www.rapid7.com Open in urlscan Pro
52.222.186.59 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=
Effective URL:
https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo...
Submission: On September 15 via api (September 15th 2021, 5:47:11 pm UTC) from US — Scanned from DE

Summary HTTP 172 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 43 IPs in 5 countries across 33 domains to perform 172 HTTP transactions. The main IP is 52.222.186.59, located in United States and belongs to AMAZON-02, US. The main domain is www.rapid7.com.
TLS certificate: Issued by Amazon on April 30th 2021. Valid for: a year.

This is the only time www.rapid7.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.74.206 104.17.74.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
22	52.222.186.59 52.222.186.59	16509 (AMAZON-02) (AMAZON-02)
2	184.30.24.149 184.30.24.149	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.217.169.74 172.217.169.74	15169 (GOOGLE) (GOOGLE)
1	104.17.73.206 104.17.73.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.16.93.80 104.16.93.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	54.230.206.61 54.230.206.61	16509 (AMAZON-02) (AMAZON-02)
1	89.187.169.47 89.187.169.47	60068 (CDN77 ^_^) (CDN77 ^_^)
3	172.217.169.8 172.217.169.8	15169 (GOOGLE) (GOOGLE)
3	216.58.213.3 216.58.213.3	15169 (GOOGLE) (GOOGLE)
1	151.101.112.134 151.101.112.134	54113 (FASTLY) (FASTLY)
1	23.67.128.30 23.67.128.30	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.113.229 151.101.113.229	54113 (FASTLY) (FASTLY)
6	142.250.187.206 142.250.187.206	15169 (GOOGLE) (GOOGLE)
1	216.58.212.194 216.58.212.194	15169 (GOOGLE) (GOOGLE)
1	184.30.21.40 184.30.21.40	16625 (AKAMAI-AS) (AKAMAI-AS)
2	23.45.104.85 23.45.104.85	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	93.184.220.66 93.184.220.66	15133 (EDGECAST) (EDGECAST)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
4	185.60.218.24 185.60.218.24	32934 (FACEBOOK) (FACEBOOK)
3	54.230.206.112 54.230.206.112	16509 (AMAZON-02) (AMAZON-02)
1	52.222.186.16 52.222.186.16	16509 (AMAZON-02) (AMAZON-02)
24	52.222.186.63 52.222.186.63	16509 (AMAZON-02) (AMAZON-02)
8	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	151.139.237.219 151.139.237.219	33438 (HIGHWINDS2) (HIGHWINDS2)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
2	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	52.222.190.34 52.222.190.34	16509 (AMAZON-02) (AMAZON-02)
1 2	108.174.11.69 108.174.11.69	14413 (LINKEDIN) (LINKEDIN)
1 1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
14	52.222.179.113 52.222.179.113	16509 (AMAZON-02) (AMAZON-02)
4	151.101.0.134 151.101.0.134	54113 (FASTLY) (FASTLY)
2	216.58.213.2 216.58.213.2	15169 (GOOGLE) (GOOGLE)
2 2	76.223.111.131 76.223.111.131	16509 (AMAZON-02) (AMAZON-02)
1	74.125.206.156 74.125.206.156	15169 (GOOGLE) (GOOGLE)
3	142.250.200.36 142.250.200.36	15169 (GOOGLE) (GOOGLE)
1	35.174.150.252 35.174.150.252	14618 (AMAZON-AES) (AMAZON-AES)
2	35.171.170.135 35.171.170.135	14618 (AMAZON-AES) (AMAZON-AES)
2	34.232.196.113 34.232.196.113	14618 (AMAZON-AES) (AMAZON-AES)
3	185.60.218.35 185.60.218.35	32934 (FACEBOOK) (FACEBOOK)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
2	142.250.180.14 142.250.180.14	15169 (GOOGLE) (GOOGLE)
2	142.250.200.13 142.250.200.13	() ()
1	172.217.169.35 172.217.169.35	() ()
1 2	18.194.85.80 18.194.85.80	() ()
2 2	37.252.173.27 37.252.173.27	() ()
172	43

1 104.17.74.206 (None, )

ASN13335 (CLOUDFLARENET, US)

info.rapid7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 52.222.186.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-186-59.ham50.r.cloudfront.net

www.rapid7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.24.149 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-24-149.deploy.static.akamaitechnologies.com

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.169.74 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s09-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)

information.rapid7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.93.80 (None, )

ASN13335 (CLOUDFLARENET, US)

app-sj20.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 54.230.206.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-206-61.ham50.r.cloudfront.net

blog.rapid7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 89.187.169.47 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-89-187-169-47.cdn77.com

cdn.rawgit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.169.8 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s26-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.213.3 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s25-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

rapid7.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.67.128.30 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-67-128-30.deploy.static.akamaitechnologies.com

a13222550.cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.229 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.187.206 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s33-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.212.194 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ams16s21-in-f194.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.21.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-21-40.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.45.104.85 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-104-85.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 93.184.220.66 (London, United Kingdom) 1 redirects

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.60.218.24 (Bucharest, Romania)

ASN32934 (FACEBOOK, US)
PTR: xx-fbcdn-shv-01-otp1.fbcdn.net

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.230.206.112 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-230-206-112.ham50.r.cloudfront.net

vidassets.terminus.services	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.186.16 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-186-16.ham50.r.cloudfront.net

px.airpr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 52.222.186.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-186-63.ham50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.237.219 (United States)

ASN33438 (HIGHWINDS2, US)

cdn.getsmartcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.190.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-190-34.ham50.r.cloudfront.net

d2oh4tlt9mrke9.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.174.11.69 (United States) 1 redirects

ASN14413 (LINKEDIN, US)
PTR: 108-174-11-69.fwd.linkedin.com

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 52.222.179.113 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-179-113.ham50.r.cloudfront.net

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.0.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.213.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: ber01s14-in-f2.1e100.net

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 76.223.111.131 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a97adde81b00f2ca4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.206.156 (United States)

ASN15169 (GOOGLE, US)
PTR: wk-in-f156.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.200.36 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr48s30-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.174.150.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-174-150-252.compute-1.amazonaws.com

s.getsmartcontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.171.170.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-171-170-135.compute-1.amazonaws.com

ws.sessioncam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.232.196.113 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-196-113.compute-1.amazonaws.com

logx.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.60.218.35 (Bucharest, Romania)

ASN32934 (FACEBOOK, US)
PTR: edge-star-mini-shv-01-otp1.facebook.com

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

411-nak-970.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.180.14 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr25s32-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.200.13 (None, )

ASN- ()

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.169.35 (None, )

ASN- ()

ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.85.80 (None, ) 1 redirects

ASN- ()

dpx.airpr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.252.173.27 (None, ) 2 redirects

ASN- ()

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
30	rapid7.com info.rapid7.com www.rapid7.com information.rapid7.com blog.rapid7.com	773 KB
24	driftt.com js.driftt.com	192 KB
14	disquscdn.com c.disquscdn.com	521 KB
7	google.com www.google.com apis.google.com accounts.google.com	42 KB
6	bizible.com cdn.bizible.com	33 KB
6	google-analytics.com www.google-analytics.com	20 KB
6	marketo.com app-sj20.marketo.com	143 KB
5	disqus.com rapid7.disqus.com disqus.com	57 KB
5	optimizely.com cdn.optimizely.com a13222550.cdn.optimizely.com logx.optimizely.com	196 KB
4	facebook.net connect.facebook.net	180 KB
4	gstatic.com fonts.gstatic.com ssl.gstatic.com	102 KB
3	facebook.com www.facebook.com	330 B
3	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	4 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	airpr.com 1 redirects px.airpr.com dpx.airpr.com	3 KB
3	terminus.services vidassets.terminus.services	4 KB
3	twitter.com 1 redirects platform.twitter.com analytics.twitter.com	1 KB
3	googletagmanager.com www.googletagmanager.com	144 KB
2	adnxs.com 2 redirects secure.adnxs.com	2 KB
2	sessioncam.com ws.sessioncam.com	2 KB
2	bizibly.com cdn.bizibly.com	288 B
2	adsrvr.org 2 redirects match.adsrvr.org	1012 B
2	t.co t.co	573 B
2	getsmartcontent.com cdn.getsmartcontent.com s.getsmartcontent.com	40 KB
2	marketo.net munchkin.marketo.net	6 KB
1	mktoresp.com 411-nak-970.mktoresp.com	311 B
1	cloudfront.net d2oh4tlt9mrke9.cloudfront.net	60 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	licdn.com snap.licdn.com	2 KB
1	googleadservices.com www.googleadservices.com	14 KB
1	jsdelivr.net cdn.jsdelivr.net	774 B
1	rawgit.com cdn.rawgit.com	10 KB
1	googleapis.com fonts.googleapis.com	31 KB
172	33

	Domain	Requested by
24	js.driftt.com	info.rapid7.com js.driftt.com
22	www.rapid7.com	info.rapid7.com www.rapid7.com cdn.bizible.com
14	c.disquscdn.com	rapid7.disqus.com disqus.com c.disquscdn.com www.rapid7.com
6	cdn.bizible.com	www.googletagmanager.com www.rapid7.com cdn.bizible.com d2oh4tlt9mrke9.cloudfront.net
6	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.rapid7.com
6	blog.rapid7.com	www.rapid7.com
6	app-sj20.marketo.com	www.rapid7.com information.rapid7.com app-sj20.marketo.com
4	disqus.com	rapid7.disqus.com c.disquscdn.com
4	connect.facebook.net	info.rapid7.com connect.facebook.net c.disquscdn.com
3	www.facebook.com	www.rapid7.com c.disquscdn.com
3	www.google.com	www.rapid7.com
3	vidassets.terminus.services	www.googletagmanager.com www.rapid7.com
3	fonts.gstatic.com	fonts.googleapis.com
3	www.googletagmanager.com	www.rapid7.com www.googletagmanager.com
2	secure.adnxs.com	2 redirects
2	dpx.airpr.com	1 redirects
2	accounts.google.com	apis.google.com ssl.gstatic.com
2	apis.google.com	c.disquscdn.com apis.google.com
2	logx.optimizely.com	cdn.bizible.com
2	ws.sessioncam.com	cdn.bizible.com
2	cdn.bizibly.com	www.rapid7.com d2oh4tlt9mrke9.cloudfront.net
2	match.adsrvr.org	2 redirects
2	googleads.g.doubleclick.net	www.googleadservices.com
2	px.ads.linkedin.com	1 redirects www.rapid7.com
2	t.co	www.rapid7.com
2	analytics.twitter.com	www.rapid7.com platform.twitter.com
2	munchkin.marketo.net	info.rapid7.com munchkin.marketo.net
2	cdn.optimizely.com	www.rapid7.com cdn.optimizely.com
1	ssl.gstatic.com	accounts.google.com
1	411-nak-970.mktoresp.com	munchkin.marketo.net
1	s.getsmartcontent.com	cdn.getsmartcontent.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	www.linkedin.com	1 redirects
1	d2oh4tlt9mrke9.cloudfront.net	info.rapid7.com
1	cdn.getsmartcontent.com	www.googletagmanager.com
1	px.airpr.com	info.rapid7.com
1	static.ads-twitter.com	www.rapid7.com
1	platform.twitter.com	1 redirects
1	snap.licdn.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	cdn.jsdelivr.net	cdn.rawgit.com
1	a13222550.cdn.optimizely.com	cdn.optimizely.com
1	rapid7.disqus.com	www.rapid7.com
1	cdn.rawgit.com	www.rapid7.com
1	information.rapid7.com	www.rapid7.com
1	fonts.googleapis.com	www.rapid7.com
1	info.rapid7.com
172	47

This site contains links to these domains. Also see Links.

