mgmt.sin3.adnexus.net; adnxs.com Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	275ms 275ms	XHR text/html	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:46 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	4 B 224 B	492ms 250ms	XHR text/html	125.56.233.143 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 125.56.233.143 , Singapore, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a125-56-233-143.deploy.static.akamaitechnologies.com Software / Resource Hash 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:46 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 null server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 4 expires Thu, 12 Jan 2023 05:48:46 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	1 KB 770 B	850ms 292ms	XHR application/json	54.199.212.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.199.212.189 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-199-212-189.ap-northeast-1.compute.amazonaws.com Software nginx / Resource Hash f25ad58644fdfdb51b18656f092c952c1dc379ced6a09a1f5ca0d32fc116e597 Request headers Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 587
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	742ms 245ms	Preflight	54.199.212.189 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.199.212.189 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-199-212-189.ap-northeast-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-max-age 1800 date Thu, 12 Jan 2023 05:48:47 GMT server nginx
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	515ms 312ms	Image image/gif	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1673502526846&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=12198d62-bc50-4c81-ad49-0e43a07afc25&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_1967aea8 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	204	56383426.js Show response bat.bing.com/p/action/	0 120 B	447ms 447ms	Script text/plain	13.107.21.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Thu, 12 Jan 2023 05:48:46 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 4EF7C6FC70A54C22924BC345E44CD917 Ref B: SYD03EDGE2109 Ref C: 2023-01-12T05:48:47Z x-cache CONFIG_NOCACHE
GET H2	204	0 bat.bing.com/action/	0 177 B	248ms 248ms	Image text/plain	13.107.21.200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=70b256be-851f-47a1-948b-61fe1eb94df5&sid=c80579c0923c11ed94bb4b8564171fe2&vid=c805b180923c11ed99257df24f9a4784&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Intelligence%20Insights%3A%20December%202022&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&r=https%3A%2F%2Ft.co%2F&lt=3399&evt=pageLoad&sv=1&rn=692210 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 13.107.21.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Thu, 12 Jan 2023 05:48:46 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A40CCB23C13F4C9F8D6E43E5B91D6A7F Ref B: SYD03EDGE2109 Ref C: 2023-01-12T05:48:47Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 8A2A	28 B 135 B	620ms 208ms	XHR text/plain	52.76.228.143 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1673502526990&tk=40ea43635c9a9388c5f9f97df894a565 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/91184d02a87923a014c1209f71972a90.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.76.228.143 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-76-228-143.ap-southeast-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 912af5b837415051e613a4c2358169aa5f99da0fa149f820d10d3aa35f1c2c05 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-origin * date Thu, 12 Jan 2023 05:48:47 GMT cache-control no-store server awselb/2.0 content-length 28 content-type text/plain
GET H/1.1	200 OK	messenger Show response app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame 1B7A	6 KB 3 KB	937ms 324ms	Document text/html	34.226.2.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.226.2.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-2-205.compute-1.amazonaws.com Software nginx / Resource Hash f76b24617aee74f65dc50a6d6ea7a9705da650dfec3025c2ab3c04f5784793b2 Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1688 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Thu, 12 Jan 2023 05:48:47 GMT Etag W/"f76b24617aee74f65dc50a6d6ea7a970" Link <https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (e13668ca8eb7) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id 85a90182-50cf-48b8-1bee-cb61b44c72c5 X-Runtime 0.020799 X-Xss-Protection 1; mode=block
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 581 B	278ms 278ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_ec1d1894ba5040e8d5fbf23e4d443fd7.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	692ms 691ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A46%20GMT%22%2C%22timeSpent%22%3A%221013%22%2C%22totalTimeSpent%22%3A%221013%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame 468B	2 KB 738 B	278ms 277ms	Document text/html	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control max-age=3600 cf-cache-status DYNAMIC cf-ray 78839aeb0f14dfb3-SYD content-encoding gzip content-type text/html; charset=utf-8 date Thu, 12 Jan 2023 05:48:47 GMT server cloudflare vary Accept-Encoding x-content-type-options nosniff
