www.cyberhaven.com Open in urlscan Pro
35.152.119.144  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJtlqvIW8lelwAAAZQ8DGbNiktjDaEdLepnZp1gOE87hhXRyfAKV415xLTG54gCBwgwBQ

Request Chain 128

• https://rp.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=fe0f6f6b-6932-461e-ab7d-045131619c01 HTTP 302
• https://rp4.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=fe0f6f6b-6932-461e-ab7d-045131619c01&i6=MjAwMTphYzg6MjQ6NDQ6OjE4

135 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Show response www.cyberhaven.com/engineering-blog/	85 KB 28 KB	220ms 78ms	Document text/html	35.152.119.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.152.119.144 Milan, Italy, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-152-119-144.eu-south-1.compute.amazonaws.com Software / Resource Hash 374b4e4c2967d68612369715d8fdfa2d67e501672dd421ea0c920b554d7c014b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 279714 alt-svc h3=":443"; ma=86400 cf-cache-status HIT cf-ray 8fdc71d77c98badb-MXP content-encoding gzip content-type text/html date Mon, 06 Jan 2025 14:37:12 GMT last-modified Fri, 03 Jan 2025 08:54:38 GMT surrogate-control max-age=432000 surrogate-key www.cyberhaven.com 64deefeac57fbbefc32df53d pageId:659f33bed6ad85bae1aa7e8e 659f33bed6ad85bae1aa7fe2 659f33bed6ad85bae1aa7e5e vary Accept-Encoding x-cluster-name eu-south-1-prod-hosting-red x-lambda-id 3d3d8f3d-397e-4aed-92cb-855b77169a14
GET H3	200	cyberhaven-2-0.86aed3ac6.min.css cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/	295 KB 55 KB	124ms 64ms	Stylesheet text/css	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 022b3ae6836331aad99fe7188dc82318a16e4b805e61415ff5e0b69b71a61e64 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT etag "200c4bd891e0f5960d86e75969e05382" x-amz-version-id bQRBeOFZBEAeokUm.onkoSshbRRsmWHE age 429210 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type text/css last-modified Wed, 01 Jan 2025 15:17:34 GMT vary Accept-Encoding priority u=0,i=?0 x-amz-id-2 /fiSwiYp/TZ9xjmZwPYTwxY4oQU1D1fo1cHfkJ+J3Go3I+7UWutM+oWZH+V/gfjYlcOpUWgG9ps= cache-control public, max-age=31536000, immutable x-amz-request-id 4FZ97WFC0T35CWE9 cf-ray 8fdc71d8598a1e51-FRA accept-ranges bytes access-control-allow-origin * content-length 56247 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	fs-cc.js Show response cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/	29 KB 11 KB	99ms 30ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bdeed7650697bd478a6b0591a9ea29664b04a6681a4f9f7c4c2d3d10cdae42a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"73ae-nwFPCwd3UXiTZ7YuAXjbCNGDpOw" age 4983 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230135-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 10845 x-jsd-version 1.15.0
GET H2	200	js.cookie.min.js Show response cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/	2 KB 1 KB	99ms 30ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/js.cookie.min.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"6c3-1s0eec7oePdhcVrYEdKeoGY3QW4" age 2813606 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230030-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 860 x-jsd-version 3.0.5
GET H2	200	readtime.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/	4 KB 2 KB	31ms 30ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/readtime.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 164406864a5606d7181ae4c6f6b48c19478bbc7377178b51c0f53c68a28fe58d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"f7c-CEGEZn4mJhUtZe0HPZGxMFBlZeE" age 33832 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230158-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 1918 x-jsd-version 1.2.3
GET H2	200	richtext.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/	8 KB 4 KB	34ms 34ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2147-I41v+oq443LPQB6aPqMil27q9QY" age 3798 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230147-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3918 x-jsd-version 1.10.2
GET H2	200	socialshare.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/	9 KB 4 KB	33ms 32ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/socialshare.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash eafd7e17be354753ca120ef03d28aa45a37c423e89e9f2602e8fd5a24400f150 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2385-rwl9CAsmlk954AGumYBzecK5wJE" age 223 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220106-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3619 x-jsd-version 1.3.1
GET H2	200	codehighlight.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/	4 KB 2 KB	36ms 36ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1254f8919b622330bce321d396d373e92655485778b03d3d1a04d493d44431ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1182-meaOv3e3adqfyT4jIRjTa76pxz4" age 26290 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230089-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 2031 x-jsd-version 1.5.2
GET H2	200	toc.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/	22 KB 9 KB	37ms 37ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8f3080c9459e76305ed52789a727b30786b4d8e27da652424db04a22f42ad83d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"57aa-2Zkk0AqSUYYUIrrzTHESzGgsbdg" age 8048 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220054-FRA, cache-mxp6961-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 8646 x-jsd-version 1.2.4
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 32 KB	153ms 50ms	Script application/javascript	52.222.232.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64deefeac57fbbefc32df53d Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.232.144 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-232-144.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" age 4473 access-control-allow-methods GET x-cache Hit from cloudfront x-amz-cf-id WAajLCbXSBSBfvlGHtSd_JmAOhxW4Ep9OrsJpiqs236JKsohwQWwUg== date Mon, 06 Jan 2025 13:22:40 GMT content-type application/javascript last-modified Mon, 20 Jul 2020 17:53:02 GMT vary accept-encoding cache-control max-age=84600, must-revalidate via 1.1 ed91e9c9d6be32c45c1d670b7d4a6616.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P4 server AmazonS3
GET H3	200	cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Show response cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/	708 KB 173 KB	186ms 155ms	Script text/javascript	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9c433a9098a5976b8d58b4371e89daafba4e0e9a05f5c880fe821355ba88684 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br cf-cache-status HIT etag W/"9792b65f944e5a2e92eae714f7201221" x-amz-version-id _GYyTxRjAFzEvmpHerpKKUquAFj9B32p age 717700 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type text/javascript last-modified Fri, 13 Dec 2024 17:48:45 GMT vary Accept-Encoding priority u=1,i=?0 x-amz-id-2 D2bsWaHyprSXvd87ue+PCwKZfSPnhiTzdxn/fJRHpvBk4DuC/lSOIvxw1bB0R4bnXgY2+4840u4CG7QbHlql0JpGqdVm0wnB cache-control public, max-age=31536000, immutable x-amz-request-id 289MC3GK1EGQP97Z cf-ray 8fdc71d8598c1e51-FRA access-control-allow-origin * server cloudflare x-amz-server-side-encryption AES256
GET H2	200	form-124.js Show response hubspotonwebflow.com/assets/js/	10 KB 3 KB	157ms 63ms	Script application/javascript	66.33.60.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/form-124.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"392ca1f460caa2aa9439969a89f31c13" age 4643994 x-matched-path /assets/js/form-124.js access-control-allow-origin * date Mon, 06 Jan 2025 14:37:12 GMT content-disposition inline; filename="form-124.js" content-type application/javascript; charset=utf-8 server Vercel last-modified Wed, 13 Nov 2024 15:18:09 GMT x-vercel-id fra1::m8hp7-1736174232429-bee446c6f78b
GET H2	200	gtm.js Show response www.googletagmanager.com/	412 KB 128 KB	176ms 85ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash c6c9d3fb5126aa778b7a80ca35340a30e40259bb631fe23eb2f4ad21254f6c5a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Mon, 06 Jan 2025 14:37:12 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Mon, 06 Jan 2025 12:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 129858 x-xss-protection 0 server Google Tag Manager
GET H3	200	676f447859d64b55526ac4ea_blog-hero-analysis.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	48 KB 49 KB	120ms 120ms	Image image/jpeg	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f447859d64b55526ac4ea_blog-hero-analysis.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02aaf64a14db538fd05ce260e97c3f59f34a811893d73928062a45e84de742e1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "1a76135b309733c2491985966d6d0560" x-amz-version-id NJizZKGhA87OUnTBSjxtYx7nz4yGTCP8 cf-cache-status HIT age 820834 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type image/jpeg last-modified Sat, 28 Dec 2024 00:21:14 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 Qy3zrnZgmFsE/4dsuHi7OyUUHumWdIC39Esjw//AtgIAtK9oKqYj3qjTQshKhoYU8pG3K79yI+z+X9RwgX6NnA== cache-control max-age=31536000, must-revalidate x-amz-request-id 48X8RF9W2YEP8VSP cf-ray 8fdc71d96a8e1e51-FRA accept-ranges bytes access-control-allow-origin * content-length 49457 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	85ms 84ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d04419609e6fa08a420ce68756b9bb81fc4ccde283575fb42ffc443e2caf3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "7017fb33ca20ea6252530f4175b595c6" x-amz-version-id nbgTfi_RoVFp7TQUfwt0fBsEIuZbE9lh age 2274050 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 gJhMn2Szeezt8PuGVLNAfz+oPTCXmHeCnPf6C14Hf6+WczXoQSvUeJv+ZErtYdEEW9GBl8NY4stVwvC3++0nIxMdwKCQXH9S1Eyr89nCsbk= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTCZ1ZWMJY9PQTZ cf-ray 8fdc71d96e601e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 30936 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	83ms 83ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3edff1ede4f95fec11b4ad510397682faac14c622267b92fe314f6860f6eba12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "c74d82a73f65864871167b931348f7dd" x-amz-version-id 0K0YF9sKMHh27RzbO2HdYO7f4xfHi1Ni age 2274050 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 MCQEkNI9Skqtr9UHAlvblDXtXn39LUjYsuoQFWJpCnk8xjEAlGHCYc29sY+wKAKPHtqGdhoW3iD6nmRIMvp0B9f394igWsOQgIZcvgApZ8U= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTC6W8VNHM33H8W cf-ray 8fdc71d97e621e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 30952 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf53f_TWKLausanne-300.