Domain
docs.rapid7.com
extensions.rapid7.com
insight.rapid7.com
www.linkedin.com
twitter.com
www.facebook.com
confluence.atlassian.com
attackerkb.com
us-cert.cisa.gov
investors.rapid7.com
blog.rapid7.com
support.rapid7.com
www.instagram.com

Subject Issuer	Validity	Valid
info.rapid7.com Cloudflare Inc ECC CA-3	`2021-06-06` - `2022-06-05`	a year	crt.sh
rapid7.com Amazon	`2021-04-30` - `2022-05-29`	a year	crt.sh
cdn.optimizely.com DigiCert SHA2 Secure Server CA	`2021-02-17` - `2022-02-21`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-08-23` - `2021-11-15`	3 months	crt.sh
information.rapid7.com Cloudflare Inc ECC CA-3	`2021-06-21` - `2022-06-20`	a year	crt.sh
app-sj20.marketo.com Cloudflare Inc ECC CA-3	`2021-06-02` - `2022-06-01`	a year	crt.sh
blog.rapid7.com Amazon	`2021-05-21` - `2022-06-19`	a year	crt.sh
cdn.rawgit.com R3	`2021-09-09` - `2021-12-08`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
*.cdn.optimizely.com DigiCert TLS RSA SHA256 2020 CA1	`2021-06-02` - `2022-06-07`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-30` - `2022-06-01`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-04-30` - `2022-05-11`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.terminus.services Amazon	`2020-12-16` - `2022-01-14`	a year	crt.sh
*.airpr.com Amazon	`2021-01-10` - `2022-02-07`	a year	crt.sh
drift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh
io.bizible.com DigiCert TLS RSA SHA256 2020 CA1	`2021-06-30` - `2022-07-05`	a year	crt.sh
*.getsmartcontent.com Go Daddy Secure Certificate Authority - G2	`2020-10-20` - `2021-11-21`	a year	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2021-04-15` - `2021-10-15`	6 months	crt.sh
a.disquscdn.com Amazon	`2020-11-30` - `2021-12-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh
bound360.com Amazon	`2021-06-28` - `2022-07-27`	a year	crt.sh
ws.sessioncam.com Amazon	`2021-03-18` - `2022-04-16`	a year	crt.sh
logx.optimizely.com Amazon	`2021-08-23` - `2022-09-21`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
*.apis.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-23` - `2021-11-15`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-30` - `2021-11-22`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Frame ID: 20025F339A20954597A121B05D0DCBCF
Requests: 98 HTTP requests in this frame

Frame: https://a13222550.cdn.optimizely.com/client_storage/a13222550.html
Frame ID: 1C99BF9B111E2BC2DC600029A0DE1606
Requests: 1 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
Frame ID: 6712F2B72C7F851C277BE2DB1192A45D
Requests: 19 HTTP requests in this frame

Frame: https://app-sj20.marketo.com/index.php/form/XDFrame
Frame ID: D0647E38951552D47BE146720CBBB5C2
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 0BB09CAA6967A11C78CED6E3D1398352
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: F2A5E12ABD9F2780EA7AF15F5D1DD958
Requests: 3 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
Frame ID: 0DA262D0325F9E4B850C2740AE738DFA
Requests: 24 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521
Frame ID: 0F5413054F0CF519221BA69BC1AC3F56
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Active Exploitation of Confluence Server CVE-2021-26084 | Rapid7 Blog

Page URL History Show full URLs

https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFi... Page URL
https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Marketo Forms (Widgets) Expand

Overall confidence: 100%
Detected patterns

marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Optimizely (Analytics) Expand

Overall confidence: 100%
Detected patterns

optimizely\.com.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

172
Requests

85 %
HTTPS

0 %
IPv6

33
Domains

47
Subdomains

43
IPs

5
Countries

2583 kB
Transfer

7544 kB
Size

48
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://docs.rapid7.com/
Title: Product DocumentationEXPLORE PRODUCT GUIDES

Search URL Search Domain Scan URL

URL: https://docs.rapid7.com/release-notes/
Title: Release NotesDISCOVER THE LATEST PRODUCT UPDATES

Search URL Search Domain Scan URL

URL: https://extensions.rapid7.com/
Title: Extensions LibraryPLUGINS, INTEGRATIONS & DEVELOPER COMMUNITY

Search URL Search Domain Scan URL

URL: https://insight.rapid7.com/saml/SSO
Title: Sign In

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/&title=Active+Exploitation+of+Confluence+Server+%26+Confluence+Data+Center%3a+CVE-2021-26084&summary=On+August+25%2c+2021%2c+Atlassian+published+details+on+a+critical+remote+code+execution+vulnerability+in+Confluence+Server+and+Confluence+Data+Center.

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Active+Exploitation+of+Confluence+Server+%26+Confluence+Data+Center%3a+CVE-2021-26084&url=https%3a%2f%2fwww.rapid7.com%2fblog%2fpost%2f2021%2f09%2f02%2factive-exploitation-of-confluence-server-cve-2021-26084%2f

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/

Search URL Search Domain Scan URL

URL: https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
Title: published details

Search URL Search Domain Scan URL

URL: https://attackerkb.com/topics/Eu74wdMbEL/cve-2021-26084/rapid7-analysis?referrer=blog
Title: CVE-2021-26084

Search URL Search Domain Scan URL

URL: https://twitter.com/CNMF_CyberAlert/status/1433787671785185283
Title: "patch immediately"

Search URL Search Domain Scan URL

URL: https://us-cert.cisa.gov/ncas/alerts/aa21-243a
Title: ransomware awareness guide

Search URL Search Domain Scan URL

URL: https://investors.rapid7.com/
Title: Investors

Search URL Search Domain Scan URL

URL: https://blog.rapid7.com/
Title: Blog

Search URL Search Domain Scan URL

URL: https://support.rapid7.com/
Title: Support Login

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/39624

Search URL Search Domain Scan URL

URL: https://twitter.com/Rapid7

Search URL Search Domain Scan URL

URL: https://www.facebook.com/rapid7

Search URL Search Domain Scan URL

URL: https://www.instagram.com/rapid7/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY= Page URL
https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

https://platform.twitter.com/oct.js HTTP 301
https://static.ads-twitter.com/oct.js

Request Chain 58

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D22471%26time%3D1631728029421%26url%3Dhttps%253A%252F%252Fwww.rapid7.com%252Fblog%252Fpost%252F2021%252F09%252F02%252Factive-exploitation-of-confluence-server-cve-2021-26084%252F%253Futm_source%253Dmarketo%2526utm_medium%253Demail%2526utm_campaign%253Dconfluence-q3-21%2526mkt_tok%253DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&liSync=true

Request Chain 72

https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33 HTTP 302
https://vidassets.terminus.services/s.gif?d=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33&t=934c99ca-67f8-41e8-b020-007491042a32

Request Chain 122

https://dpx.airpr.com/px?hostname=www.rapid7.com&profile=530642&ga_account_id=UA-4622520-1&ga_account_type=UA&ga_c=1065388984.1631728029&an=true HTTP 302
https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4061543988 HTTP 307
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D4061543988 HTTP 302
https://dpx.airpr.com/anpx?adnxs_uid=2103207750422641859&airpr_id=4061543988

172 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY= Show response
info.rapid7.com/ 610 B
1 KB 535ms
248ms Document
text/html 104.17.74.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.74.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad86bd1c6c30f9d98ce71fe5d96cfe5ea52e4b5aca3eda1dc6e963be44ac3afe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: info.rapid7.com
:scheme: https
:path: /NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 15 Sep 2021 17:47:06 GMT
content-type: text/html
cache-control: private, no-cache, no-store, max-age=0
x-content-type-options: nosniff
vary: Accept-Encoding
set-cookie: BIGipServersj_mailtracking_http=!87nbX31RzvNEKm67iv4ewrP5TPDRszPdyK/F07lQFMMpSuj6cIxErhmxZd9OARiuVFJAkkcjxwLIX/o=; path=/; Httponly; Secure __cf_bm=MKWkTBxzxpmWo6KMh1Md_D3q0f_lonVCk_S9pl6JwT8-1631728026-0-AXVsHUIcLgBphFr1QTYcajunE2ulBupVZa+mHsM+5oJCO+awy9UsIVgeHnEYNFJaPklVMaTyr2oUl/24xRKrJWw=; path=/; expires=Wed, 15-Sep-21 18:17:06 GMT; domain=.info.rapid7.com; HttpOnly; Secure; SameSite=None
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 68f3ada40ff0f9e6-PRG
content-encoding: gzip

GET
H2 200 Primary Request / Show response
www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/ 83 KB
15 KB 1842ms
1789ms Document
text/html 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA

Requested by

Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

ee61d0d70457124d456851d06fbc7de0204b99c7b930305cd7bc26bfccd25c5d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.rapid7.com
:scheme: https
:path: /blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://info.rapid7.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://info.rapid7.com/

Response headers

content-type: text/html; charset=utf-8
vary: Accept-Encoding
cache-control: private
content-security-policy: frame-ancestors 'self' https://*.rapid7.com
date: Wed, 15 Sep 2021 17:47:05 GMT
set-cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; path=/; secure; HttpOnly; SameSite=lax r7-vc=; path=/; SameSite=lax
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: yXhsDWvnckQ6M7a10W4Dr7N5BEv6uniWZPFh-3CxVNVS6k16RxiTMQ==

GET
H2 200 all.min.css
www.rapid7.com/includes/css/ 905 KB
135 KB 28ms
25ms Stylesheet
text/css 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

daaa4757566b582fa2e3bfb4c49a0996d279a0e8deaa2ff1b15d582cacb357cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/css/all.min.css?cb=1631630037273
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
age: 31
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:36:08 GMT
x-frame-options: SAMEORIGIN
date: Wed, 15 Sep 2021 17:46:34 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
etag: W/"0bcedda75a9d71:0"
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: _Q1ZhBJH5QYxkQlmDAgawiYdj43T_dyG7GcbhNe51EKr9bEMqbsCwg==