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 665 B	1052ms 1050ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social X-Requested-With XMLHttpRequest accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Thu, 12 Jan 2023 05:48:48 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff, nosniff strict-transport-security "max-age=63072000; includeSubDomains; preload"; content-encoding br x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin server nginx vary Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options SAMEORIGIN, deny content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store access-control-allow-credentials true feature-policy microphone 'none'; geolocation 'none' x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 548 B	586ms 199ms	Image image/gif	172.217.194.106 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1673502526517&cv=11&fst=1673499600000&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&ref=https%3A%2F%2Ft.co%2F&tiba=Intelligence%20Insights%3A%20December%202022&fmt=3&is_vtc=1&random=3029941465&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.194.106 , United States, ASN15169 (GOOGLE, US), Reverse DNS si-in-f106.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:47 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com.au/pagead/1p-user-list/759876114/	42 B 548 B	586ms 200ms	Image image/gif	142.250.4.94 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com.au/pagead/1p-user-list/759876114/?random=1673502526517&cv=11&fst=1673499600000&bg=ffffff&guid=ON&async=1&gtm=2wg1a1&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&ref=https%3A%2F%2Ft.co%2F&tiba=Intelligence%20Insights%3A%20December%202022&fmt=3&is_vtc=1&random=3029941465&rmt_tld=1&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f94.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:47 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/	36 B 377 B	933ms 307ms	XHR application/json	18.65.185.69 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/1540753/domain/redcanary.com/token Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.65.185.69 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-65-185-69.nrt57.r.cloudfront.net Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:05:53 GMT content-encoding gzip via 1.1 d947c63dfd9d1ccbe9f338254272c65e.cloudfront.net (CloudFront) x-amz-cf-pop NRT57-P2 age 2574 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id VPd8ZK8SVixeV5mSDd-_rgPG0x3I_PZM6BTeGVV2h5vIJj0NqugS6w==
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Ds... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Ds... https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1673502527204%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Ds...	0 363 B	313ms 313ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&cookiesTest=true&liSync=true Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: DD850A6303FB4C65927E875FF4D76C05 Ref B: SYD03EDGE0809 Ref C: 2023-01-12T05:48:48Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lva1 x-li-proto http/2 content-length 0 x-li-uuid AAXyCqu/iF3LfB4MNme42w== Redirect headers content-security-policy default-src *; connect-src 'self' *.licdn.com *.linkedin.com wss://*.linkedin.com dpm.demdex.net/id lnkd.demdex.net blob: accounts.google.com/gsi/ linkedin.sc.omtrdc.net/b/ss/ *.qualtrics.com *.adyen.com *.microsoft.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; worker-src blob: 'self'; frame-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' *.linkedin.com teams.microsoft.com client.learningapp.microsoft.com strict-transport-security max-age=31536000 x-content-type-options nosniff date Thu, 12 Jan 2023 05:48:47 GMT linkedin-action 1 x-cache CONFIG_NOCACHE content-length 0 x-li-uuid AAXyCqu6C6B4QewplG66XQ== pragma no-cache x-li-pop afd-prod-lva1-x x-msedge-ref Ref A: C8646F899D5C44C993600536A587573F Ref B: SYD03EDGE0809 Ref C: 2023-01-12T05:48:48Z expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" x-frame-options sameorigin x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1673502527204&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&cookiesTest=true&liSync=true cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	adsct t.co/i/	43 B 157 B	325ms 323ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=b1176d1e-9f1e-4613-8334-b5d5cc3b75fa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ae15e9e1-92e6-4d5f-8c77-3f736df36e45&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_l / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers x-response-time 221 date Thu, 12 Jan 2023 05:48:47 GMT strict-transport-security max-age=0 server tsa_l content-type image/gif;charset=utf-8 x-transaction-id 65dae8cdc17f6d97 cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 0cd76bc2000ec9d9bffcbf14d1d6c36cf7fdf7b8a62f63bb88dd62054a343390 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 394 B	525ms 312ms	Image image/gif	104.244.42.67 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=b1176d1e-9f1e-4613-8334-b5d5cc3b75fa&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=ae15e9e1-92e6-4d5f-8c77-3f736df36e45&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_l / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers x-response-time 213 date Thu, 12 Jan 2023 05:48:47 GMT strict-transport-security max-age=631138519 server tsa_l content-type image/gif;charset=utf-8 x-transaction-id b37eb9f22bc8fade cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 04f9b64b3647cbe130a05a47f1e86fb6a2f81e1b5eab61de97b69b1058a20ce6 content-length 43