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	29 KB 30 KB	93ms 93ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf53f_TWKLausanne-300.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43e196dea1bb50052e39bb72d5146ca65dcbeddbb56ca9f939d85c39e152f219 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "b6399e7dcfa3936c0f20e75e8ea070c7" x-amz-version-id ZBYM2pzvY3d3.LCU5xbdDaV6IOyUyQV. age 2278920 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 m6ydf77jwkKftQxQBU+1M7YG7wNfzAtOdtxHC2HwfIJKxLWi12d9A5YS1hbQnKJVPkvqhNiPYyo= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id S0D843DW7FKQQXYN cf-ray 8fdc71d97e651e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 30152 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	94ms 94ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17e921e79da7db5200bf6306e57c9a561ff4dfa1215d250f15384aa0d23a1d23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "698fbe394f26b24fe5bda79219e312ea" x-amz-version-id IB8aQpEKbkqJmVgCCA4g6ZnSKyG9yt.w age 1491286 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 20:34:13 GMT x-amz-id-2 lWnJbBoYdD7v8nAlLgeBjKNMLGVzMxjjrSK0yEyJ4/DAyqXU6aLtiMepqs4AErNOc8hviv/0vj7qzy17gG6Az5fLNIwiAVP0CzNv3J3ZVNA= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id Q7X64X2SFZH10WMY cf-ray 8fdc71d97e661e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 31088 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	31 KB 32 KB	203ms 202ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf477dd7f1f2598513f268e5d86db59f2bf78cf5608b6d2b3bbede1ae015749d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "1079ff010de8753eb2eea411463e0a91" x-amz-version-id OlnoJq_KD3p4L6Vhpcl.niE2c5DijABz age 2263648 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 CtRoGf0fu8vjwsk9g5jMaubzrfJ+qErHoNOnNfkVGIeVDyb1Y8ZOyc1MyU0EULHa/VVpuv19F0c= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id H0PJZEQK51F6QYXP cf-ray 8fdc71d97e671e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 31836 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	53ms 53ms	Font application/octet-stream	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f80afcc11946f09caeaad7fdd4febb98bbb145a41e24bfd36bd482bdf70caa3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.86aed3ac6.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "a1659b77956f1919811ab7b82c2276d5" x-amz-version-id YuICHYP_D8aK2yDWMfwtWbNeUZaHyz29 age 2278920 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 P1Q3i9+ephkS6tkM7ppEHyk0CazjiDVvbQycOxzKRmlE4/0kfBKH/2djV9BYPTBYdHN/NH8ARZL9YS1fsmJ5/jrlxfmtwPWUEwihAsNp3hM= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVT0KJSYE65TYGV5 cf-ray 8fdc71d97e681e4a-FRA accept-ranges bytes access-control-allow-origin * content-length 30716 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f444c8108263f227e2659_Cyberhaven%20generic%20author.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	6 KB 7 KB	109ms 108ms	Image image/png	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f444c8108263f227e2659_Cyberhaven%20generic%20author.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68e2330e1344b9b74b1fe80c5762cd25dc38d48e4729a68e9efb08dbd871342c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "cc8175b9379835524077dbb651fc197f" x-amz-version-id Z7kNl.q4o2SWLNrLL6g88z625u7bIGzM age 820834 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:20:31 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ov4NQLfBHdAZF9TOgIKrXpnUY88Qs/dcrW9K7wQJQYQeYryhqSI9o+UwAWGTyn0dGTg5wChhLdoBEL/emH+7X5FadsBkGW3ZP6geHfvCP/k= cache-control max-age=31536000, must-revalidate x-amz-request-id 48XB49GWVZR1NZJE cf-ray 8fdc71d97a9e1e51-FRA accept-ranges bytes access-control-allow-origin * content-length 6596 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	68 KB 69 KB	110ms 109ms	Image image/png	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efd70a126766db0daeb2d0a39246bb00e2f5af423f2deceb8fb87febfe14970e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "811b488ff94f4f0b1f857afb7930bec9" x-amz-version-id C86hd2YZSjKZzA88LiOcRnpQygUaeudY age 23841 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 DDrxYC2qlrdEhexHdG6s7Z+R/3REuezcM6Md535traQY3vxFInROKTawEqk1ypTe1+C3Z9ETAcc= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZJ5HCF7J11Y25H cf-ray 8fdc71d97aa01e51-FRA accept-ranges bytes access-control-allow-origin * content-length 70038 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	166 KB 167 KB	110ms 108ms	Image image/png	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38949f97e6770288dcf96195e601480f85bf502a50da7a2a6907a932092ffd34 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "ecb0956c5cf844c67d6066e1516c449a" x-amz-version-id w75.YwkqNAkX8P94nx3CfN3GO7XH6OWq age 23841 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type image/png last-modified Tue, 31 Dec 2024 21:58:05 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 CZ1dUPt4pSTTt5JWIdGVI179jysW5De1WMhdf8aL/9I9EFxzJ+rRxfnyDYs9SX/Gdur9h0AOhLI= cache-control max-age=84600, must-revalidate x-amz-request-id 12SSQKMM1T7CC4S3 cf-ray 8fdc71d97aa11e51-FRA accept-ranges bytes access-control-allow-origin * content-length 170083 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	highlight.min.js Show response cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/	113 KB 41 KB	31ms 31ms	Script application/javascript	151.101.193.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.193.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1828162a4978444dfe33f4cd1f977f17cd13cf7d0f413f8eb9bab9437239736d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1c30f-0mStFr3znP7CsGwgIjuH/LN60ns" age 1122221 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230041-FRA, cache-mxp6952-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 41100 x-jsd-version 11.4.0
GET H3	200	github-dark.min.css cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/	1 KB 998 B	30ms 30ms	Stylesheet text/css	151.101.193.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/github-dark.min.css Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.193.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9f208d022102b1d0c7aebfecd8e42ca7997d5de636649d2b31ea63093d809019 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"523-oe0DT1osdtatoK9R3LMOLlr5NqA" age 1555620 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 06 Jan 2025 14:37:12 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-etou8220128-FRA, cache-mxp6952-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 619 x-jsd-version 11.4.0
GET H2	200	bda12b36-0455-47af-b8ba-9529bbb134fb.js Show response j.6sc.co/j/	4 KB 5 KB	190ms 66ms	Script application/javascript	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 73c5c9fb7e8e51a3af35769a05cac8b20493d7158c284c504f93eab13d0d53aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 content-type application/javascript cache-control private, max-age=1800 x-amz-version-id N26XcBiiU4KO8qPH4s3OdRIA551zYsKR etag "2a619c6409aef52add1c19ae5d16a447" expires Mon, 06 Jan 2025 15:07:12 GMT accept-ranges bytes content-length 4528 x-amz-cf-id LlQCzf6A8AdceuaCXl2fW895eurJ0Q-qOXNA9eO65qNesNWeLzwJlA== date Mon, 06 Jan 2025 14:37:12 GMT last-modified Thu, 21 Sep 2023 21:57:20 GMT vary accept-encoding server AmazonS3 x-amz-cf-pop DUS51-P4 x-amz-meta-content-type application/json
POST H3	200	collect www.google.com/ccm/	0 0	126ms 47ms	Ping text/plain	142.250.185.100 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&scrsrc=www.googletagmanager.com&frm=0&rnd=1119234373.1736174233&auid=1941402287.1736174233&navt=n&npa=1&gtm=45He4cc1v832240631za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1736174232804&tfd=741&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.100 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s49-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	422 KB 134 KB	59ms 59ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 98c6cb6278a6ed3791f067dc239d5d6acfafab244e4045ea60562473be7419c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Mon, 06 Jan 2025 14:37:12 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136883 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	25 KB 9 KB	173ms 53ms	Script application/javascript	2a02:26f0:2780:5e::210:a86b AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:2780:5e::210:a86b , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash c8879b289784c2f0e524c601ee26bd458ab9d35a527c22ce582904004e47d018 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=66586 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 9404 date Mon, 06 Jan 2025 14:37:12 GMT last-modified Mon, 06 Jan 2025 08:56:54 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	142ms 41ms	Script application/javascript	146.75.120.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 146.75.120.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Mon, 06 Jan 2025 14:37:12 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 20:04:45 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kcgs7200099-IAD, cache-fra-etou8220142-FRA x-amz-server-side-encryption AES256
GET H2	200	hotjar-3169094.js Show response static.hotjar.com/c/	13 KB 6 KB	138ms 43ms	Script application/javascript	18.66.102.53 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.53 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-53.fra56.r.cloudfront.net Software / Resource Hash f61a6b609ec3b3b0d11d93c7757b60e452844d4601b3df3a32edaa942bd745e8 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br etag W/b4eb9e877ec2823d86710809af43490f age 2 x-content-type-options nosniff x-cache-hit 1 x-cache Hit from cloudfront x-amz-cf-id -n8-vy1p_sywvFNRnnmmB7-EFUgHTZyR8j46CLOFu1yEiAc7npRJ9w== date Mon, 06 Jan 2025 14:37:10 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 cross-origin-resource-policy cross-origin via 1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P2