GET
H2 200 10801744121.js Show response
cdn.optimizely.com/js/ 960 KB
193 KB 37ms
8ms Script
text/javascript 184.30.24.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/10801744121.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-149.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

2f6f8ef5cbba4c5c44c2612efc7f64e4d8398ecd6096e3a16e144058148837ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: 7djvlYQtVWee7KnEpiTK8IfOloWhBznq
content-encoding: gzip
etag: "1d96ff7c7bea409b58cb1737cff614a9"
x-amz-request-id: SZ1ECA1ZFWCMNVD5
x-amz-server-side-encryption: AES256
x-amz-meta-revision: 69587
x-amz-replication-status: PENDING
access-control-allow-methods: GET, HEAD
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="184.30.24.149";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0
vary: Accept-Encoding
content-length: 196271
x-amz-id-2: Y3Cm/9hnsZ1iA0G0uT/jKrW3XKjSO0ZSTWiX60haFu1AAn9IYqYmg+QWcJJOZzbhrTzH/lWTKkY=
last-modified: Wed, 15 Sep 2021 17:03:26 GMT
server: AmazonS3
date: Wed, 15 Sep 2021 17:47:08 GMT
access-control-max-age: 86400
strict-transport-security: max-age=15768000
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 css
fonts.googleapis.com/ 116 KB
31 KB 89ms
38ms Stylesheet
text/css 172.217.169.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Muli:800,900|Roboto:300,400,700|Noto+Sans+JP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s09-in-f10.1e100.net

Software

ESF /

Resource Hash

cffd0317df77f6cca959bf9cf11db68960d73262907aaaae3a9b8a2e5f565316

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 17:47:08 GMT
server: ESF
date: Wed, 15 Sep 2021 17:47:08 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 15 Sep 2021 17:47:08 GMT

GET
H2 200 jquery.min.js Show response
www.rapid7.com/includes/js/ 83 KB
30 KB 55ms
53ms Script
application/javascript 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/js/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

26896559e0cc85fb441792c86279304693546375f1144040e46cd910362b8e43

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/js/jquery.min.js
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:37:46 GMT
x-frame-options: SAMEORIGIN
date: Wed, 15 Sep 2021 17:46:35 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
etag: W/"059571576a9d71:0"
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: owJoXRSOuJLjtgSqTlEUVibpiuSMtc-zlfUhUFTRDUonGA13FAXycQ==

GET
H2 200 populateCountryState.js Show response
www.rapid7.com/includes/js/ 6 KB
2 KB 57ms
55ms Script
application/javascript 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/js/populateCountryState.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

948ef5fb4409b53579bee0c26ee642ed9fbc77f0e279d5aed6b8cfdff8f3182a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/js/populateCountryState.js
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
x-amz-cf-pop: HAM50-C2
date: Wed, 15 Sep 2021 17:47:08 GMT
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
cache-control: no-cache
vary: Accept-Encoding
x-amz-cf-id: pdr9JbEcg_4a-lj6ZTr_pekLE4KeFCrInGazYC8OtFfHeJpySsyE8Q==
etag: W/"04e85676a9d71:0"

GET
H2 200 forms2.min.js Show response
information.rapid7.com/js/forms2/js/ 205 KB
68 KB 189ms
36ms Script
application/x-javascript 104.17.73.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://information.rapid7.com/js/forms2/js/forms2.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 10 Aug 2021 17:41:08 GMT
server: cloudflare
age: 5532
etag: "740df3-33210-5c93801bbf500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 68f3adb32ecdf9ce-PRG
expires: Wed, 15 Sep 2021 21:47:08 GMT

GET
H2 200 forms2.min.js Show response
app-sj20.marketo.com/js/forms2/js/ 205 KB
68 KB 619ms
463ms Script
application/x-javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/js/forms2/js/forms2.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Tue, 10 Aug 2021 17:41:08 GMT
server: cloudflare
etag: "740df3-33210-5c93801bbf500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 68f3adb33bbc410e-PRG
expires: Wed, 15 Sep 2021 21:47:09 GMT

GET
H2 200 Rapid7_logo.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 1 KB
1 KB 637ms
637ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

c65ffa9b8e350747e5dec76cbf16729482008fa1b57be07c53d3c509bebcfadd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /Areas/Docs/includes/img/r7-nav/Rapid7_logo.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:36:07 GMT
x-amz-cf-pop: HAM50-C2
etag: W/"802555da75a9d71:0"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/svg+xml
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
date: Wed, 15 Sep 2021 17:47:06 GMT
vary: Accept-Encoding
x-amz-cf-id: wDeYFD2XN0UQl-lvECUy7chUUpOhjdzl3hKICr6DqZjS9ry1ZIrJaQ==
x-xss-protection: 1; mode=block

GET
H2 200 icon-lock.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 1 KB
1008 B 632ms
631ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/icon-lock.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

9904ff6810e17c1ffc108bf92dbee7f8a6318d0c8c58c1d70555d0a3945fb9da

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /Areas/Docs/includes/img/r7-nav/icon-lock.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:39:34 GMT
x-amz-cf-pop: HAM50-C2
etag: W/"0d7b65576a9d71:0"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/svg+xml
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
date: Wed, 15 Sep 2021 17:47:06 GMT
vary: Accept-Encoding
x-amz-cf-id: QhSETCTdTzg5Eg8KIreMe1fp3EMvx5GNhu3V4Es-or26tLShqQHQNA==
x-xss-protection: 1; mode=block

GET
H2 200 Rapid7_logo-short.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 497 B
944 B 635ms
634ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/Rapid7_logo-short.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

ac2a270e60c15fdaaf9957f52bab00aaefd32ac7782a62b141c66c2ce3f6369c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /Areas/Docs/includes/img/r7-nav/Rapid7_logo-short.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:41:15 GMT
x-amz-cf-pop: HAM50-C2
etag: "8037ea9176a9d71:0"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/svg+xml
cache-control: no-cache
date: Wed, 15 Sep 2021 17:47:06 GMT
accept-ranges: bytes
content-length: 497
x-xss-protection: 1; mode=block
x-amz-cf-id: WKyXKTrDZ-HyzaacZwtT58BfoeMXZ07PhwhWzE786V73nxr6LHSbCg==

GET
H/1.1 200
OK confluence-server.jpg
blog.rapid7.com/content/images/2021/09/ 103 KB
103 KB 461ms
391ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2021/09/confluence-server.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

6e7528c07c5c49c54d62806dc1d5413526a338a085df22b73cda2362013008b3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 3f7bd14926d2704d3a00300bdc9dae98.cloudfront.net (CloudFront)
ETag: W/"19a7b-17ba7263e50"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 105083
Last-Modified: Thu, 02 Sep 2021 15:35:06 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: tws-hGzJgqhF3BwJMATjy0yWRYSzEPkzr38RcM1DHuZPCxAaoRfynA==

GET
H2 200 placeholder-transparent.png
www.rapid7.com/includes/img/ 162 B
593 B 52ms
51ms Image
image/png 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/placeholder-transparent.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

e3f37423bbf836a90c48b4bb4c13fcc828e2664540cb97fa8ad135d6e26e50eb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/placeholder-transparent.png
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
x-amz-cf-pop: HAM50-C2
date: Wed, 15 Sep 2021 17:47:09 GMT
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: image/png
x-xss-protection: 1; mode=block
cache-control: no-cache
accept-ranges: bytes
content-length: 162
etag: "04e85676a9d71:0"
x-amz-cf-id: v1KaSiYx84KfqYwK2tVdJANjuLCJ07K1dntExZJSSFpTVF8Pr00fmw==

GET
H2 200 all.min.js Show response
www.rapid7.com/includes/js/ 335 KB
84 KB 28ms
28ms Script
application/javascript 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/js/all.min.js?cb=1631630037273

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

6ea2a98492ef856efe0731923957339e2920c0430dae00f289eb98c8a8b54ec3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/js/all.min.js?cb=1631630037273
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
x-frame-options: SAMEORIGIN
date: Wed, 15 Sep 2021 17:46:35 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
etag: W/"04e85676a9d71:0"
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: doi5F4yX6hpYS8pVlF_kc05hwYSBSH7N0mARuxxxBZ9geUPohVhHEA==

GET
H2 200 run_prettify.js Show response
cdn.rawgit.com/google/code-prettify/master/loader/ 18 KB
10 KB 44ms
8ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js?skin=desert

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),

Reverse DNS

unn-89-187-169-47.cdn77.com

Software

BunnyCDN-DE1-756 /

Resource Hash

7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:08 GMT
content-encoding: br
x-content-type-options: nosniff
cdn-edgestorageid: 756
access-control-allow-origin: *
cdn-cachedat: 09/10/2021 05:52:54
cdn-pullzone: 201235
server: BunnyCDN-DE1-756
rawgit-cache-status: MISS
link: <https://rawgit.com/>; rel="sunset"; title="RawGit will soon shut down. Please stop using it."
cdn-proxyver: 1.0
cdn-requestpullcode: 200
x-robots-tag: none
vary: Accept-Encoding
sunset: Tue, 01 Oct 2019 00:00:00 GMT
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=2592000
cdn-requestid: 50b10a8454117eb5974f7162a9d1950a
content-type: application/javascript; charset=utf-8
cdn-requestcountrycode: US
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 block.blog-tags-list.min.js Show response
www.rapid7.com/includes/js/bundles/ 841 B
1 KB 32ms
31ms Script
application/javascript 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/js/bundles/block.blog-tags-list.min.js?cb=1631630037273

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

db320734b1ceba11653b78882616887e436b37fb99bebbd9ec6d388642550a6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/js/bundles/block.blog-tags-list.min.js?cb=1631630037273
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 21
x-cache: Hit from cloudfront
date: Wed, 15 Sep 2021 17:46:45 GMT
content-length: 841
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
etag: "04e85676a9d71:0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: no-cache
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: miPjETgS8Md0_bAXILdrGyKXwep16iq54tcmrt51sd20gD-6ZMfzEw==

GET
H2 200 c988151143acb47893d98e3bff41fb02b952e55b9be4aed9ecc79315964324d8.js Show response
cdn.optimizely.com/public/13222550/data/actions/ 432 B
1 KB 7ms
7ms Script
text/javascript 184.30.24.149
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/public/13222550/data/actions/c988151143acb47893d98e3bff41fb02b952e55b9be4aed9ecc79315964324d8.js

Requested by

Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/10801744121.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.24.149 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-24-149.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

c988151143acb47893d98e3bff41fb02b952e55b9be4aed9ecc79315964324d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: K6oCo_e_428NylJcjwgueeYo.LW_4Znd
content-encoding: gzip
etag: "417b9c3ed849156f5d8074f4002dee0a"
x-amz-request-id: 7J79HWJ0NAY69RMF
x-amz-server-side-encryption: AES256
x-amz-replication-status: COMPLETED
access-control-allow-methods: GET, HEAD
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="184.30.24.149";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0
vary: Accept-Encoding
content-length: 325
x-amz-id-2: w8NdOIQ5eqGhmRGdVC4rZ6wB5uSFzH3GScxpTRY73AkEYiJ3RsW0QOshD3J46ZUvN9AGCv50FSs=
last-modified: Tue, 24 Aug 2021 01:13:17 GMT
server: AmazonS3
date: Wed, 15 Sep 2021 17:47:09 GMT
access-control-max-age: 86400
strict-transport-security: max-age=15768000
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: public, max-age=315360000, immutable
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 257 KB
69 KB 92ms
42ms Script
application/javascript 172.217.169.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