GET H2	200	1042590016249604 Show response connect.facebook.net/signals/config/	376 KB 107 KB	428ms 427ms	Script application/x-javascript	157.240.235.1 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.91&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.235.1 , Singapore, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-04-sin6.fbcdn.net Software / Resource Hash b8efe9776ed94aa02f53e21db54a81dc5233a4a0aa8a18a43f3d80db7a513cd0 Security Headers Name Value Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers content-security-policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Thu, 12 Jan 2023 05:48:47 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug 8C9vZ5CvYMSVhamlxi3xPGB9F31CYVBdOzKTE+p0hrWm6aTsDaherhaqt3/m+NTUZi4PQgJEhkxR3aVQ960AbA== x-fb-trip-id 548340344 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame 468B	208 KB 69 KB	112ms 111ms	Script application/x-javascript	104.17.72.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:47 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 6935 etag "2d4002b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 78839aecc950dfb3-SYD expires Thu, 12 Jan 2023 09:48:47 GMT
GET BLOB	200 OK	f6783f24-7a32-4c99-8476-97296ed9ed08 https://redcanary.com/	241 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/f6783f24-7a32-4c99-8476-97296ed9ed08 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash ba860807d58acdebb183234adc0c67c0658ad5b7ac61f65f1a3fec4c483c9ea5 Request headers accept-language en-AU,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Length 241 Content-Type text/javascript
GET H2	200	messenger-94e6eccc.chunk.css assets.qualified.com/packs/css/vendors~widget/sandboxed/ Frame 1B7A	35 KB 7 KB	120ms 110ms	Stylesheet text/css	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/vendors~widget/sandboxed/messenger-94e6eccc.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash eb3487cae40a55bf31dc6e6191ab0d88ec8c8f85c62bf28ad25ad0a40c16a611 Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id CR7RLVOSvN8A59.U_Z8vAhDQbuXMYHqb content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:35 GMT server cloudflare x-amz-request-id KMW8925BT0EKDGHM age 3337 etag W/"a788ecf510f83ee517cbaf79306145dd" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 78839af01f52a892-SYD x-amz-id-2 7470PuKAAXNhxq5fnaBvy/tkacfrDBx6qj0Yzvssr+pcuh7ZpMdeVsXIyGJ8ajvzDdiTtB3HqMw= expires Thu, 12 Jan 2023 09:48:48 GMT
GET H2	200	messenger-84a66aeb.chunk.css assets.qualified.com/packs/css/widget/sandboxed/ Frame 1B7A	5 KB 1 KB	117ms 107ms	Stylesheet text/css	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id 5Ydu6k4rPSG3QXcV_n2ryczMueyoFhYW content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Jan 2023 23:05:35 GMT server cloudflare x-amz-request-id KMW8E4AJGKKG0SZ8 age 3337 etag W/"22d5f23e695250d3c5a5b1e76a015c5e" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 78839af01f55a892-SYD x-amz-id-2 aPfTJG4hFLQmWMf/KF9qhRs6vL3sWVppwPE5E34hIVVmsh+cJJ8JXtztJ7EC/Xfv/iT9ImTmors= expires Thu, 12 Jan 2023 09:48:48 GMT
GET H2	200	messenger~runtime-ef1ece1c0a9549d59eea.js Show response assets.qualified.com/packs/js/widget/sandboxed/ Frame 1B7A	2 KB 1 KB	117ms 113ms	Script application/javascript	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-ef1ece1c0a9549d59eea.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7485bab42f18111f4f81c9d049a598ab69dc1c26be862132978682b82195559d Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id ZtJfY9kM3I15ZJJtyHqtSdTqK5IiFdbd content-encoding gzip cf-cache-status HIT last-modified Fri, 06 Jan 2023 17:48:43 GMT server cloudflare x-amz-request-id XSVNCM3CT9QG34TN age 3337 etag W/"24c8a10961409c26d456e07b23a1a317" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 78839af01f57a892-SYD x-amz-id-2 56UYtKrCpYhN68izjKb21XK1MZ48oY176yw1nP85dAWzRzihwyEy6OCPzqc2bCPSOrZ9Pqx4wRU= expires Thu, 12 Jan 2023 09:48:48 GMT
GET H2	200	messenger-bf86254db76bd5381d33.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/ Frame 1B7A	991 KB 296 KB	118ms 116ms	Script application/javascript	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-bf86254db76bd5381d33.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 376b58dc7a9322205fdfebce8dce774d34d63da16479dd4f258c66c5430ff066 Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id dYH7oRR0TjLsf1Q9h3gFoQqrLpPg6e5C content-encoding gzip cf-cache-status HIT last-modified Fri, 06 Jan 2023 17:48:43 GMT server cloudflare x-amz-request-id XSVSHX72WA4SGY82 age 2871 etag W/"776bedb11d7647092ca4f806b711dccc" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 78839af01f56a892-SYD x-amz-id-2 OjoKrN43i/DbecQsLvMFnXggopqqb8ack/6hm/kD2Sj20WOOsxsdk5UlK98blLgemYyncHa/1A4= expires Thu, 12 Jan 2023 09:48:48 GMT