GET H3	200	2985.js Show response script.crazyegg.com/pages/scripts/0115/	7 KB 3 KB	145ms 77ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0115/2985.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0d810efe03fa42a406546c8b52a2b9623d2625938f7e1048fba55a71f99eafa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:12 GMT content-type text/javascript last-modified Mon, 06 Jan 2025 14:34:51 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fdc71db9eefdbc9-FRA accept-ranges bytes access-control-allow-origin * content-length 2480 ce-version 11.5.340 server cloudflare
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	109ms 29ms	Script application/javascript	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Mon, 06 Jan 2025 14:37:12 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	93ms 46ms	Script application/x-javascript	157.240.0.6 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra3.fbcdn.net Software / Resource Hash 4b851bd9af5635c2682387427eb718d453b8e7aeefdbb01c8521ab32a49004b3 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-7XTMAHHo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 06 Jan 2025 14:37:12 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-7XTMAHHo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=44, rtx=0, c=23, mss=1232, tbw=4479, tp=9, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug YeY/D6uBIISE3xNC1Xl6usRkuzt7sF56R9Zfiz5lNoDFFuCGM6tDRE/Vydwmg/9agL5b5assgVjQhLKcy5r2SA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62279 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	186ms 59ms	Script text/javascript	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip age 2369 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],} x-content-type-options nosniff expires Mon, 06 Jan 2025 15:57:43 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 13:57:43 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 17168 server Golfe2
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/	16 KB 5 KB	302ms 205ms	Script application/javascript	2600:9000:2670:ca00:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2670:ca00:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Clearbit / Resource Hash 11e852bb791058078812ff8c0780eee92054fbaad4e03ca2f4263576ee487ac7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip etag W/"baf7329e47c04b0ab497040e04f53af5" x-envoy-response-flags - x-content-type-options nosniff via 1.1 5335ce80c0b9264bc591cce2c73bef5e.cloudfront.net (CloudFront) x-cache Miss from cloudfront x-amz-cf-id G0gBHxllWvas9D81AHb_ys5fcfmVZzIl-H6OoXiZfIEyXd5mD-YP2A== date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit x-amz-cf-pop FRA56-P9
GET H3	200	62febdf93e32fb008eef5596 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	389ms 337ms	Script text/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62febdf93e32fb008eef5596 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 5556658d17097436ac86de767fb92cb82d793f4d0ac77cdba0e0ec7bb7f4813d Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript vary Accept-Encoding priority u=3,i=?0 access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url access-control-allow-credentials true via 1.1 google cf-ray 8fdc71dc3cbdd2be-FRA access-control-allow-origin * x-powered-by Express server cloudflare
GET H3	200	warmly.js Show response opps-widget.getwarmly.com/	1 KB 2 KB	161ms 99ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 854515f13a032302be50faa83c7033319558bda07e7c22cb0befe1af42ecc015 Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status BYPASS etag W/"b12c9bbe9dbabc368ad6370931d3a9cd83071e17ad3929182123e049cbad032b-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHFcdzENCnSBsu1CyxZs45Ye5pf9rExn4SCuB5b1HSyvFLB4ihkQl8%2F3jm5qy7bDSrQHnpEGUBfhcuBTLnDbS0AqJcFM1G8kjHt%2FoR8xvUUw9L2BHq%2BBUAHWEMJyvTy03m6lPv58Lpi%2FchwG"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache MISS server-timing cfL4;desc="?proto=QUIC&rtt=47154&min_rtt=46673&rtt_var=10225&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4164&recv_bytes=4361&delivery_rate=12362&cwnd=12000&unsent_bytes=0&cid=caa9591a8d6144dd&ts=104&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 03 Jan 2025 16:48:06 GMT x-served-by cache-fra-eddf8230031-FRA x-cache-hits 0 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=3,i=?0 x-timer S1736174233.033665,VS0,VE32 referrer-policy origin-when-cross-origin cf-ray 8fdc71dc6f5130cf-FRA access-control-allow-origin * server cloudflare
GET H2	200	5298086.js Show response js-na1.hs-scripts.com/	2 KB 1 KB	112ms 43ms	Script application/javascript	2606:4700::6810:8ad1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/5298086.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff07c02b058ffb495472a85b2c0b0efd198d8f6cab2d2be1aa93130bf81b3a2e Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3600 content-encoding gzip cf-cache-status HIT age 5295 x-content-type-options nosniff date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id 5ec8cd03-e8d8-4633-9ad9-e601fc5b7df1 content-type application/javascript;charset=utf-8 vary origin, Accept-Encoding last-modified Mon, 06 Jan 2025 11:42:14 GMT access-control-allow-credentials true cf-ray 8fdc71dc7836ed1c-MXP accept-ranges bytes access-control-allow-origin https://www.cyberhaven.com content-length 650 server cloudflare
GET H2	200	array.js Show response us-assets.i.posthog.com/static/	175 KB 62 KB	226ms 148ms	Script text/javascript	2606:4700:10::6816:3ab5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/array.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3ab5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43672f1b60dd646276b135da4ed5cbcb33748cd1ddd1af70a2b2da8933c0e7f1 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 5 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8fdc71dc9d3eee79-MXP access-control-allow-origin * date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 13:17:24 GMT vary Accept-Encoding server cloudflare
GET H2	200	web gtm-server.cyberhaven.com/measurement/	35 B 386 B	351ms 256ms	Image image/gif	34.8.125.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://gtm-server.cyberhaven.com/measurement/web?event_name=page_view&event_id=1736175143268_17361743343541&page_location=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension%3Ffbclid%3Dnull%26li_fat_id%3Dnull Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.8.125.141 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.125.8.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires Thu, 01 Jan 1970 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif server Google Frontend
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4cc0/ Frame 1F26	0 0	123ms 40ms	Document text/html	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.cyberhaven.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 250108 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Fri, 03 Jan 2025 17:08:44 GMT expires Sat, 03 Jan 2026 17:08:44 GMT last-modified Thu, 12 Dec 2024 10:18:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
POST H2	204	collect region1.analytics.google.com/g/	0 0	163ms 58ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-WLE78NS0JZ&gtm=45je4cc1v890707664z8832240631za200zb832240631&_p=1736174232506&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=718325932.1736174233&ul=it-it&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1736174232&sct=1&seg=0&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clean_url=www.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.clean_path=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.level1=engineering-blog&ep.level2=cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tfd=862 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 548 B	160ms 50ms	Ping text/plain	2a00:1450:400c:c1f::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WLE78NS0JZ&cid=718325932.1736174233&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c1f::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/plain server Golfe2
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	160ms 68ms	Image image/gif	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-WLE78NS0JZ&cid=718325932.1736174233&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=3180383 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Mon, 06 Jan 2025 14:37:13 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_kk14jgkb/	3 B 124 B	103ms 34ms	XHR application/json	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_kk14jgkb/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json
GET H2	200	t2_kk14jgkb_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	115ms 47ms	XHR application/json	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_kk14jgkb_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	215ms 132ms	Image image/gif	151.101.129.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1736174232932&id=t2_kk14jgkb&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=4c4490ed-b719-465d-9851-0dff690e8df6&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif server Varnish
GET H2	200	modules.60031afbf51fb3e88a5b.js Show response script.hotjar.com/	223 KB 56 KB	145ms 48ms	Script application/javascript	13.33.187.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.33.187.109 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-187-109.fra60.r.cloudfront.net Software / Resource Hash e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b4a1a7933e55e780894c3f39b1aca0b4" age 1651566 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id jmxsE8-znI5K3M9XzCl1D9phanv_E1B912Gec037yH7E7jLZs2dppQ== date Wed, 18 Dec 2024 11:51:07 GMT content-type application/javascript; charset=utf-8 last-modified Wed, 18 Dec 2024 11:50:24 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 78668cba389ee6455cf1c23180f33cf8.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56408 x-amz-cf-pop FRA60-P9