951ad1312a6cf6133f66cf429454c360b0fcbd606f12b3b261128c669c6e61eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70050
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Sep 2021 17:47:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 69ms
19ms Font
font/woff2 216.58.213.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:800,900|Roboto:300,400,700|Noto+Sans+JP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.3 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s25-in-f3.1e100.net

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.rapid7.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 10 Sep 2021 07:49:43 GMT
x-content-type-options: nosniff
age: 467845
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:35 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Sep 2022 07:49:43 GMT

GET
H2 200 arrow-dropdown.svg
www.rapid7.com/Areas/Docs/includes/img/r7-nav/ 459 B
906 B 630ms
629ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/Areas/Docs/includes/img/r7-nav/arrow-dropdown.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

a8aa8c94d42d57cd377de305aed2169249f6f6bd2fd31b5f1d2671cc1502a1d1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /Areas/Docs/includes/img/r7-nav/arrow-dropdown.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:36:07 GMT
x-amz-cf-pop: HAM50-C2
etag: "802555da75a9d71:0"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/svg+xml
cache-control: no-cache
date: Wed, 15 Sep 2021 17:47:06 GMT
accept-ranges: bytes
content-length: 459
x-xss-protection: 1; mode=block
x-amz-cf-id: v7kTaXhg47eHZLqpV5CmKIAjgTUvzBmNgYrdJyTTPimA2sUBHrwQjg==

GET
H2 200 linkedin-mini.png
www.rapid7.com/includes/img/blog/ 817 B
1 KB 30ms
30ms Image
image/png 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/blog/linkedin-mini.png

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

44fc485dc1ebae37e5b965b0295dd07e645a2a4065a68b1c2416d0911ac92007

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/blog/linkedin-mini.png
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 21
x-cache: Hit from cloudfront
content-length: 817
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:37:46 GMT
date: Wed, 15 Sep 2021 17:46:46 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache
etag: "059571576a9d71:0"
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: Zk8X8AMpudlYlix6U7jDY2oIOQRS5-UMWfV_o-dWL0iZssw-U2Y6GQ==

GET
H2 200 twitter-mini.png
www.rapid7.com/includes/img/blog/ 839 B
1 KB 24ms
24ms Image
image/png 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/blog/twitter-mini.png

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

3a50103004f1b8789103e6f8ba96dd51f2c071a2b7a71dcc1f33f9c8de33382f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/blog/twitter-mini.png
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 21
x-cache: Hit from cloudfront
date: Wed, 15 Sep 2021 17:46:45 GMT
content-length: 839
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
etag: "04e85676a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: pQ_YB3qZvadAgWMer6QNAAbSL-JQUq_wK1hAb6UNePGnNFH5H9jFKA==

GET
H2 200 facebook-mini.png
www.rapid7.com/includes/img/blog/ 773 B
1 KB 25ms
25ms Image
image/png 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/blog/facebook-mini.png

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

652667975f4e5bc9b68363e77211b87c5739566baed70c21fe835d7969995478

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/blog/facebook-mini.png
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 21
x-cache: Hit from cloudfront
content-length: 773
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:37:46 GMT
date: Wed, 15 Sep 2021 17:46:46 GMT
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache
etag: "059571576a9d71:0"
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: sEHQGc1xnDqNbJHtttPmFD4_2C7V_ucyIKR9fk-NKXQtbv4OvkvZDA==

GET
H/1.1 200
OK caitlin-condon.jpg
blog.rapid7.com/content/images/2017/08/ 54 KB
54 KB 363ms
298ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2017/08/caitlin-condon.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

7a1fb34bc02c96391342ed535200c029f5a03f2a9a2ca99d44cb32994f26fcf1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 7f3d82c6ba482f74d3d5c3921ce57cbe.cloudfront.net (CloudFront)
ETag: W/"d62b-16321359208"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 54827
Last-Modified: Wed, 02 May 2018 14:15:49 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: j-vv2z65gF_-zC8c8rwhZIezVCe-xMcQGc9Q-ZU775DZa6Vst232Yw==

GET
H2 200 7Auwp_0qiz-afTLGLQ.woff2
fonts.gstatic.com/s/muli/v22/ 30 KB
31 KB 27ms
26ms Font
font/woff2 216.58.213.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/muli/v22/7Auwp_0qiz-afTLGLQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:800,900|Roboto:300,400,700|Noto+Sans+JP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.3 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s25-in-f3.1e100.net

Software

sffe /

Resource Hash

8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.rapid7.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 20:56:33 GMT
x-content-type-options: nosniff
age: 247836
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31120
x-xss-protection: 0
last-modified: Wed, 15 Jul 2020 20:50:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 Sep 2022 20:56:33 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v27/ 15 KB
16 KB 20ms
20ms Font
font/woff2 216.58.213.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v27/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Muli:800,900|Roboto:300,400,700|Noto+Sans+JP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.3 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s25-in-f3.1e100.net

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.rapid7.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 06:00:56 GMT
x-content-type-options: nosniff
age: 215173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Mon, 05 Apr 2021 21:10:46 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 06:00:56 GMT

GET
H2 200 rapid7.woff2
www.rapid7.com/Areas/Docs/includes/plugins/rapid7-icon-font/fonts/ 105 KB
106 KB 787ms
786ms Font
application/font-woff 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/Areas/Docs/includes/plugins/rapid7-icon-font/fonts/rapid7.woff2?6dd0dd42f9106a91d9bb3963482a2723

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

f6a7ad54334944eee92788a72ddf72f0e4f6f8d32b6eb5f9442d6103eddf0a27

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
origin: https://www.rapid7.com
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
sec-fetch-dest: font
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
:path: /Areas/Docs/includes/plugins/rapid7-icon-font/fonts/rapid7.woff2?6dd0dd42f9106a91d9bb3963482a2723
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
Origin: https://www.rapid7.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:37:44 GMT
x-amz-cf-pop: HAM50-C2
etag: "02c261476a9d71:0"
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: application/font-woff
cache-control: no-cache
date: Wed, 15 Sep 2021 17:47:07 GMT
accept-ranges: bytes
content-length: 107824
x-xss-protection: 1; mode=block
x-amz-cf-id: xmXwN3pQLt0VaeuEVZHr3RIToqhY1TIZtDh0oetiLN6lVnRAogPenQ==

GET
H/1.1 200
OK embed.js Show response
rapid7.disqus.com/ 74 KB
25 KB 227ms
164ms Script
application/javascript 151.101.112.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://rapid7.disqus.com/embed.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

5533ce540540315ff7caca642d2c348d516821c569688aabe0c4b1ce8ce81d50

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Encoding: gzip
Server: openresty
Age: 0
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24675

GET
H2 200 a13222550.html Show response
a13222550.cdn.optimizely.com/client_storage/ Frame 1C99 2 KB
1 KB 39ms
9ms Document
text/html 23.67.128.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://a13222550.cdn.optimizely.com/client_storage/a13222550.html

Requested by

Host: cdn.optimizely.com
URL: https://cdn.optimizely.com/js/10801744121.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.67.128.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-67-128-30.deploy.static.akamaitechnologies.com

Software

AmazonS3 /

Resource Hash

a4d6553c8eda4f55ee8692903953e7cdbb4e4ea5418db70f796b7fe68675d592

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

:method: GET
:authority: a13222550.cdn.optimizely.com
:scheme: https
:path: /client_storage/a13222550.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.rapid7.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

x-amz-id-2: HOkQfjGRB/2lRCaNH4ZhcMrJQ7L3rJOcr1MTLEDY6sXpoL2IXQCqg5Sam3PXyTM3Ww9EfgtP3uU=
x-amz-request-id: AGSSFCXP4MTFEFK1
x-amz-replication-status: PENDING
last-modified: Wed, 15 Sep 2021 17:03:13 GMT
etag: "9e630bc52c2aedf398e810f78dc2b912"
x-amz-server-side-encryption: AES256
x-amz-meta-pci_enabled: False
content-encoding: gzip
x-amz-version-id: eUP6oL9OcYNvyrEMArBVmFfpWH3zGFcL
accept-ranges: bytes
content-type: text/html; charset=utf-8
server: AmazonS3
content-length: 821
vary: Accept-Encoding
cache-control: max-age=120
date: Wed, 15 Sep 2021 17:47:09 GMT
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="23.67.128.30";dur=0,cdnmap;desc="a4728.x.akamaiedge.net";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000

GET
H2 200 getForm Show response
app-sj20.marketo.com/index.php/form/ 6 KB
2 KB 493ms
493ms Script
application/javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/index.php/form/getForm?munchkinId=411-NAK-970&form=4144&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&callback=jQuery1124012098716988842928_1631728028738&_=1631728028739

Requested by

Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

861402dadc9f3e8a4911565d1730f4112956f54c4808c10836b330de177d3e8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
strict-transport-security: max-age=63113904
cf-ray: 68f3adb689f4410e-PRG
cached: false

GET
H/1.1 200
OK Path.jpg
blog.rapid7.com/content/images/2020/07/ 23 KB
24 KB 425ms
394ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2020/07/Path.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

ba0663ff1abcd5e2909fbf118f907f4b1c7d2b36cd0ddc29fb9294af37bab918

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 6da6e07aeb89276b8f6fa46086b0c8c2.cloudfront.net (CloudFront)
ETag: W/"5d91-1737d493a27"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 23953
Last-Modified: Thu, 23 Jul 2020 20:06:57 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: qk1cCzwAGiY---i4xTP69WS6Pw9JvkDlaViL4WjEhlAekjit2YHtYQ==

GET
H/1.1 200
OK Windows.jpg
blog.rapid7.com/content/images/2020/07/ 42 KB
42 KB 522ms
491ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2020/07/Windows.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

ad859925a743729da634c6989f2ad78fd7b27a4096081619937d4fc14c068ec9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 dad44092e95c7e3e18abc391b2ada473.cloudfront.net (CloudFront)
ETag: W/"a674-1734f027ebb"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 42612
Last-Modified: Tue, 14 Jul 2020 20:27:10 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: TeyeH8m1fRdEoO-EZ_jNe89XuiomgeY3gKHPwhn_VvQr3QTd3CSiCQ==