GET H2	200	messenger-5e19c91f1355f0263c55.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame 1B7A	438 KB 120 KB	152ms 151ms	Script application/javascript	104.18.16.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-5e19c91f1355f0263c55.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b52e441d2ec3b6b8ffa530fccb0fa224264bf179ca980df75041c243c15ad190 Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id 6J6zp1gFEFxJ7E1hfg4s_njZyka0.mvQ content-encoding gzip cf-cache-status HIT last-modified Fri, 06 Jan 2023 23:58:19 GMT server cloudflare x-amz-request-id 8GSEWJVDV9XFBJQM age 3336 etag W/"7be0a4effaefc3fcbb8adfa732402f3c" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 78839af0c844a892-SYD x-amz-id-2 og5DcEFuVmYMoIdlXlHaHxDJex+E3nPzprCHC0X4sUh19isFKPp9pVDNfhkeOm+ANsCbGTln4Rg= expires Thu, 12 Jan 2023 09:48:48 GMT
GET H2	200	Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 1B7A	97 KB 97 KB	315ms 106ms	Font font/woff2	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id Ts0p7fbKsZIFu_VEk6HOvm9iYpTRKuos cf-cache-status HIT x-amz-request-id BCHD699RQSKGQR0A age 2952396 content-length 98868 x-amz-id-2 ah30HCJLCWUH8FBvQ6OfOYMPY/obFF6n97GYVr1nCoey1IqrCeJ/CSemSFj/KAgVW7jgb8ZJyj8= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "dc131113894217b5031000575d9de002" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 78839af15910a941-SYD expires Fri, 12 Jan 2024 11:48:48 GMT
GET H2	200	Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 1B7A	103 KB 104 KB	421ms 213ms	Font font/woff2	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=210c7527-8790-4e18-b35b-a7de0f6320bc Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-amz-version-id ePBeoMCujYBxKBCWHO9COs36tHcpJSw9 cf-cache-status HIT x-amz-request-id TFBY0REVZMGKQA11 age 2952406 content-length 105804 x-amz-id-2 Du3UtdwfXt96oDQO1/K0zmv0LKXPsHcKl5C6YRSpcIhsbc6OVEDcu+Z0EWIIM4CTA/90cwYVEBI= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "007ad31a53f4ab3f58ee74f2308482ce" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 78839af15911a941-SYD expires Fri, 12 Jan 2024 11:48:48 GMT
GET H2	200	/ www.facebook.com/tr/	0 31 B	840ms 200ms	Image text/plain	157.240.235.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&rl=https%3A%2F%2Ft.co%2F&if=false&ts=1673502528102&sw=1600&sh=1200&v=2.9.91&r=stable&ec=0&o=30&fbp=fb.1.1673502528100.1874937645&it=1673502527338&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.235.35 , Singapore, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-04-sin6.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Thu, 12 Jan 2023 05:48:48 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	717ms 717ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A47%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222015%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:48 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H/1.1	200 OK	/ Show response sentry.io/api/1332833/envelope/ Frame 1B7A	2 B 407 B	1104ms 275ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/vendors~widget/sandboxed/messenger-bf86254db76bd5381d33.chunk.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.qualified.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Thu, 12 Jan 2023 05:48:49 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary Origin Content-Type application/json access-control-allow-origin https://app.qualified.com access-control-expose-headers x-sentry-error, retry-after, x-sentry-rate-limits x-envoy-upstream-service-time 0 Connection keep-alive Content-Length 2
POST H2	200	/ Show response www.facebook.com/tr/ Frame B2AC	0 201 B	201ms 199ms	Document text/plain	157.240.235.35 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.235.35 , Singapore, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-04-sin6.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://redcanary.com Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Thu, 12 Jan 2023 05:48:48 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	710ms 710ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A48%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223016%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:49 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 1B7A	13 KB 13 KB	968ms 333ms	Image image/png	52.216.145.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/intelligence-insights-december-2022/?utm_source=twitter&utm_medium=social Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.118 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:51 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id NXKJT01610BH9TM8 ETag "fd481ec600c1b3fad6f9e29aa732a946" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 dz9wm2xkZIbJBs1grZb8d43vYfxzAbhwLK4BbzlV3QUd5sKzVFzKBzmkZASCCS+Hgvb/e0TmG20=