GET H3	200	321517546861767 Show response connect.facebook.net/signals/config/	69 KB 14 KB	120ms 120ms	Script application/x-javascript	157.240.0.6 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/321517546861767?v=2.9.179&r=stable&domain=www.cyberhaven.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.6 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-02-fra3.fbcdn.net Software / Resource Hash eb24f0f3a43ff4aac43ed08c045e810d847652a5393b3db67de9f6c055deebc5 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-3iwwyvWk' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-3iwwyvWk' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=44, rtx=0, c=77, mss=1232, tbw=70495, tp=65, tpl=0, uplat=74, ullat=0 pragma public x-fb-debug KP1OyPKLuI805r6ouWe4VxtuBPP78OaEM3IoKpZI6HXaGjEiuO3rNOq4OV/OJfybonKd4PO9NKIS6ZoeV8lMsw== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/site/	5 KB 2 KB	114ms 66ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/site/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e384c0f00d27d6f1f244b5c774dae9383feb22b97a1eb6654a40ff8cc44a283a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 142 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json last-modified Mon, 06 Jan 2025 14:34:51 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fdc71dc7c51d2c2-FRA accept-ranges bytes access-control-allow-origin * content-length 1778 ce-version 11.5.340 server cloudflare
GET H2	200	adsct t.co/1/i/	43 B 627 B	323ms 232ms	Image image/gif	172.66.0.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=1caa5485-8d30-44c9-8f74-45163699270d&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f23f0db6-f58a-44ed-8603-42caa0b32836&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=0 x-transaction-id 16ca9efb1d7c55ce cache-control no-cache, no-store, max-age=0 x-connection-hash c622f17b68f34ee1be78275479f51635525d940794a6027d2c0b53ddd3793d94 cf-cache-status DYNAMIC cf-ray 8fdc71dd08522c26-FRA x-response-time 167 content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 726 B	321ms 217ms	Image image/gif	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2632%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=1caa5485-8d30-44c9-8f74-45163699270d&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=f23f0db6-f58a-44ed-8603-42caa0b32836&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 25b59e4dd2734ca6 cache-control no-cache, no-store, max-age=0 x-connection-hash c723e91043d9231e8e3acd0368e0f59073cf74d452fede9427351a2ca979f58b x-response-time 173 content-length 43 date Mon, 06 Jan 2025 14:37:12 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	53ms 52ms	Script application/javascript	2a02:26f0:2780:5e::210:a86b AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:2780:5e::210:a86b , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=72585 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Mon, 06 Jan 2025 14:37:13 GMT last-modified Mon, 02 Dec 2024 10:13:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	6si.min.js Show response j.6sc.co/	69 KB 19 KB	45ms 45ms	Script application/javascript	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "6763d3a0-115be" x-content-type-options nosniff expires Mon, 06 Jan 2025 17:37:13 GMT accept-ranges bytes content-length 19249 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 19 Dec 2024 08:04:48 GMT
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 410 B	65ms 65ms	Image image/gif	2a00:1450:4001:82a::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=516082823&utmhn=www.cyberhaven.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=it-it&utmje=0&utmfl=-&utmhid=1089369735&utmr=-&utmp=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&utmht=1736174233020&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D154243370.718325932.1736174233.1736174233.1736174233.1%3B%2B__utmz%3D154243370.1736174233.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=495033328&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],} x-content-type-options nosniff content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0 expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:13 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif server Golfe2
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 813 B	300ms 220ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1962740&time=1736174233062&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.cyberhaven.com/ Response headers x-li-pop afd-prod-lor1-x content-encoding gzip x-fs-uuid 00062b0a9070d41e016fd2799d2a0ebd x-msedge-ref Ref A: B9FA6C199E2C4E5F8D2227190F53E57D Ref B: ZRHEDGE1910 Ref C: 2025-01-06T14:37:13Z x-li-fabric prod-lor1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYrCpBw1B4Bb9J5nSoOvQ== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Mon, 06 Jan 2025 14:37:12 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recen...	0 482 B	298ms 205ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJtlqvIW8lelwAAAZQ8DGbNiktjDaEdLepnZp1gOE87hhXRyfAKV415xLTG54gCBwgwBQ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} x-msedge-ref Ref A: FA90BBD4F6BA456EB2C91ECBBD51065C Ref B: MIL30EDGE1206 Ref C: 2025-01-06T14:37:13Z x-li-fabric prod-lor1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-uuid AAYrCpB2IWW7Kfopdgw6qQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lor1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1736174233062&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJtlqvIW8lelwAAAZQ8DGbNiktjDaEdLepnZp1gOE87hhXRyfAKV415xLTG54gCBwgwBQ x-msedge-ref Ref A: 826FEAC79F1D4250B74B7D60CD2D7852 Ref B: ZRHEDGE1008 Ref C: 2025-01-06T14:37:13Z x-li-fabric prod-lor1 x-li-uuid AAYrCpBxdSG9XtrIxdQFiQ== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 06 Jan 2025 14:37:12 GMT
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 706 B	140ms 51ms	XHR application/json	37.252.171.21 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 192.145.127.213; 192.145.127.213; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://www.cyberhaven.com an-x-request-uuid fce3ef61-0633-4390-8780-b3a183f48a94 content-length 11 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Mon, 06 Jan 2025 14:37:13 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H/1.1	200 OK	/ Show response c.6sc.co/	7 B 332 B	177ms 50ms	XHR text/html	2.21.65.132 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.21.65.132 , Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-21-65-132.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers Access-Control-Max-Age 86400 Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Methods GET,POST Access-Control-Allow-Origin https://www.cyberhaven.com Content-Length 7 Date Mon, 06 Jan 2025 14:37:13 GMT Content-Type text/html Access-Control-Allow-Headers *
GET H2	200	/ Show response ipv6.6sc.co/	18 B 312 B	160ms 40ms	XHR text/html	2a02:26f0:480:23::1726:629c AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 4f6fe757e38e949f3d6f7e815228d32e0d416a5f69b3137aa1fccb6f955e1582 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:24:44::18 expires Mon, 06 Jan 2025 14:37:13 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1736174233163_388391900_1151089593_27_1287_37_41_219";dur=1 access-control-allow-origin https://www.cyberhaven.com content-length 18 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/html vary Origin
GET H3	200	4905af20a771527fdcc240cf8ab4172a.js Show response script.crazyegg.com/pages/versioned/common-scripts/	107 KB 37 KB	53ms 53ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f17058a6ac8f171e452a0ed24075c6e592834eef8dc12e343ade35adc73c4cc Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 982361 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:04 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8fdc71dce9a5dbc9-FRA accept-ranges bytes access-control-allow-origin * content-length 37122 server cloudflare
GET H3	200	/ www.facebook.com/tr/	0 16 B	119ms 51ms	Image text/plain	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1736174233090&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1736174233090.21929833654333385&ler=empty&cdl=API_unavailable&it=1736174232962&coo=false&eid=1736175143268_17361743343541&tm=1&rqm=GET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality GOOD; q=0.7, rtt=50, rtx=0, c=23, mss=1232, tbw=4526, tp=10, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 202 B	281ms 215ms	Image image/png	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1736174233090&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1736174233090.21929833654333385&ler=empty&cdl=API_unavailable&it=1736174232962&coo=false&eid=1736175143268_17361743343541&tm=1&rqm=FGET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7456811552515298691"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x388744eefc87a3b9","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["5988309531205427"]},"debug_reporting":true,"debug_key":"1683008227569639437"} date Mon, 06 Jan 2025 14:37:13 GMT content-type image/png vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7456811552515298691", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-debug dRm0nESf4mjdqcIkRWVnJLvYZD6ugG/plCR7wnOH6xEqAGmLSoZl5n1BZ7FGkF+STYP0VXf5Mq/KI4ZqU1Htkg== cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality GOOD; q=0.7, rtt=50, rtx=0, c=23, mss=1232, tbw=4894, tp=13, tpl=0, uplat=164, ullat=0 pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	0 44 B	359ms 246ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 x-envoy-response-flags - x-content-type-options nosniff content-length 0 date Mon, 06 Jan 2025 14:37:12 GMT content-type application/javascript;charset=utf-8 server Clearbit
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	168 KB 45 KB	297ms 205ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash 9be0e78d405feaf2f28eaa33d8f8b0c298c5385a546d825fba34e81aed740be0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip x-envoy-response-flags - x-content-type-options nosniff date Mon, 06 Jan 2025 14:37:13 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit
GET H2	200	conversations-embed.js Show response js.usemessages.com/	94 KB 27 KB	113ms 44ms	Script application/javascript	2606:4700::6810:4e8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4e8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d2b03470a7d1ae7aba4f78432a23655d3e5092f63312f3dcc3bd1f3e2ed7ec5 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all x-request-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-encoding gzip cf-cache-status HIT etag W/"4dfe3f6f9786f2063afe9a04ac031914" x-amz-version-id fDaori16DhigsoRwsdU7m4W4sxmAcg6S cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod age 80 x-content-type-options nosniff x-cache Hit from cloudfront x-hs-cache-status HIT x-amz-cf-id j-SnkIpB8dxYR4_xkUb1_co81133geiWWU2BVr0S_m3zvz2sOR5wuw== date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-type application/javascript; charset=utf-8 last-modified Tue, 17 Dec 2024 16:16:40 UTC vary accept-encoding x-evy-trace-listener listener_https x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-mglm2 x-envoy-upstream-service-time 0 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19372/bundles/project.js&cfRay=8f76c22c89cd8fd6-FRA via 1.1 b77313059f3d50280ced20238b151620.cloudfront.net (CloudFront) cf-ray 8fdc71de1f33ee5f-MXP x-evy-trace-route-configuration listener_https/all x-hs-target-asset conversations-embed/static-1.19372/bundles/project.js x-amz-cf-pop IAD12-P3 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	banner.js Show response js.hs-banner.com/v2/5298086/	71 KB 26 KB	145ms 79ms	Script text/javascript	2606:4700:4400::ac40:9310 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/5298086/banner.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1f5bfd29b1b65351bdeec611c0f02131e5a8a7336e2d87075b15dff2b7f3f8f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all access-control-max-age 604800 x-request-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing content-encoding gzip cf-cache-status HIT etag W/"70c5670e6d77885ece19beb74afe4af5" x-amz-version-id GcEt1rgO1vU4WsJ6afMIGzER7IXMa_OI access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD expires Mon, 06 Jan 2025 14:39:51 GMT x-evy-trace-listener listener_https date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea content-type text/javascript; charset=UTF-8 last-modified Thu, 24 Oct 2024 19:19:32 GMT vary origin, Accept-Encoding x-amz-id-2 MQCYBvG4V5+djwpG0cU2tMuf/xfG+OQ3887eGE3FR+ewuikvYiayuXnhJbexmo5WsCK+SjZoz4I= access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public timing-allow-origin * x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-85276 x-envoy-upstream-service-time 156 access-control-allow-credentials true x-amz-request-id 6NB4N8W9R5GSAPVD cf-ray 8fdc71de3be0ed8e-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-amz-server-side-encryption AES256
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	70 KB 25 KB	111ms 50ms	Script application/javascript	2606:4700::6810:6cfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6cfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers x-request-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-encoding gzip cf-cache-status HIT x-amz-version-id 8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_ etag W/"ceb8bcb73e5536d8416735a3977d227a" cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-content-type-options nosniff x-cache Hit from cloudfront x-evy-trace-listener listener_https x-amz-cf-id 8WfkRX3JAvexG5l-W6G4VtYiAK3XggMdfy0nlP-0JfveLJ71QnecPQ== x-hubspot-correlation-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-type application/javascript; charset=utf-8 last-modified Mon, 09 Dec 2024 13:03:17 UTC x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-4w2hc x-envoy-upstream-service-time 5 x-hs-target-asset collected-forms-embed-js/static-1.1112/bundles/project.js server cloudflare x-evy-trace-virtual-host all x-amz-server-side-encryption AES256 access-control-max-age 3000 access-control-allow-methods GET x-hs-cache-status MISS date Mon, 06 Jan 2025 14:37:13 GMT vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8ef5bfb0bfdeedcb-FRA via 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront) cf-ray 8fdc71deae52ee68-MXP access-control-allow-origin * x-evy-trace-route-configuration listener_https/all x-amz-cf-pop IAD12-P3
GET H2	200	5298086.js Show response js.hs-analytics.net/analytics/1736163600000/	68 KB 25 KB	122ms 56ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1736163600000/5298086.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash deff21bdd3cf5ec27f508fe5d3e13bcd67ffb7dda68e07d97582cddc6ab4e7f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 x-request-id e6e26454-d7b6-4497-8dd0-3f3d874fbe5c content-encoding gzip cf-cache-status HIT etag W/"db94dc959471013f74dd433982c87807" x-amz-version-id null expires Mon, 06 Jan 2025 14:41:43 GMT x-evy-trace-listener listener_https date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id e6e26454-d7b6-4497-8dd0-3f3d874fbe5c content-type text/javascript last-modified Wed, 06 Nov 2024 18:35:26 GMT vary origin, Accept-Encoding x-amz-id-2 V8lrtGcO4pX4Dqoq6IiTvvlPMe77HmKrb4+MbH1Cvt+Q8IIkZlwxL1UomKWBwN4YaYAM7cgQ8oO+5O0Kd0IBb4ie1VQUCd+ucwD1tQ6gshk= x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-t4w29 x-envoy-upstream-service-time 35 access-control-allow-credentials false x-amz-request-id D62P6D8BNRVY8X0Q cf-ray 8fdc71debbb9ed23-MXP x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	204	3169094 Show response vc.hotjar.io/sessions/	0 232 B	183ms 68ms	XHR text/plain	18.66.112.19 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vc.hotjar.io/sessions/3169094?s=0.25&r=0.11590574678590992 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.19 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-19.fra56.r.cloudfront.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers via 1.1 cf2071a2896a4f71dbfdbc521d554362.cloudfront.net (CloudFront) access-control-allow-origin * cache-control no-store x-cache Miss from cloudfront x-amz-cf-id O21pl4AHapPS1xyDKTm-0gxmVQ09K6pqW22ruB3CU4-C33nvLuBIzQ== date Mon, 06 Jan 2025 14:37:13 GMT x-amz-cf-pop FRA56-P5
GET H2	200	browser-perf.8417c6bba72228fa2e29.js Show response script.hotjar.com/	5 KB 2 KB	42ms 42ms	Script application/javascript	13.33.187.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/browser-perf.8417c6bba72228fa2e29.js Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.33.187.109 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-187-109.fra60.r.cloudfront.net Software / Resource Hash 70712c8650feecc46403b5801b9d5b72d5b2d6ba1d1cf0317e105603982321bf Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b83b61bc5871e9a23a0434e2c539f4f3" age 9474472 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id rHDYvrcx5_hNG9QD2DrVPl8AZvdl-oCetSTGmozAUqmu2vjAE4EfOg== date Wed, 18 Sep 2024 22:49:21 GMT content-type application/javascript; charset=utf-8 last-modified Tue, 17 Sep 2024 15:41:53 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 78668cba389ee6455cf1c23180f33cf8.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 1782 x-amz-cf-pop FRA60-P9
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	155ms 129ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	148ms 131ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22218d4ca0f0d30c4801ecd3d056a7fae0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22555171e6d4c91ba269d673d31c487f9d31fe33c9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22bda12b36-0455-47af-b8ba-9529bbb134fb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	config.js Show response us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/	963 B 766 B	429ms 429ms	Script application/javascript	2606:4700:10::6816:3ab5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/config.js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3ab5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224f0faed26a56018f3d6f3d5e8fe2dda990c262ca0903c723145d2b47d1b108 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status EXPIRED x-content-type-options nosniff date Mon, 06 Jan 2025 14:37:13 GMT content-type application/javascript vary Origin, Referer, Accept-Encoding last-modified Mon, 06 Jan 2025 14:37:13 GMT x-frame-options SAMEORIGIN cache-control max-age=300 cross-origin-opener-policy same-origin x-envoy-upstream-service-time 17 referrer-policy same-origin allow GET, HEAD, OPTIONS cf-ray 8fdc71ddc82aee79-MXP accept-ranges bytes access-control-allow-origin * content-length 568 server cloudflare
POST H2	200	/ Show response us.i.posthog.com/decide/	861 B 837 B	517ms 132ms	Fetch application/json	44.219.183.100 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/decide/?v=3&ip=1&_=1736174233226&ver=1.203.3&compression=base64 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.219.183.100 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-219-183-100.compute-1.amazonaws.com Software envoy / Resource Hash c28e2af4e14aafdc9b247281d5aa398e81f6c95a1543caa0fdc786ffe4552856 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/x-www-form-urlencoded Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/sampling/	160 B 392 B	58ms 57ms	XHR application/json	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/sampling/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 814f40bffe8a80758359466be6bb4cc9c21c9ab9e664139f5e959fd16797b3d7 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 141 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json last-modified Mon, 06 Jan 2025 14:34:52 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8fdc71ddef40d2c2-FRA accept-ranges bytes access-control-allow-origin * content-length 149 ce-version 11.5.340 server cloudflare
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 656 B	171ms 73ms	XHR application/json	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 9d3d1562c7ca9da6bacad14844adfc7dcfd6f9f0bd0016f1ef70845ae0c00bf0 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	164ms 50ms	Preflight	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 06 Jan 2025 14:37:13 GMT timing-allow-origin https://6sense.com x-6si-region
POST H2	200	/ Show response us.i.posthog.com/e/	13 B 414 B	507ms 133ms	Fetch application/json	44.219.183.100 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/e/?ip=1&_=1736174233236&ver=1.203.3&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.219.183.100 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-219-183-100.compute-1.amazonaws.com Software envoy / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 130ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A18%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	204	clock tracking.crazyegg.com/ Frame	0 0	235ms 90ms	Preflight	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1736174233295&tk=8278c3be49784fffa4a1b15f884798b8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods access-control-allow-methods * access-control-allow-origin * access-control-max-age 86400 cache-control public, max-age=86400 date Mon, 06 Jan 2025 14:37:13 GMT server awselb/2.0 vary Access-Control-Request-Headers, Origin, Access-Control-Request-Method