GET
H/1.1 200
OK SAP.jpg
blog.rapid7.com/content/images/2020/07/ 43 KB
43 KB 335ms
299ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2020/07/SAP.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

ce48f94ab14e16d6a7140b1b813874847f20ee5e94a1642b2a77c20ead3e55d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 dea2813e25126efeee924db05c094a40.cloudfront.net (CloudFront)
ETag: W/"aa9f-1734f18c115"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 43679
Last-Modified: Tue, 14 Jul 2020 20:51:29 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: 46bxUCO8XIPEqkK2LFZ5jv2TnjVaQ4-i3U19W5D5vkwP7pnx575uJw==

GET
H/1.1 200
OK Sophos.jpg
blog.rapid7.com/content/images/2020/04/ 42 KB
43 KB 431ms
394ms Image
image/jpeg 54.230.206.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.rapid7.com/content/images/2020/04/Sophos.jpg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.61 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-61.ham50.r.cloudfront.net

Software

nginx/1.14.0 (Ubuntu) / Express

Resource Hash

b74154f3076c165261c6f878c19f1f3de6b261e77f301212a32a5634a71b47cd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://www.rapid7.com
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Security-Policy: frame-ancestors 'self' https://www.rapid7.com
Via: 1.1 c25a7e7126dfc9a3b0a377e34949f435.cloudfront.net (CloudFront)
ETag: W/"a7d1-171bcc6775e"
X-Amz-Cf-Pop: HAM50-C3
X-Powered-By: Express
X-Cache: Miss from cloudfront
Connection: keep-alive
Content-Length: 42961
Last-Modified: Mon, 27 Apr 2020 17:54:15 GMT
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
X-Amz-Cf-Id: 3o2DHOH5ajohSOiXp_PfOivjJuCFEkabB4SdHLTjQp3uMqXTGrJ7Gw==

GET
H2 200 search-gray.png
www.rapid7.com/includes/img/ 533 B
972 B 31ms
30ms Image
image/png 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/search-gray.png

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

4b20b79d8999b2516d971378ec1b7a3bb36108838a22d3c6f2e1d9a47dbe7f08

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/search-gray.png
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
date: Wed, 15 Sep 2021 17:46:36 GMT
content-length: 533
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
etag: "04e85676a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: RhOD9WKvVD_0Yeiq_9D_avwsAL9rZZ2ygAS-wXJkFr6M7ZMhviyoFQ==

GET
H2 200 response.svg
www.rapid7.com/includes/img/ 558 B
993 B 37ms
37ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/response.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

7e4db0925a0f8500f77e268985894d2a77a600786d4c6eb0b8cd84781cb05743

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/response.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:36:09 GMT
x-amz-cf-pop: HAM50-C2
date: Wed, 15 Sep 2021 17:47:09 GMT
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: image/svg+xml
x-xss-protection: 1; mode=block
cache-control: no-cache
accept-ranges: bytes
content-length: 558
etag: "805286db75a9d71:0"
x-amz-cf-id: BbuLgaGaCryf0tZKjmUc_cYoC2S8DAjLyz8naHCiJuVYjb32x1-FAQ==

GET
H2 200 linkedin-light.svg
www.rapid7.com/includes/img/ 514 B
957 B 25ms
25ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/linkedin-light.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

2dd8e940e47cb067ab22aadfe8ccc4f744ddd724bfac7f058915413ae8974909

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/linkedin-light.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
content-length: 514
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:36:09 GMT
date: Wed, 15 Sep 2021 17:46:35 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: no-cache
etag: "805286db75a9d71:0"
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: GMZZrvJ91TtJXb-6mIE7uioBedNuUtprTPpKM34BwSopoX_-XEVgPQ==

GET
H2 200 twitter-light.svg
www.rapid7.com/includes/img/ 662 B
1 KB 26ms
25ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/twitter-light.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

a1e5e79263b670b9f325e1b03db57992cc05c556289f2ea31b9393f265364263

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/twitter-light.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 30
x-cache: Hit from cloudfront
content-length: 662
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:37:46 GMT
date: Wed, 15 Sep 2021 17:46:36 GMT
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: no-cache
etag: "059571576a9d71:0"
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
x-amz-cf-id: UxdkR-XO1MyYb82M8a6wh8jm8lKf5dRjHPsf25giG0Pik5sjDhkNMg==

GET
H2 200 facebook-light.svg
www.rapid7.com/includes/img/ 323 B
759 B 183ms
183ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/facebook-light.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

8f0a8aeb7295594ad2a432cb24687f3bc9eef6837443f73a5aa7aeea7417e268

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/facebook-light.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:41:16 GMT
x-amz-cf-pop: HAM50-C2
date: Wed, 15 Sep 2021 17:47:06 GMT
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
content-type: image/svg+xml
x-xss-protection: 1; mode=block
cache-control: no-cache
accept-ranges: bytes
content-length: 323
etag: "0ce829276a9d71:0"
x-amz-cf-id: _luO3zXju3uGkH_AVURI_HZIQ0_a5y8SQylZbNkqeQkseMM4087suw==

GET
H2 200 instagram-light.svg
www.rapid7.com/includes/img/ 1 KB
994 B 31ms
31ms Image
image/svg+xml 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.rapid7.com/includes/img/instagram-light.svg

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

7d7f64f89927a0c843f4ae2f589c776643aa23ead9ce829bb39c8f3a40d4955d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /includes/img/instagram-light.svg
pragma: no-cache
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: www.rapid7.com
referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/includes/css/all.min.css?cb=1631630037273
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
age: 7
x-cache: Hit from cloudfront
date: Wed, 15 Sep 2021 17:46:59 GMT
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 14:36:09 GMT
x-frame-options: SAMEORIGIN
etag: W/"805286db75a9d71:0"
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
cache-control: no-cache
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: R0Rs-YbttWzTfMyrNpB4GdOP7JRQEFzvLiUOgslFLSXf0xesuWSEFg==

GET
H2 200 countryData.json Show response
www.rapid7.com/includes/js/data/ 28 KB
8 KB 26ms
25ms XHR
application/json 52.222.186.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.rapid7.com/includes/js/data/countryData.json

Requested by

Host: www.rapid7.com
URL: https://www.rapid7.com/includes/js/jquery.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-59.ham50.r.cloudfront.net

Software

Resource Hash

97a641fead8dfd832fc2a2f271e9e498f2ced8e32cc335f5b19a7a51e35d4b2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' https://*.rapid7.com
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-fetch-mode: cors
accept-encoding: gzip, deflate, br
accept-language: de-DE,de;q=0.9
x-requested-with: XMLHttpRequest
sec-fetch-dest: empty
cookie: r7-session=mqvt44sv0nocwgnlngkqxus3; r7-vc=; optimizelyEndUserId=oeu1631728028664r0.00773964388229631; r7gdprAll=notRequired US; r7gdprAnalytics=notRequired US
:path: /includes/js/data/countryData.json
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: application/json, text/javascript, */*; q=0.01
cache-control: no-cache
:authority: www.rapid7.com
referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
:scheme: https
sec-fetch-site: same-origin
:method: GET
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: frame-ancestors 'self' https://*.rapid7.com
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 14:39:36 GMT
x-amz-cf-pop: HAM50-C2
date: Wed, 15 Sep 2021 17:47:09 GMT
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: application/json
via: 1.1 be43ad4ac2015a11cc932d5a96f3e717.cloudfront.net (CloudFront)
x-xss-protection: 1; mode=block
cache-control: no-cache
vary: Accept-Encoding
x-amz-cf-id: mgQ_myTByZ9LBAEFg0cjMVXc8IOcRlNR5z2jG4P-iulQ7TbOPaGMTw==
etag: W/"04e85676a9d71:0"

GET
H2 200 desert.css
cdn.jsdelivr.net/gh/google/code-prettify@master/loader/skins/ 914 B
774 B 30ms
6ms Stylesheet
text/css 151.101.113.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/google/code-prettify@master/loader/skins/desert.css

Requested by

Host: cdn.rawgit.com
URL: https://cdn.rawgit.com/google/code-prettify/master/loader/run_prettify.js?skin=desert

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.113.229 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

5d39ff82989d5d48695a4c9ef8883fbbb9f68ee83b7bc771b68d18281548889a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 6359
x-jsd-version: master
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 385
etag: W/"392-JmOhmNGjmTQ+PuEBJrXkJZkd7dU"
x-served-by: cache-fra19156-FRA, cache-hhn4069-HHN
x-jsd-version-type: branch
date: Wed, 15 Sep 2021 17:47:09 GMT
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 97ms
28ms Script
text/javascript 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 300
date: Wed, 15 Sep 2021 17:42:09 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Wed, 15 Sep 2021 19:42:09 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 36 KB
14 KB 104ms
53ms Script
text/javascript 216.58.212.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.194 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams16s21-in-f194.1e100.net

Software

cafe /

Resource Hash

8227a862b924b10dd6f1937cc73288d73111599d2968728fc762baf159cc3e78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14041
x-xss-protection: 0
server: cafe
etag: 16185193972789726432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 15 Sep 2021 17:47:09 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 32ms
10ms Script
application/x-javascript 184.30.21.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-40.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 13 Aug 2021 21:34:05 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=34348
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 177ms
6ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 28 May 2021 01:40:41 GMT
Server: AkamaiNetStorage
ETag: "5379c4a40ff8ae9d2fc6484dd1c57349:1622166041.794746"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2

200

oct.js Show response
static.ads-twitter.com/
Redirect Chain

https://platform.twitter.com/oct.js
https://static.ads-twitter.com/oct.js

6 KB
2 KB

32ms
7ms

Script
application/javascript

151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/oct.js
Requested by: Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7e8ee8f9d56ca7e35629a7c16b9f1c09fbb1e7d19fe922833a2f4edec48bfeea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
fastly-restarts: 1
last-modified: Wed, 25 Aug 2021 16:20:44 GMT
etag: "934b8997f9fc81b2d0e16fca4cd0b8bb+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-geo-cc_and_ra: DE-NW
cache-control: no-cache
x-cache: HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 2119
x-served-by: cache-fra19154-FRA

Redirect headers

x-tw-cdn: VZ
Date: Wed, 15 Sep 2021 17:47:09 GMT
Server: ECS (frb/674B)
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Location: https://static.ads-twitter.com/oct.js
Content-Length: 0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
26 KB 111ms
34ms Script
application/x-javascript 185.60.218.24
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.60.218.24 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-otp1.fbcdn.net

Software

Resource Hash

335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 25999
x-xss-protection: 0
pragma: public
x-fb-debug: Sm8YSm5u280YqpftVlx1Psfdk6iXE3eoomkhQ5fos2b2TGB/FokgFb//9QTkZi3ESvS3d7LwlJIyXOslks07Vw==
x-fb-trip-id: 1082456386
x-frame-options: DENY
date: Wed, 15 Sep 2021 17:47:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 96 KB
38 KB 82ms
48ms Script
application/javascript 172.217.169.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1009321688

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.169.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

a7bb5549e621d9880bf17153afe6929624427fb38e2d7ced1f9df37794abd61d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39256
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Sep 2021 17:47:09 GMT