GET H2	200	optimize.js Show response www.google-analytics.com/gtm/	111 KB 44 KB	495ms 194ms	Script application/javascript	142.250.4.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f100.1e100.net Software Google Tag Manager / Resource Hash 15f88a878d12ad914ef402e51c4c44723a57fb2e7138037a7a6893d56bf8bebd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:50 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44476 x-xss-protection 0 last-modified Thu, 12 Jan 2023 03:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 12 Jan 2023 05:48:50 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	707ms 707ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A50%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A49%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224017%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:50 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H3	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	193ms 193ms	Script text/javascript	142.250.4.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.4.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f100.1e100.net Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 12 Jan 2023 03:57:24 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 6686 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Thu, 12 Jan 2023 05:57:24 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	193ms 193ms	XHR text/plain	142.250.4.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j98&a=851749141&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&dr=https%3A%2F%2Ft.co%2F&ul=en-us&de=UTF-8&dt=Intelligence%20Insights%3A%20December%202022&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=974953720&gjid=362809261&cid=1346799797.1673502526&tid=UA-52702906-1&_gid=2107995196.1673502531&_r=1&gtm=2wg1a1PXWC8JW&cd4=Beyond%20Technology&cd5=beyondtechnology.com.au&cd6=Australia&cd7=New%20South%20Wales&cd8=Crows%20Nest&cd9=2065&cd10=Software%20and%20Technology&cd11=0%20-%209&cd12=7&cd13=%241M%20-%20%245M&cd14=Australia%20and%20New%20Zealand&cd18=null&z=1841710949 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.4.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f100.1e100.net Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:50 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 1B7A	13 KB 13 KB	333ms 333ms	Image image/png	52.216.145.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.118 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:52 GMT Last-Modified Thu, 20 Oct 2022 23:48:08 GMT Server AmazonS3 x-amz-request-id EDEAE2S6WCXN6GKX ETag "7797b96a7f999ac42de528bede3329af" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 13099 x-amz-id-2 5UlbamZRJ6KYKTYNyOBO8WO5DP4S9JbwejcPX29XP619WLexyjew+TI2284MAsC+5H/w8k9wPhw=
POST H2	200	collect Show response stats.g.doubleclick.net/j/	8 B 444 B	580ms 193ms	XHR text/plain	172.217.194.157 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-52702906-1&cid=1346799797.1673502526&jid=974953720&gjid=362809261&_gid=2107995196.1673502531&_u=YADAAEAAQAAAACAAI~&z=1173936852 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.194.157 , United States, ASN15169 (GOOGLE, US), Reverse DNS si-in-f157.1e100.net Software Golfe2 / Resource Hash 7817ee889e9c73351b96c97c740c9dd746ba87ebd6c6fcab3cd77cd021920ce7 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Thu, 12 Jan 2023 05:48:51 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	712ms 712ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A51%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A50%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225018%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:51 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	RedCanary_Logo_Primary.png redcanary.com/wp-content/uploads/2022/11/ Frame 1B7A	15 KB 15 KB	552ms 552ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2022/11/RedCanary_Logo_Primary.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 82ff0da13fe2fc8c21420a72d5e6255f6d1023c8dee0a35573319d4b64953ee3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:51 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Tue, 15 Nov 2022 20:15:42 GMT server nginx etag "6373f36e-3ad4" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 15060
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	499ms 199ms	Image image/gif	172.217.194.106 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-52702906-1&cid=1346799797.1673502526&jid=974953720&_u=YADAAEAAQAAAACAAI~&z=1298095673 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.194.106 , United States, ASN15169 (GOOGLE, US), Reverse DNS si-in-f106.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:52 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.com.au/ads/	42 B 107 B	498ms 197ms	Image image/gif	142.250.4.94 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com.au/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-52702906-1&cid=1346799797.1673502526&jid=974953720&_u=YADAAEAAQAAAACAAI~&z=1298095673 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.4.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f94.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:52 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame 1B7A	13 KB 13 KB	329ms 328ms	Image image/png	52.216.145.118 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.145.118 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Date Thu, 12 Jan 2023 05:48:52 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id EDE4WY434ZZ657Z3 ETag "fd481ec600c1b3fad6f9e29aa732a946" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 LuNo+VTM7GW262avYZrEa/nYxNd1xKNf2rtYHZ0NyJtMkdXyJsL6WJ4J8+2wiZCDC5MuRYJab/o=