GET		9d92160d-b74f-4dd3-afec-f938b7a708a3 https://www.cyberhaven.com/ Frame	0 0
POST H2	200	clock Show response tracking.crazyegg.com/	41 B 147 B	107ms 106ms	XHR text/plain	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1736174233295&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 0a828fd6a48f2ee8aec5e8199a000152f92e3632535bdb9b5a92e90a70a086fb Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers cache-control no-store access-control-allow-origin * content-length 41 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/plain server awselb/2.0
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/	19 B 462 B	149ms 45ms	XHR application/json	13.35.58.27 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.27 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-27.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 9098479 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id FDmZK1EBmhKZ5VwDjpuAtHUZ4eiA7fW5wmj3L8xFFh3sWGdLylvo0A== date Mon, 23 Sep 2024 07:15:55 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 2809edb23da5b1de8a640a251efb8608.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P10 server AmazonS3
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/	19 B 462 B	141ms 44ms	XHR application/json	18.66.122.57 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.57 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-57.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 9613496 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id Gyqlkh3PHcDDrqdS6q5tZtYyb7m0VrEXonYeRI9uiLhz9Ejq9dc7jg== date Tue, 17 Sep 2024 08:12:17 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 da6955a1993e1118f32bcb48c6630c20.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P2 server AmazonS3
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	297 B 944 B	279ms 279ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=6ca2e54bd0f448deb3cacdf072beb3e6&traceId=6ca2e54bd0f448deb3cacdf072beb3e6 Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bed0bb479e6f4b1d821ada4e07fe9e1fd821a84c517a5bcde615afeabc1d055c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 X-HubSpot-Messages-Uri https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3jXlJ3GRqEn0LAozCRnd6Da5Ln0StYEHnJ%2B%2FZ3C39RUoK%2Fk1zk%2FYmQ2B6g1c3qxl3spwM1EcgMAunp2yVbrBdwPSTThqHWGFYGFpuPivEyCM3TZRhgoNU%2B1Sd2j05xoF2bcSLSyjGrUqNYhxg%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id 9755c6bb-a748-4619-a214-7ba84b2cf50a content-type application/json;charset=utf-8 vary origin, Accept-Encoding access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials false cf-ray 8fdc71dffb950d53-MXP access-control-allow-origin https://www.cyberhaven.com content-length 237 server cloudflare
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	239ms 163ms	Preflight text/plain	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=6ca2e54bd0f448deb3cacdf072beb3e6&traceId=6ca2e54bd0f448deb3cacdf072beb3e6 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://www.cyberhaven.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8fdc71defb060d53-MXP content-length 18 content-type text/plain; charset=utf-8 date Mon, 06 Jan 2025 14:37:13 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yyGUvF1X1byyA9gYJaVfamB3gbBFaAOecTBiQAW3p59mrRG%2BLaEakvUM3VoCVbsMGA1H7PLME9koHuQBBBMPSppqaALnk3kFlDom0xtBeG3PfAvYI6njyCWeySJPfztIi%2FFEygvZ9aZomUuY9g%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-hubspot-correlation-id 93c3d788-0144-4275-b908-60b5d162181b
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	133 B 635 B	138ms 136ms	XHR application/json	2606:4700::6810:6cfe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=5298086&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6cfe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51cde42c03bdfd44328fe282089cbd8e3ee5185c09d38ac0814480d824de684a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, */* Referer https://www.cyberhaven.com/ Response headers x-robots-tag none access-control-max-age 180 x-request-id f1690efe-1e04-48d2-afb8-1c30b4600361 content-encoding br cf-cache-status DYNAMIC access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff x-evy-trace-listener listener_https date Mon, 06 Jan 2025 14:37:13 GMT x-hubspot-correlation-id f1690efe-1e04-48d2-afb8-1c30b4600361 content-type application/json;charset=utf-8 vary Accept-Encoding access-control-allow-headers * x-evy-trace-route-service-name envoyset-translator cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-7cp72 x-envoy-upstream-service-time 4 cf-ray 8fdc71df1f61ee68-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	348ms 207ms	XHR application/json	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload access-control-max-age 7200 access-control-expose-headers content-encoding gzip x-envoy-response-flags - access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; x-content-type-options nosniff access-control-allow-origin https://www.cyberhaven.com date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Accept-Encoding, Origin server Clearbit
OPTIONS H2	200	details eps.6sc.co/v3/company/ Frame	0 0	168ms 51ms	Preflight	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,epsiloncookie,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,epsiloncookie,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 06 Jan 2025 14:37:13 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	details Show response eps.6sc.co/v3/company/	738 B 655 B	79ms 78ms	Fetch application/json	99.83.231.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.83.231.3 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 9d3d1562c7ca9da6bacad14844adfc7dcfd6f9f0bd0016f1ef70845ae0c00bf0 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb EpsilonCookie null User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	v v.eps.6sc.co/ Frame	0 0	252ms 140ms	Preflight application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Mon, 06 Jan 2025 14:37:13 GMT via 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront) x-amz-apigw-id D-GYFHjyIAMETNQ= x-amz-cf-id QrFdYepIVyh135NK1FE0i1BDB51OnctLPn_EkjckEY62KzyZvKhv2Q== x-amz-cf-pop FRA60-P10 x-amzn-requestid 8a6be4a9-08ed-44bc-b6eb-876407e7d7c7 x-cache Miss from cloudfront
POST H2	200	v Show response v.eps.6sc.co/	12 B 519 B	215ms 214ms	XHR application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers x-amz-apigw-id D-GYHEpJoAMEL_Q= x-amzn-trace-id Root=1-677bea99-7b6395aa515c090c13ae309d;Parent=361d2c3407bc882e;Sampled=0;Lineage=1:56167173:0 access-control-allow-methods OPTIONS,POST x-amzn-requestid 1d616fe8-5329-436e-9970-4e64127d5450 via 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 12 x-amz-cf-id RpmAt83gUs-rJIgFsnl8jH4t76iYrL7XwShIr3Acc5qYsSFvpfLauw== date Mon, 06 Jan 2025 14:37:13 GMT content-type application/json x-amz-cf-pop FRA60-P10 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	131ms 130ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=https%3A%2F%2Fepsilon.6sense.com&q=%7B%22name%22%3A%22https%3A%2F%2Fepsilon.6sense.com%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1168.7000002861023%2C%22duration%22%3A337%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1168.7000002861023%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1505.7000002861023%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=&d=1&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET		217e2b5b-597e-42a2-b276-a2f1d22d575f https://www.cyberhaven.com/ Frame	0 0
GET H3	200	cdc746c62076757bb4e3133b83f84f01.js Show response script.crazyegg.com/pages/versioned/trackingpagestate-scripts/	20 KB 8 KB	50ms 50ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/trackingpagestate-scripts/cdc746c62076757bb4e3133b83f84f01.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2371b74e57f4690cc3ea0847772618a505fc224fcbada874b4f181dcc8c00a9e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 1083887 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:28 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8fdc71e0695bdbc9-FRA accept-ranges bytes access-control-allow-origin * content-length 8064 server cloudflare
GET H3	200	496d1b1e10152b872f6786d06ae2cb02.js Show response script.crazyegg.com/pages/versioned/tracking-scripts/	96 KB 31 KB	49ms 49ms	Script text/javascript	104.19.148.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/tracking-scripts/496d1b1e10152b872f6786d06ae2cb02.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.148.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8ee64f33cd91015eaff6d4d575801786cbd619dc5afbf244dd76c657b66a2aaf Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 976317 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:23 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8fdc71e0ba28dbc9-FRA accept-ranges bytes access-control-allow-origin * content-length 31490 server cloudflare
GET H2	200	recorder.js Show response us-assets.i.posthog.com/static/	112 KB 40 KB	137ms 137ms	Script text/javascript	2606:4700:10::6816:3ab5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/recorder.js?v=1.203.3 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3ab5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ec3f8ef2aa975a22f11d5d3592111d857a5917287a00ca6cf191d72859354d75 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8fdc71e10f9aee79-MXP access-control-allow-origin * date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 13:17:25 GMT vary Accept-Encoding server cloudflare
GET H2	200	dead-clicks-autocapture.js Show response us-assets.i.posthog.com/static/	14 KB 5 KB	209ms 209ms	Script text/javascript	2606:4700:10::6816:3ab5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.203.3 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3ab5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6efafe07fd29b04ec60906d17ea4e89d6c0601d49ff2f160e06d709060bbcee2 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=14400 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8fdc71e10f9cee79-MXP access-control-allow-origin * date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 13:17:25 GMT vary Accept-Encoding server cloudflare