GET
H2 200 t.js Show response
vidassets.terminus.services/c7c37bd7-a625-41d3-a077-5cfb8d57de15/ 4 KB
2 KB 66ms
17ms Script
application/javascript 54.230.206.112
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://vidassets.terminus.services/c7c37bd7-a625-41d3-a077-5cfb8d57de15/t.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-112.ham50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:44:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160
x-cache: Hit from cloudfront
access-control-allow-origin: *
last-modified: Wed, 08 Sep 2021 19:22:48 GMT
server: nginx/1.10.3 (Ubuntu)
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript;charset=utf-8
via: 1.1 d801ae07b5a25e1b54be4791dba41742.cloudfront.net (CloudFront)
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: HAM50-C3
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: M8k6mIVRHxxyQ6SHawMxWI83AmOEiGwMrxt8HzFdifaetw4jk8fwHw==

GET
H2 200 airpr.js Show response
px.airpr.com/ 7 KB
2 KB 57ms
13ms Script
application/javascript 52.222.186.16
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://px.airpr.com/airpr.js
Requested by: Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.186.16 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-186-16.ham50.r.cloudfront.net
Software: nginx /
Resource Hash: 529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 16:00:58 GMT
content-encoding: gzip
last-modified: Sat, 21 Apr 2018 18:03:55 GMT
server: nginx
age: 6374
etag: "5adb7d0b-853"
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 c3ea695df6623739937b8dda8c1599f9.cloudfront.net (CloudFront)
cache-control: max-age=43200
x-amz-cf-pop: HAM50-C2
content-length: 2131
x-amz-cf-id: YwtWwCjK2p_JDEud--tD0VRs_Ji1Ia3wq3s5Z_FJV6hfrXLjGI-SQw==
expires: Thu, 16 Sep 2021 04:15:42 GMT

GET
H2 200 hgzvddcpffbf.js Show response
js.driftt.com/include/1631728200000/ 214 KB
61 KB 208ms
145ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1631728200000/hgzvddcpffbf.js

Requested by

Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

c7bc8a2914e073cc57c8e2d8530cf1cfcbfa05c48663224d30e53fdb6b700368

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: 9p_Ql.NCJR7rXxHIga1nzkJigYswAegr
content-encoding: gzip
etag: W/"38c6a1a2853d08c7c5b96c7c0cc895c7"
x-amz-cf-pop: HAM50-C2
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 14 Sep 2021 19:38:25 GMT
server: nginx
date: Wed, 15 Sep 2021 17:47:09 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: UpCIkX--VdjbBLQmUemjmgIxSZmiDz8e0kpHtqKQPmXsy6a8TB7X8Q==

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 83 KB
32 KB 42ms
7ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67F3) /
Resource Hash: de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
last-modified: Fri, 10 Sep 2021 00:30:14 GMT
server: ECS (frb/67F3)
age: 71865
etag: "6a1946dba5d71:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 32240

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 92 KB
37 KB 65ms
35ms Script
application/javascript 172.217.169.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10511878

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.169.8 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s26-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f00e805fa94ee0f20b2c0f3c3f3a1f1c617d5735d93fd78e30047a04c976ac25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37835
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 15 Sep 2021 17:47:09 GMT

GET
H/1.1 200
OK 53ZNW7VR.js Show response
cdn.getsmartcontent.com/ 105 KB
37 KB 71ms
11ms Script
application/javascript 151.139.237.219
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.getsmartcontent.com/53ZNW7VR.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WBTPTVC
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.237.219 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 4769d42009cae6acf42fdaf1604feff36f8a5bb6c37c049a035fbc9a6802766c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Encoding: gzip
ETag: W/"6d5b1949fceda8b74c31c5b653c4ce08"
Last-Modified: Wed, 15 Sep 2021 17:45:33 GMT
Server: NetDNA-cache/2.2
x-amz-request-id: R020QF2SBA4HNZJ1
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: HIT
Content-Type: application/javascript
Cache-Control: public, max-age=900
x-amz-replication-status: PENDING
Connection: keep-alive
x-amz-version-id: ez7L8duFSkQlYEDqBNdoDQpmrgJgvYb4
x-amz-id-2: AD1n9EXqEu18o2j201fkvDkcgeP+5kNC39tIcSgByY75eMcc7y2nvq0xpyqjWUSopo+Htb6r38U=

GET
H2 200 adsct
analytics.twitter.com/i/ 43 B
582 B 135ms
114ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?txn_id=nuan9&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0&gtmcb=1371615958

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 15 Sep 2021 17:47:09 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5d5fbd8377b6800c1fc8a4d69904a1f02ca2d8f095bccc4e4560650a1fd1e533
x-transaction: c59a2a1b26e28435
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
454 B 132ms
112ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?txn_id=nuan9&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0&gtmcb=1187054248

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 15 Sep 2021 17:47:09 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e536a53e8a3a35b3557135543183028106e27245abb1b6f770ac5c111ca66d96
x-transaction: 1eb8d44de4340738
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK sessioncam.recorder.js Show response
d2oh4tlt9mrke9.cloudfront.net/Record/js/ 268 KB
60 KB 73ms
14ms Script
text/javascript 52.222.190.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Requested by: Host: info.rapid7.com
URL: https://info.rapid7.com/NDExLU5BSy05NzAAAAF_R0IDIi4SL9snLTOtHAHtd58hPWDJW3XtuodwXJQ7duqD7sGqfw5TMJFiBP2EqaqUFcE0FuY=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.190.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-190-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dea35a199ac7d32e9d486b6779d82202a3abdee5a8fb1bb2929ba8ab3bba96ec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-amz-version-id: qu1Ff.86MgLMhM6ZXnQKzA.rj3ifS0Jj
Content-Encoding: gzip
ETag: "3070b71c6b70954b8cc324b123ea12d8"
Age: 10840
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 61031
Last-Modified: Fri, 20 Aug 2021 06:45:24 GMT
Server: AmazonS3
Date: Wed, 15 Sep 2021 14:46:30 GMT
Content-Type: text/javascript
Via: 1.1 a1c4b15d670dc9e4a6cbea1be6412324.cloudfront.net (CloudFront)
Cache-Control: max-age=14400
X-Amz-Cf-Pop: HAM50-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: rwq-A9meLfjzuU9MB1FEI_pjRQ-hijvOClzLkig6u-alIyP5633C4Q==

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D22471%26time%3D1631728029421%26url%3Dhttps%253A%252F%252Fwww.rapid7.com%252Fblog%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084...

0
80 B

134ms
134ms

Image
application/javascript

108.174.11.69
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&liSync=true
Requested by: Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 108.174.11.69 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-11-69.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
x-li-proto: http/2
x-li-pop: prod-eda6
content-type: application/javascript
content-length: 0
x-li-uuid: fvIJlf8PpRbgUxHoPCsAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri /security/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXMDEmccIHtoTqEi6pTvw==
pragma: no-cache
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 678381FCD39641B987D5A1C0E356FE73 Ref B: PRG01EDGE0712 Ref C: 2021-09-15T17:47:10Z
x-frame-options: sameorigin
date: Wed, 15 Sep 2021 17:47:10 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=31536000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=22471&time=1631728029421&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&liSync=true
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 lounge.aa6d56595a43bd5e887186df12931c03.css
c.disquscdn.com/next/embed/styles/ 0
26 KB 93ms
14ms Other
text/css 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Requested by

Host: rapid7.disqus.com
URL: https://rapid7.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1194355
x-cache: Hit from cloudfront
content-length: 26040
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-65b8"
content-type: text/css; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: 64c9n7zmQIyEsOgVwJh94k3NRu-O0M8Gn3EPMNylCXRa0tA51AcPIA==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js
c.disquscdn.com/next/embed/ 0
93 KB 102ms
26ms Other
application/javascript 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: rapid7.disqus.com
URL: https://rapid7.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5002796
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: MCyZme0zPmZcEkMLm-pu86qfqfPyzranHnGSFI_-jA6NrptIU0ZhdQ==
x-cache-hits: 0

GET
H2 200 lounge.bundle.a394e8c4e3eaa98fc6ab1dfa2e322bd4.js
c.disquscdn.com/next/embed/ 0
119 KB 116ms
41ms Other
application/javascript 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.a394e8c4e3eaa98fc6ab1dfa2e322bd4.js

Requested by

Host: rapid7.disqus.com
URL: https://rapid7.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 18:15:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1121473
x-cache: Hit from cloudfront
content-length: 120689
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 02 Sep 2021 17:40:39 GMT
server: nginx
etag: "61310c97-1d771"
content-type: application/javascript; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Fri, 02 Sep 2022 18:15:56 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: bg_R7Q2nOwf1aGKtK9v9bRnB-IOaMZ1e6iEKm3dj57yW46ck105cxg==
x-cache-hits: 0

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
12 KB 6ms
6ms Other
application/javascript 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: rapid7.disqus.com
URL: https://rapid7.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 45
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12058
X-XSS-Protection: 1; mode=block

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 65ms
32ms XHR
text/plain 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=1728906341&t=pageview&_s=1&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&dr=https%3A%2F%2Finfo.rapid7.com%2F&ul=en-us&de=UTF-8&dt=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=684378463&gjid=1203204368&cid=1065388984.1631728029&tid=UA-4622520-1&_gid=1784728309.1631728029&_r=1&gtm=2wg9d0WBTPTVC&cd14=secondary&cd15=contact&z=1074712028

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.rapid7.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 48ms
26ms Image
image/gif 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 07:31:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 36966
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 49ms
27ms Image
image/gif 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 07:31:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 36966
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
336 B 122ms
121ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=nuan9&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/oct.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 15 Sep 2021 17:47:09 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5d5fbd8377b6800c1fc8a4d69904a1f02ca2d8f095bccc4e4560650a1fd1e533
x-transaction: 9a8e767b05e55ace
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
119 B 113ms
112ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.3&p_id=Twitter&p_user_id=0&txn_id=nuan9&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
pragma: no-cache
last-modified: Wed, 15 Sep 2021 17:47:09 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: e536a53e8a3a35b3557135543183028106e27245abb1b6f770ac5c111ca66d96
x-transaction: 458e37b849ec0448
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1009321688/ 2 KB
2 KB 81ms
30ms Script
text/javascript 216.58.213.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1009321688/?random=1631728029517&cv=9&fst=1631728029517&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9d0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&ref=https%3A%2F%2Finfo.rapid7.com%2F&tiba=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ber01s14-in-f2.1e100.net

Software

cafe /

Resource Hash

7d3b9af0b596b6cee1705514cfc32bf8b2d87a153591c3f03f9e664827cf8a24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1239
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1009321688/ 2 KB
1 KB 55ms
31ms Script
text/javascript 216.58.213.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1009321688/?random=1631728029522&cv=9&fst=1631728029522&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&ref=https%3A%2F%2Finfo.rapid7.com%2F&tiba=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.213.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ber01s14-in-f2.1e100.net