GET H2	200	Inter-roman.var-ba4caefcdf5b36b438db92786991c845.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame 1B7A	222 KB 222 KB	108ms 107ms	Font font/woff2	104.18.17.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-roman.var-ba4caefcdf5b36b438db92786991c845.woff2 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.17.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17fe38ab302c7e5dbfb5c3d87801092d79be958500db6412ed3bc0f126bd53d3 Request headers Referer https://assets.qualified.com/packs/css/widget/sandboxed/messenger-84a66aeb.chunk.css Origin https://app.qualified.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:51 GMT x-amz-version-id 8iJAUpJd6e_Yyn0OiVIrGWhC4aEObLYF cf-cache-status HIT x-amz-request-id AYAMGA4CGACD56ZG age 2952405 content-length 227180 x-amz-id-2 0jihi9y8BcAEoWSkB9/Pqlc34ZZUL6xW9UQRT/IHDzrShJenQN2RhD2MFhWZ29btkzr9gMcgPIE= last-modified Thu, 08 Dec 2022 23:17:25 GMT server cloudflare etag "66c6e40883646a7ad993108b2ce2da32" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 78839b07deaaa941-SYD expires Fri, 12 Jan 2024 11:48:51 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	698ms 697ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A51%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226020%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:52 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	RedCanary_Logo_Primary.png redcanary.com/wp-content/uploads/2022/11/ Frame 1B7A	15 KB 15 KB	554ms 554ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2022/11/RedCanary_Logo_Primary.png Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 82ff0da13fe2fc8c21420a72d5e6255f6d1023c8dee0a35573319d4b64953ee3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"; Request headers accept-language en-AU,en;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:53 GMT content-security-policy upgrade-insecure-requests strict-transport-security "max-age=63072000; includeSubDomains; preload"; last-modified Tue, 15 Nov 2022 20:15:42 GMT server nginx etag "6373f36e-3ad4" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 15060
GET H/1.1	206 Partial Content	7bfc614b2b8cf39efbfb3b15da61c94a.mp3 app.qualified.com/packs/	6 KB 6 KB	302ms 301ms	Media audio/mpeg	34.226.2.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/packs/7bfc614b2b8cf39efbfb3b15da61c94a.mp3 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 34.226.2.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-226-2-205.compute-1.amazonaws.com Software nginx / Resource Hash 3814cdd9f44b721f9c1cb111462e040b4a885d07cb143ee37b680d871cbfa94e Request headers Referer https://redcanary.com/ Accept-Encoding identity;q=1, *;q=0 accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Range bytes=0- Response headers Date Thu, 12 Jan 2023 05:48:53 GMT Via 1.1 spaces-router (e13668ca8eb7) Last-Modified Wed, 11 Jan 2023 03:21:48 GMT Server nginx Content-Type audio/mpeg Content-Range bytes 0-5869/5870 Cache-Control max-age=315360000, public Content-Length 5870 Expires Thu, 31 Dec 2037 23:55:55 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	701ms 700ms	Image image/gif	104.111.166.129 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%227022%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.111.166.129 Central, Hong Kong, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-111-166-129.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Thu, 12 Jan 2023 05:48:53 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu) etag "615ccf10-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
POST H3	204	collect www.google-analytics.com/g/	0 17 B	195ms 194ms	Ping text/plain	142.250.4.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oe1a1&_p=851749141&cid=1346799797.1673502526&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAE&sid=1673502526&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&dr=https%3A%2F%2Ft.co%2F&dt=Intelligence%20Insights%3A%20December%202022&_s=2 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.4.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS sm-in-f100.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://redcanary.com/ accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Thu, 12 Jan 2023 05:48:53 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=6ce35d61-5f79-4a64-8d7a-30d8547e2ffc&session=d1328f05-9e25-4165-87e8-772202d9f562&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2012%20Jan%202023%2005%3A48%3A53%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%228023%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20ghost%20of%20malware%20past%2C%20Yellow%20Cockatoo%2C%20returns%20from%20hiatus%20while%20Gootloader%20unwraps%20new%20TTPs%20in%20this%20month%E2%80%99s%20Intelligence%20Insights%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Intelligence%20Insights%3A%20December%202022%22%7D&cb=&r=https%3A%2F%2Ft.co%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fintelligence-insights-december-2022%2F%3Futm_source%3Dtwitter%26utm_medium%3Dsocial&pageViewId=ee0e07d1-3cc9-4e8d-8aee-ca553ea7559e&an_uid=0