GET H2	200	web-vitals.js Show response us-assets.i.posthog.com/static/	10 KB 4 KB	147ms 147ms	Script text/javascript	2606:4700:10::6816:3ab5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/web-vitals.js?v=1.203.3 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3ab5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7196c8f501e096262228f56c988d4fb9e4b2e3e331e411f40c30e6889f282fb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 3 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8fdc71e10f9eee79-MXP access-control-allow-origin * date Mon, 06 Jan 2025 14:37:13 GMT content-type text/javascript; charset="utf-8" last-modified Mon, 06 Jan 2025 13:17:24 GMT vary Accept-Encoding server cloudflare
GET		33400d88-fb89-443a-b11d-85909e2583c0 https://www.cyberhaven.com/ Frame	0 0
GET		446d3beb-2531-4c00-b3ca-eff72484c8e4 https://www.cyberhaven.com/ Frame	0 0
GET		8ae7b8e9-b747-48bf-b2b6-98939a054964 https://www.cyberhaven.com/ Frame	0 0
OPTIONS H2	204	v11 tracking.crazyegg.com/ Frame	0 0	86ms 86ms	Preflight	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/v11?u=1152985&st=411982&s=&ss=b82628a0-cc3b-11ef-9cf5-1970b3433ce2&p=e555ee0ed84a9ccde22c805e0897c536&tk=8278c3be49784fffa4a1b15f884798b8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods access-control-allow-methods * access-control-allow-origin * access-control-max-age 86400 cache-control public, max-age=86400 date Mon, 06 Jan 2025 14:37:13 GMT server awselb/2.0 vary Access-Control-Request-Headers, Origin, Access-Control-Request-Method
POST H2	201	v11 Show response tracking.crazyegg.com/	0 82 B	91ms 91ms	XHR text/plain	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/v11?u=1152985&st=411982&s=&ss=b82628a0-cc3b-11ef-9cf5-1970b3433ce2&p=e555ee0ed84a9ccde22c805e0897c536&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/gzip Referer https://www.cyberhaven.com/ Response headers access-control-allow-origin * content-length 0 date Mon, 06 Jan 2025 14:37:13 GMT content-type text/plain server awselb/2.0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	129ms 129ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=ni%3Aepsv&q=%7B%22or%22%3A%22%22%2C%22nr%22%3A%22%22%2C%22orl%22%3A338%2C%22nrl%22%3A248%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Atrue%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	200	v v.eps.6sc.co/ Frame	0 0	141ms 140ms	Preflight application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Mon, 06 Jan 2025 14:37:13 GMT via 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront) x-amz-apigw-id D-GYGEFOIAMEi7Q= x-amz-cf-id xZQzHijs0J6Co76GeKESJwUhh3k2vlZXHD8SH11JTI4bDSMpVngEWg== x-amz-cf-pop FRA60-P10 x-amzn-requestid d83972f9-05d6-403f-b90e-7845912d1dac x-cache Miss from cloudfront
POST H2	200	v Show response v.eps.6sc.co/	12 B 521 B	213ms 212ms	XHR application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers x-amz-apigw-id D-GYIGidoAMEiDw= x-amzn-trace-id Root=1-677bea9a-33816aa429b9c4935e0a32d9;Parent=06b2f54f66a2d0d7;Sampled=0;Lineage=1:56167173:0 access-control-allow-methods OPTIONS,POST x-amzn-requestid db9cf5cc-0618-40da-8c5b-7e24f4ed7edf via 1.1 0679859c01a1d918f3fb77e42174ecf8.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 12 x-amz-cf-id XulMks4tYpXxoMuZSCJvyFw6_LOGPFhlPcUXpIGIfT7t84h06kavYg== date Mon, 06 Jan 2025 14:37:14 GMT content-type application/json x-amz-cf-pop FRA60-P10 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 129ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1515.2000002861023%2C%22duration%22%3A247.59999990463257%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1515.2000002861023%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1762.8000001907349%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=&d=1&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:13 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:13 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	blockedDomains.json Show response hubspotonwebflow.com/assets/js/	98 KB 23 KB	62ms 62ms	Fetch application/json	66.33.60.67 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/blockedDomains.json Requested by Host: hubspotonwebflow.com URL: https://hubspotonwebflow.com/assets/js/form-124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.67 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"04708d47dd194d37b8231a65de7a66f1" age 7563715 x-matched-path /assets/js/blockedDomains.json access-control-allow-origin * date Mon, 06 Jan 2025 14:37:14 GMT content-disposition inline; filename="blockedDomains.json" content-type application/json; charset=utf-8 server Vercel last-modified Thu, 10 Oct 2024 20:46:42 GMT x-vercel-id fra1::9gxl7-1736174233983-6a8023763e24
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	218ms 153ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=151041951&v=1.1&a=5298086&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&cts=1736174233966&vi=26002a19d5feed2e7d3b5e938704a82d&nc=true&u=208653005.26002a19d5feed2e7d3b5e938704a82d.1736174233965.1736174233965.1736174233965.1&b=208653005.1.1736174233965&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none x-request-id c6a1f343-b063-417c-be59-9f2e8d409b36 cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVMQ%2BM6wCjucNW4PKtSO0z75WfGJm0iKN05yr1vcqpjTS3SoK3Wvtgw85xlhdb6AzbnJJsIh937yr5JOCIHuz%2BA2DX6U%2FCK7Pet7oVrFzQqUYHVYTnRiIohx4HPmtyy%2FZIftbsZ3J5Il%2B3dg7I0f"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-evy-trace-listener listener_https p3p CP="NOI CUR ADM OUR NOR STA NID" date Mon, 06 Jan 2025 14:37:14 GMT x-hubspot-correlation-id c6a1f343-b063-417c-be59-9f2e8d409b36 content-type image/gif vary origin, Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator cache-control no-cache, no-store, no-transform nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-8lhqm x-envoy-upstream-service-time 6 access-control-allow-credentials false cf-ray 8fdc71e2ceda375d-MXP x-evy-trace-route-configuration listener_https/all content-length 45 server cloudflare x-evy-trace-virtual-host all
GET H3	200	6515e83924723987bacc4b6b_favicon.png cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	2 KB 2 KB	60ms 60ms	Other image/png	104.18.161.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/6515e83924723987bacc4b6b_favicon.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.161.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35f594c6250e4f6beb23551ea8b2128ca0faa451998403ac7859bc51873b3cf2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "7f9532364c9c4bd7e55de7b330a315d7" x-amz-version-id 2PFNNcwh85NMJaJS3FT9RI.EWY5iSVaq age 1881533 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 06 Jan 2025 14:37:14 GMT content-type image/png last-modified Thu, 28 Sep 2023 20:55:22 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 DXBM/QZjP7VP0udFWwQW1Ne7Ln2t4YKWVp1eFwUKXXpTzGxa2UJL/gJOzqOckRkg147HE3WbLM62S9LLMIF80Un+8HW3s9kvXNDcEiWLLzw= cache-control max-age=31536000, must-revalidate x-amz-request-id RFQT0G6005M45KPE cf-ray 8fdc71e27b681e51-FRA accept-ranges bytes access-control-allow-origin * content-length 1946 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	142ms 142ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A13%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:14 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:14 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H3	200	widget-X-lC0KIY.js Show response opps-widget.getwarmly.com/	599 KB 183 KB	93ms 50ms	Script text/javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e205d249d21cce1b88ce4e38ad4652f44215f09667880d8defb90545f21b35f9 Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"be5996212d89bfb98baee4c1309c1a500adb16cbcd30f1dbea66589d5c04b685-br" age 744 x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ap%2Fk4lFwQwua6Nn8nJ0ObubwWKmBhjtOgdgxrcEjasUHnK7LCRCUb0SohzQNQrHSm%2FzM%2B8ivoSSrzcBfgmlpU4rgUehg27Fzc5wz5Oa3ZJkNpC9d81aDvL5n1FR9VuExXJjNBepRueHTgoX0"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache HIT server-timing cfL4;desc="?proto=QUIC&rtt=38579&min_rtt=38576&rtt_var=14471&sent=9&recv=6&lost=0&retrans=0&sent_bytes=2157&recv_bytes=4073&delivery_rate=34935&cwnd=12000&unsent_bytes=0&cid=b7507b0e6db5afa4&ts=53&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 06 Jan 2025 14:37:14 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 03 Jan 2025 16:48:06 GMT x-served-by cache-fra-eddf8230030-FRA x-cache-hits 103 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=1,i=?0 x-timer S1735923638.204211,VS0,VE0 referrer-policy origin-when-cross-origin cf-ray 8fdc71e3abcf0410-FRA access-control-allow-origin * server cloudflare
POST H3	200	sessions.createSession Show response opps-api.getwarmly.com/api/sessions/trpc/	2 KB 2 KB	271ms 217ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 5ba4a8bf23f79b9cd83dee3c0a24fdea4dae4e520a236e1381b85653d6cc79c1 Request headers x-warmly-user-identifier x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 1327e9b0-0b76-42ac-9539-7194a066125d X-Warmly-Target session-server User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2116 date Mon, 06 Jan 2025 14:37:14 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	sessions.createSession opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	280ms 167ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 06 Jan 2025 14:37:14 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
OPTIONS H2	204	sessions.trackScriptAdded opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	170ms 170ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 06 Jan 2025 14:37:15 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		cs a.usbrowserspeed.com/	0 0