Software

cafe /

Resource Hash

3ec0b189cbac8dfe42e34b2ffea5d7f632dc0c0b0ddea73d57c2d48ae59f1137

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1273
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 221535741698095 Show response
connect.facebook.net/signals/config/ 306 KB
87 KB 71ms
35ms Script
application/x-javascript 185.60.218.24
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/221535741698095?v=2.9.45&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.24 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-otp1.fbcdn.net

Software

Resource Hash

8f572e55d1260c84e42865af82f2fe8572c8544b29d9cb887c3dc405e3718ccf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 89185
x-xss-protection: 0
pragma: public
x-fb-debug: CNln9kiqjx5I/fwkYjr8HwP1NmDtW1Url3nzS3zI8vPl7xZ+gJB5lGwY7ooPwK7/OuGx6wtSD9TdYt/2T5BVfg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 15 Sep 2021 17:47:09 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 6712 7 KB
4 KB 172ms
139ms Document
text/html 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default

Requested by

Host: rapid7.disqus.com
URL: https://rapid7.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

b1aad362c22adc49a9d6ec917da6601d8982cd44a7a91a5e6d97bdf84e75ba19

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.rapid7.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

Connection: keep-alive
Content-Length: 2811
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 02 Sep 2021 15:48:10 GMT
ETag: W/"lounge:view:8752861485.5035a4b9b94ee8e5ee088935ba26f998.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Wed, 15 Sep 2021 17:47:09 GMT
Age: 0
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H2

200

s.gif
vidassets.terminus.services/
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33
https://match.adsrvr.org/track/cmb/generic?ttd_pid=terminus&ttd_tpi=1&ttd_puid=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33
https://vidassets.terminus.services/s.gif?d=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33&t=934c99ca-67f8-41e8-b020-007491042a32

42 B
684 B

17ms
17ms

Image
image/gif

54.230.206.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vidassets.terminus.services/s.gif?d=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33&t=934c99ca-67f8-41e8-b020-007491042a32

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-112.ham50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:13:18 GMT
via: 1.1 d801ae07b5a25e1b54be4791dba41742.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 2045
x-cache: Hit from cloudfront
content-length: 42
last-modified: Wed, 08 Sep 2021 19:22:48 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: HAM50-C3
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: aU4RuXnYESkkyWWngDfbw90FxlVcUDlzMPczmlbvhGgWHydDXBhuvg==

Redirect headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://vidassets.terminus.services/s.gif?d=c7c37bd7-a625-41d3-a077-5cfb8d57de15|2b023085-ea6c-4d1e-8cdb-da4e16beeb33&t=934c99ca-67f8-41e8-b020-007491042a32
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 343

GET
H2 200 t.gif
vidassets.terminus.services/c7c37bd7-a625-41d3-a077-5cfb8d57de15/ 42 B
684 B 17ms
16ms Image
image/gif 54.230.206.112
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://vidassets.terminus.services/c7c37bd7-a625-41d3-a077-5cfb8d57de15/t.gif?d=2b023085-ea6c-4d1e-8cdb-da4e16beeb33&s=371d0fb9-d026-4b00-8293-58fedffad150&p=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&cb=1631728029553

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.230.206.112 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-54-230-206-112.ham50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:18:36 GMT
via: 1.1 d801ae07b5a25e1b54be4791dba41742.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 1952
x-cache: Hit from cloudfront
content-length: 42
last-modified: Wed, 08 Sep 2021 19:22:48 GMT
server: nginx/1.10.3 (Ubuntu)
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
cache-control: public, s-maxage=2700
x-amz-cf-pop: HAM50-C3
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Authorization
x-amz-cf-id: -9BTvSy4IwZ4-VXFr-qOOgSK7V3mPh4HAWeKVLYlPsDTljgO4j0wJQ==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 2 B
432 B 48ms
14ms XHR
text/plain 74.125.206.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-4622520-1&cid=1065388984.1631728029&jid=684378463&gjid=1203204368&_gid=1784728309.1631728029&_u=YEBAAEAAAAAAAC~&z=22838236

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.206.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wk-in-f156.1e100.net

Software

Golfe2 /

Resource Hash

6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 15 Sep 2021 17:47:09 GMT
content-type: text/plain
access-control-allow-origin: https://www.rapid7.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/160/ 11 KB
5 KB 7ms
7ms Script
application/x-javascript 23.45.104.85
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/160/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.45.104.85 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-104-85.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Feb 2021 02:54:38 GMT
Server: AkamaiNetStorage
ETag: "19a9335fd71267d56e65bc19390f3100:1613703278.138281"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4811
Expires: Fri, 24 Dec 2021 17:47:09 GMT

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
304 B 10ms
9ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=https%3A%2F%2Finfo.rapid7.com%2F&_biz_h=-1906410348&_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029586&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&_biz_n=0&rnd=497636&cdn_o=a&_biz_z=1631728029587
Requested by: Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6760) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
last-modified: Sun, 12 Sep 2021 11:21:51 GMT
server: ECS (frb/6760)
age: 282318
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 kvp
cdn.bizible.com/m/ 43 B
202 B 10ms
10ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/kvp?data=%7B%22ABTest%22%3A%5B%7B%22Exp%22%3A%7B%22Id%22%3A%2220570974667.20563386157%22%2C%22Name%22%3A%2220210823%20IDC%20Marketscape%20MDR.20210823%20IDC%20Marketscape%20MDR%22%7D%2C%22Var%22%3A%7B%22Id%22%3A%2220514685381%22%2C%22Name%22%3A%22Variation%20%231%22%7D%2C%22U%22%3A%22oeu1631728028664r0.00773964388229631%22%7D%2C%7B%22Exp%22%3A%7B%22Id%22%3A%2220596013402.20607354566%22%2C%22Name%22%3A%2209092021%20CloudSec%20Campaign%20Promobar.09092021%20CloudSec%20Campaign%20Promobar%22%7D%2C%22Var%22%3A%7B%22Id%22%3A%2220615180662%22%2C%22Name%22%3A%22Variation%20%231%22%7D%2C%22U%22%3A%22oeu1631728028664r0.00773964388229631%22%7D%5D%7D&_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029592&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&_biz_n=1&rnd=572351&cdn_o=a&_biz_z=1631728029592
Requested by: Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67F2) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
last-modified: Mon, 13 Sep 2021 02:16:10 GMT
server: ECS (frb/67F2)
age: 228659
x-cache: HIT
content-type: Image/GIF
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
203 B 18ms
7ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029593&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&rnd=595452&cdn_o=a&_biz_z=1631728029593
Requested by: Host: www.rapid7.com
URL: https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/?utm_source=marketo&utm_medium=email&utm_campaign=confluence-q3-21&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67C2) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
last-modified: Thu, 09 Sep 2021 23:57:00 GMT
server: ECS (frb/67C2)
age: 496209
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
522 B 82ms
32ms Image
image/gif 142.250.200.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-4622520-1&cid=1065388984.1631728029&jid=684378463&_u=YEBAAEAAAAAAAC~&z=1946568549

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
527 B 119ms
119ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_h=-1906410348&cdn_o=a&jsVer=4.21.06.25
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6711) /
Resource Hash: ae40a082914cb6ab8c858235a780dd1b9c3fd5e1a584b9eaf10c8115539993a9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
server: ECS (frb/6711)
etag: 9BC6D36C
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 219

GET
H2 200 serving Show response
s.getsmartcontent.com/ 2 KB
3 KB 441ms
190ms Script
application/javascript 35.174.150.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://s.getsmartcontent.com/serving?tm=1631728030&rv=cbecf5a2-8129-476c-9675-a039e1b5307b&i=p1p1swrngpqqdywppwalh4bzqk8ljgb5&loc=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&w=53ZNW7VR&c=Q0ML02G9%2CRJBW1ZJH&v=1631728030.1631728030.1631728030.1&s=p1p1swrngpqqdywppwalh4bzqk8ljgb5.1631728030&d=1600%2C1200&ab=&r=https%3A%2F%2Finfo.rapid7.com%2F&m.eg=&lvc=&lvcr=&dl=%7B%7D

Requested by

Host: cdn.getsmartcontent.com
URL: https://cdn.getsmartcontent.com/53ZNW7VR.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.174.150.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-174-150-252.compute-1.amazonaws.com

Software

Resource Hash

e9dddbbd48a572a38b0ae1c9452f38616ce7b949492856ddf39de557d9e7c4cb

Security Headers

Name	Value
Content-Security-Policy	default-src '*'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:10 GMT
referrer-policy: unsafe-url
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: max-age=0, must-revalidate, no-cache=Set-Cookie, private
content-security-policy: default-src '*'
x-content-type-options: nosniff
expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK config.aspx Show response
ws.sessioncam.com/Record/ 1 KB
2 KB 406ms
96ms XHR
text/javascript 35.171.170.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sessioncam.com/Record/config.aspx?url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&jsver=592&originalUrl=https://www.rapid7.com&sse=1631728029682&inTg=a&acr=0
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.170.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-170-135.compute-1.amazonaws.com
Software: /
Resource Hash: 173766c85b077cac6612a19f37dfd086d800fe1438ba4e887a81848c6d0a8570

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Wed, 15 Sep 2021 17:47:09 GMT
Content-Type: text/javascript
Access-Control-Allow-Origin: https://www.rapid7.com
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1269
Expires: -1

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
359 B 451ms
110ms XHR
text/plain 34.232.196.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.196.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-196-113.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 15 Sep 2021 17:47:10 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.rapid7.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: d41bcdec-f6f6-40c2-a7f5-61a73e15ed31

GET
H2 200 /
www.facebook.com/tr/ 44 B
313 B 111ms
34ms Image
image/gif 185.60.218.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=221535741698095&ev=PageView&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&rl=https%3A%2F%2Finfo.rapid7.com%2F&if=false&ts=1631728029703&sw=1600&sh=1200&v=2.9.45&r=stable&ec=0&o=30&fbp=fb.1.1631728029701.865585914&it=1631728029541&coo=false&exp=p1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.60.218.35 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-otp1.facebook.com

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Wed, 15 Sep 2021 17:47:09 GMT

GET
H2 200 forms2.css
app-sj20.marketo.com/js/forms2/css/ 13 KB
3 KB 211ms
211ms Stylesheet
text/css 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/js/forms2/css/forms2.css

Requested by

Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Tue, 10 Aug 2021 17:41:08 GMT
server: cloudflare
etag: "720072-3437-5c93801bbf500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 68f3adb9c864410e-PRG
content-length: 2623
expires: Wed, 15 Sep 2021 21:47:09 GMT

GET
H2 200 forms2-theme-simple.css
app-sj20.marketo.com/js/forms2/css/ 826 B
339 B 200ms
200ms Stylesheet
text/css 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/js/forms2/css/forms2-theme-simple.css