GET H2	200	did-008f.min.js Show response d-code.liadm.com/	136 KB 46 KB	161ms 48ms	Script application/javascript	2600:9000:2156:3a00:1c:2afd:fb00:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d-code.liadm.com/did-008f.min.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:3a00:1c:2afd:fb00:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 4e74df57357b9705a6880964b39f7951b0c2be130d14fe7cadd8a9e4f85147d2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public,max-age=86400 content-encoding gzip age 75334 via 1.1 f7b7cf90592cf6a380fd34cc45e9c4b4.cloudfront.net (CloudFront) x-cache Hit from cloudfront x-amz-cf-id 1Fszccyz3aFwJd5dgE75blGAYh8iOkGFKold1D4QNXv5loYR5k-meg== date Sun, 05 Jan 2025 17:41:41 GMT content-type application/javascript vary Accept-Encoding x-amz-cf-pop FRA50-C1
POST H3	200	sessions.trackScriptAdded Show response opps-api.getwarmly.com/api/sessions/trpc/	65 B 82 B	170ms 169ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 1327e9b0-0b76-42ac-9539-7194a066125d content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Mon, 06 Jan 2025 14:37:15 GMT content-type application/json; charset=utf-8 vary Origin
GET H3	200	chat.getMessages Show response opps-api.getwarmly.com/api/sessions/trpc/	31 B 47 B	167ms 166ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%221986ccad-d5b9-420e-a58c-216142d777d4%22%7D%7D Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 2485e74dd82a729476c358bb9ad59c0322ee42bfeeac9805606cb9da39a47f98 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 1327e9b0-0b76-42ac-9539-7194a066125d content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 date Mon, 06 Jan 2025 14:37:15 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	chat.getMessages opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	169ms 168ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%221986ccad-d5b9-420e-a58c-216142d777d4%22%7D%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 06 Jan 2025 14:37:15 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	143ms 142ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A15%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A14%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:15 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:15 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	204	any Show response idx.liadm.com/idex/did-008f/	0 374 B	399ms 127ms	XHR text/plain	3.221.57.175 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://idx.liadm.com/idex/did-008f/any?duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&did=did-008f&cd=.cyberhaven.com&pu=https%3A%2F%2Fwww.cyberhaven.com%2F&pv=fe0f6f6b-6932-461e-ab7d-045131619c01&resolve=md5&resolve=sha2&resolve=age&resolve=gender Requested by Host: d-code.liadm.com URL: https://d-code.liadm.com/did-008f.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.221.57.175 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-221-57-175.compute-1.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains cache-control max-age=3599, private trace-id 234d8b1ddcad03e6 request-time 0 access-control-allow-credentials true expires Mon, 06 Jan 2025 15:37:15 GMT access-control-allow-origin https://www.cyberhaven.com date Mon, 06 Jan 2025 14:37:15 GMT vary Origin
OPTIONS H3	204	sessions.captureLiveIntent opps-api.getwarmly.com/api/trpc/ Frame	0 0	159ms 159ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/trpc/sessions.captureLiveIntent Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 06 Jan 2025 14:37:15 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
POST H3	200	sessions.captureLiveIntent Show response opps-api.getwarmly.com/api/trpc/	65 B 81 B	159ms 158ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/trpc/sessions.captureLiveIntent Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-session-id 1986ccad-d5b9-420e-a58c-216142d777d4 x-warmly-user-identifier 78efbaba-4990-4e4c-adfe-5bc0bfb6f05c x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 1327e9b0-0b76-42ac-9539-7194a066125d x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Mon, 06 Jan 2025 14:37:15 GMT content-type application/json; charset=utf-8 vary Origin
POST H2	201	v11 Show response tracking.crazyegg.com/	0 82 B	127ms 125ms	XHR text/plain	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/v11?u=1152985&st=411982&s=&ss=b82628a0-cc3b-11ef-9cf5-1970b3433ce2&p=e555ee0ed84a9ccde22c805e0897c536&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/gzip Referer https://www.cyberhaven.com/ Response headers access-control-allow-origin * content-length 0 date Mon, 06 Jan 2025 14:37:15 GMT content-type text/plain server awselb/2.0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	136ms 136ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A16%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A15%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:16 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:16 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	j Show response rp4.liadm.com/ Redirect Chain https://rp.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-prelimin... https://rp4.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-prelimi...	13 B 370 B	382ms 122ms	XHR application/json	34.231.172.117 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://rp4.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=fe0f6f6b-6932-461e-ab7d-045131619c01&i6=MjAwMTphYzg6MjQ6NDQ6OjE4 Protocol H2 Server 34.231.172.117 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-231-172-117.compute-1.amazonaws.com Software / Resource Hash efabba3678b85fcab831b778ea2ddaad1e2a1e952584d3566bc39b7ccb3429d9 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-pixel-event-id 62cf1fe0-829f-4a48-9677-48c8513d2bf1 access-control-max-age 86400 access-control-expose-headers * access-control-allow-credentials true access-control-allow-methods GET access-control-allow-origin null content-length 13 date Mon, 06 Jan 2025 14:37:17 GMT content-type application/json Redirect headers access-control-max-age 86400 access-control-expose-headers * location https://rp4.liadm.com/j?dtstmp=1736174236221&did=did-008f&se=e30&duid=5b1202958f69--01jgy0rvjmbxz0cfym172a9nxs&tv=v3.6.0&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&wpn=lc-bundle&wpv=v3.6.0&cd=.cyberhaven.com&c=PHRpdGxlPjwvdGl0bGU-PG1ldGEgY29udGVudD0iIiBuYW1lPSJkZXNjcmlwdGlvbiI-PGgxIGNsYXNzPSJoZWFkaW5nLXN0eWxlLWgyIG1heC13aWR0aC14eGxhcmdlIGNvbG9yLWRhcmstcHJpbWFyeSI-Q3liZXJoYXZlbuKAmXMgcHJlbGltaW5hcnkgYW5hbHlzaXMgb2YgdGhlIHJlY2VudCBtYWxpY2lvdXMgQ2hyb21lIGV4dGVuc2lvbjwvaDE-&pv=fe0f6f6b-6932-461e-ab7d-045131619c01&i6=MjAwMTphYzg6MjQ6NDQ6OjE4 access-control-allow-credentials true access-control-allow-methods GET access-control-allow-origin https://www.cyberhaven.com content-length 0 date Mon, 06 Jan 2025 14:37:16 GMT
POST H2	200	/ Show response us.i.posthog.com/s/	15 B 248 B	697ms 685ms	Fetch application/json	44.219.183.100 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/s/?ip=1&_=1736174236225&ver=1.203.3&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 44.219.183.100 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-44-219-183-100.compute-1.amazonaws.com Software envoy / Resource Hash 0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers x-envoy-upstream-service-time 315 access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 15 date Mon, 06 Jan 2025 14:37:16 GMT content-type application/json vary origin, access-control-request-method, access-control-request-headers server envoy
POST H2	204	/ metrics.hotjar.io/	0 80 B	243ms 66ms	Ping text/plain	54.246.129.206 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://metrics.hotjar.io/?v=6&site_id=3169094 Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.246.129.206 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-246-129-206.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Referer https://www.cyberhaven.com/ Response headers date Mon, 06 Jan 2025 14:37:16 GMT access-control-max-age 86400 access-control-allow-origin *
POST H3	200	sessions.updateHubspotUserToken Show response opps-api.getwarmly.com/api/sessions/trpc/	33 B 49 B	165ms 164ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-X-lC0KIY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash ded6935dc09c7888de1b41c8ab7cebf82223c044f9eced4628c8236962fec3c5 Request headers x-warmly-session-id 1986ccad-d5b9-420e-a58c-216142d777d4 x-warmly-user-identifier 78efbaba-4990-4e4c-adfe-5bc0bfb6f05c x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 1327e9b0-0b76-42ac-9539-7194a066125d X-Warmly-Target session-server x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33 date Mon, 06 Jan 2025 14:37:16 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.updateHubspotUserToken opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	157ms 157ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 06 Jan 2025 14:37:16 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	131ms 130ms	Image image/gif	95.101.79.57 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=6b5491c5-af49-4997-8f43-d8e6e9019b55&session=7d79ecf1-cb3e-4274-8c2e-bc400e400baf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A17%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2006%20Jan%202025%2014%3A37%3A16%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=edb8eb3b-03bb-4295-8cb8-b1158651f5b4&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A18&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.79.57 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-79-57.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 06 Jan 2025 14:37:17 GMT accept-ranges bytes content-length 43 date Mon, 06 Jan 2025 14:37:17 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/9d92160d-b74f-4dd3-afec-f938b7a708a3

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/217e2b5b-597e-42a2-b276-a2f1d22d575f

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/33400d88-fb89-443a-b11d-85909e2583c0

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/446d3beb-2531-4c00-b3ca-eff72484c8e4

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/8ae7b8e9-b747-48bf-b2b6-98939a054964

Domain

a.usbrowserspeed.com

URL

https://a.usbrowserspeed.com/cs?pid=4dd5c5fae59ce3249cf6f13469fbc883b27c8135ce5092e6a3b38092dc07d387&puid=1986ccad-d5b9-420e-a58c-216142d777d4&r=%0A%20%20%20%20https%3A%2F%2Fapi.immagnify.com%2Fv1%2Fintegrations%2Ffxf%2Fwebhook%2FkhlFEhkHvc%3Fhem%3D%24%7BHEM_SHA256_LOWERCASE%7D%26up_id%3D%24%7BUP_ID%7D%26puid%3D1986ccad-d5b9-420e-a58c-216142d777d4%26ip%3D%24%7BIP%7D%0A%20%20