Requested by

Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
vary: Accept-Encoding
content-length: 242
last-modified: Tue, 10 Aug 2021 17:41:08 GMT
server: cloudflare
etag: "720051-33a-5c93801bbf500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 68f3adb9c869410e-PRG
expires: Wed, 15 Sep 2021 21:47:09 GMT

POST
H/1.1 200
OK visitWebPage
411-nak-970.mktoresp.com/webevents/ 2 B
311 B 694ms
152ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://411-nak-970.mktoresp.com/webevents/visitWebPage?_mchNc=1631728029739&_mchCn=&_mchId=411-NAK-970&_mchTk=_mch-rapid7.com-1631728029739-54904&mkt_tok=NDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_mchHo=www.rapid7.com&_mchPo=&_mchRu=%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&_mchPc=https%3A&_mchVr=160&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Finfo.rapid7.com%2F&_mchQp=utm_source%3Dmarketo__-__utm_medium%3Demail__-__utm_campaign%3Dconfluence-q3-21__-__mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/160/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 15 Sep 2021 17:47:10 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: b2506395-c875-4c61-8d92-ca8a99de8424

GET
H2 200 /
www.google.com/pagead/1p-user-list/1009321688/ 42 B
154 B 50ms
45ms Image
image/gif 142.250.200.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1009321688/?random=1631728029517&cv=9&fst=1631725200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9d0&sendb=1&frm=0&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&ref=https%3A%2F%2Finfo.rapid7.com%2F&tiba=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&async=1&fmt=3&is_vtc=1&random=241643665&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/1009321688/ 42 B
108 B 32ms
32ms Image
image/gif 142.250.200.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1009321688/?random=1631728029522&cv=9&fst=1631725200000&num=1&bg=ffffff&guid=ON&eid=376635470&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&ref=https%3A%2F%2Finfo.rapid7.com%2F&tiba=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&async=1&fmt=3&is_vtc=1&random=2996050859&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr48s30-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:09 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.load.9bdb65de27b881f62b84ef54f46d1575.js Show response
c.disquscdn.com/next/embed/ Frame 6712 1 KB
1 KB 56ms
12ms Script
application/javascript 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.9bdb65de27b881f62b84ef54f46d1575.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

8dedd8362bb42b3e64a65b7bc88013fd669da19133f0f63e930f0c8c86681b7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
Origin: https://disqus.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 18:15:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1121473
x-cache: Hit from cloudfront
content-length: 533
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 02 Sep 2021 17:40:39 GMT
server: nginx
etag: "61310c97-215"
content-type: application/javascript; charset=utf-8
via: 1.1 34b26b9570d823536072a91c564a4d8d.cloudfront.net (CloudFront)
expires: Fri, 02 Sep 2022 18:15:56 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: HUBKfl-VS36o-0OTq0s0a13zq4Jte9J8Ota-n77djnY1EQ_pYvuYjA==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js Show response
c.disquscdn.com/next/embed/ Frame 6712 282 KB
93 KB 36ms
36ms Script
application/javascript 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.9bdb65de27b881f62b84ef54f46d1575.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5002796
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: 1XsoWMAMiTGUaI454EheKpPZIps3OUibFOvpMLeSwf_J1yskHCerKg==
x-cache-hits: 0

GET
H2 200 lounge.aa6d56595a43bd5e887186df12931c03.css
c.disquscdn.com/next/embed/styles/ Frame 6712 163 KB
26 KB 14ms
14ms Stylesheet
text/css 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

cf7ffb56cda8d58d7a7783e442a5729573c7e5d7098785c9a6cb382f2a772b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1194355
x-cache: Hit from cloudfront
content-length: 26040
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-65b8"
content-type: text/css; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: FO3AsrS267VE8eAjPo8oLs1UoqHI1a1EOKc9aa8L5wppjQIBYK5aeg==
x-cache-hits: 0

GET
H2 200 lounge.bundle.a394e8c4e3eaa98fc6ab1dfa2e322bd4.js Show response
c.disquscdn.com/next/embed/ Frame 6712 468 KB
119 KB 13ms
13ms Script
application/javascript 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.a394e8c4e3eaa98fc6ab1dfa2e322bd4.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

0a92d224a35aab3de7aa661df5c11272eea7f7fc8065230cf6b221a2e4961c31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 18:15:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1121473
x-cache: Hit from cloudfront
content-length: 120689
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Thu, 02 Sep 2021 17:40:39 GMT
server: nginx
etag: "61310c97-1d771"
content-type: application/javascript; charset=utf-8
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
expires: Fri, 02 Sep 2022 18:15:56 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
timing-allow-origin: *
x-amz-cf-id: t__dNMyf8nxkNxZoq6A4QVJRXqLRZ8Y1e3JJ01xTVKqDtwFH0FwKQA==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 6712 12 KB
12 KB 7ms
7ms Script
application/javascript 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

a2ac7d27583731c7b8390949ca3884a647f16f7e499fef291bc73881ac4400b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:09 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 45
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12058
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 6712 3 KB
3 KB 114ms
114ms XHR
application/json 151.101.0.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=rapid7&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.0.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e96622a932374b7be800e0c4d622609002e8a63087f0dd88fb13816b874cd16e

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Wed, 15 Sep 2021 17:47:10 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 0
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3081
X-XSS-Protection: 1; mode=block

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/524/8537/ Frame 6712 1 KB
2 KB 14ms
14ms Image
image/jpeg 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/524/8537/avatar92.jpg?1503943901

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

8f89cb57447f4e42714685a45fe3feb68d6a09323d228be12a7529bdb7416325

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 14:29:01 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5800689
x-cache: Hit from cloudfront
content-length: 1323
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 28 Aug 2017 18:11:42 GMT
server: nginx
etag: "bd78a5b693572c6e236917dfdd5c4d7b"
content-type: image/jpeg
expires: Sun, 10 Jul 2022 14:29:01 GMT
cache-control: max-age=31536000, public, immutable
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: tuHb67UC8Tp3q6F_UPygjM20IAC5lG5QA4ExrEmI7pTSZFM__RHJvQ==
x-cache-hits: 0

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 6712 13 KB
13 KB 13ms
13ms Image
image/svg+xml 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 12107369
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: mUmzzLQGgqTARU-Ky63gul2HMpYLyY5GSw4XnK9jka6R9zppXLupZw==
x-cache-hits: 0

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 6712 3 KB
3 KB 13ms
12ms Image
image/gif 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:58:07 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 19399743
x-cache: Hit from cloudfront
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 27 Jan 2021 17:23:07 GMT
server: nginx
etag: "6011a17b-b9b"
content-type: image/gif
access-control-allow-origin: *
expires: Thu, 03 Feb 2022 04:58:07 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: u6aAIA2YkN_hpO5KM0t0T1y_jcj_-4OELicXcwTfiwa66lLkRhGxYw==
x-cache-hits: 0

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame 6712 2 KB
2 KB 13ms
13ms Image
image/png 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:19 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 8319591
x-cache: Hit from cloudfront
content-length: 1862
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 10 Jun 2021 21:33:44 GMT
server: nginx
etag: "60c28538-746"
content-type: image/png
access-control-allow-origin: *
expires: Sat, 11 Jun 2022 10:47:19 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: BbYjgpzVtgRV9EiY1bGvMcHcZPf264FsHSQ3FVs31fquUfvxeigJoA==
x-cache-hits: 0

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 6712 8 KB
8 KB 13ms
13ms Font
application/octet-stream 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
Origin: https://disqus.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 12 Jul 2021 19:36:59 GMT
via: 1.1 34b26b9570d823536072a91c564a4d8d.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5609411
x-cache: Hit from cloudfront
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 08 Jul 2021 22:07:43 GMT
server: nginx
etag: "60e7772f-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
expires: Tue, 12 Jul 2022 19:36:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: G-qhezqLpeFMaR3f0EuDFk33BSie8h1sANklApWJ0k1FZ7MOHDV4Rg==
x-cache-hits: 0

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
108 B 12ms
12ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=https%3A%2F%2Finfo.rapid7.com%2F&_biz_h=-1906410348&_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029586&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&_biz_n=0&rnd=497636&cdn_o=a&_biz_z=1631728029587
Requested by: Host: d2oh4tlt9mrke9.cloudfront.net
URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/6760) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:10 GMT
last-modified: Sun, 12 Sep 2021 11:21:51 GMT
server: ECS (frb/6760)
age: 282319
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 kvp
cdn.bizible.com/m/ 43 B
84 B 12ms
12ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/kvp?data=%7B%22ABTest%22%3A%5B%7B%22Exp%22%3A%7B%22Id%22%3A%2220570974667.20563386157%22%2C%22Name%22%3A%2220210823%20IDC%20Marketscape%20MDR.20210823%20IDC%20Marketscape%20MDR%22%7D%2C%22Var%22%3A%7B%22Id%22%3A%2220514685381%22%2C%22Name%22%3A%22Variation%20%231%22%7D%2C%22U%22%3A%22oeu1631728028664r0.00773964388229631%22%7D%2C%7B%22Exp%22%3A%7B%22Id%22%3A%2220596013402.20607354566%22%2C%22Name%22%3A%2209092021%20CloudSec%20Campaign%20Promobar.09092021%20CloudSec%20Campaign%20Promobar%22%7D%2C%22Var%22%3A%7B%22Id%22%3A%2220615180662%22%2C%22Name%22%3A%22Variation%20%231%22%7D%2C%22U%22%3A%22oeu1631728028664r0.00773964388229631%22%7D%5D%7D&_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029592&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&_biz_n=1&rnd=572351&cdn_o=a&_biz_z=1631728029592
Requested by: Host: d2oh4tlt9mrke9.cloudfront.net
URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67F2) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:10 GMT
last-modified: Mon, 13 Sep 2021 02:16:10 GMT
server: ECS (frb/67F2)
age: 228660
x-cache: HIT
content-type: Image/GIF
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
85 B 13ms
12ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=9e7e0de41f7d4f6b892f762d53603197&_biz_s=2f20f0&_biz_l=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&_biz_t=1631728029593&_biz_i=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&rnd=595452&cdn_o=a&_biz_z=1631728029593
Requested by: Host: d2oh4tlt9mrke9.cloudfront.net
URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/67C2) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 17:47:10 GMT
last-modified: Thu, 09 Sep 2021 23:57:00 GMT
server: ECS (frb/67C2)
age: 496210
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 XDFrame Show response
app-sj20.marketo.com/index.php/form/ Frame D064 2 KB
881 B 203ms
202ms Document
text/html 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/index.php/form/XDFrame

Requested by

Host: information.rapid7.com
URL: https://information.rapid7.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c89a8bee77d21587af1a9e0dcd26a779b62436084eaf136c354ff1bf39f2c280

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-sj20.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.rapid7.com/
accept-encoding: gzip, deflate, br
cookie: __cf_bm=JDBeo3iimHm3X5ZvMkKknErTJzwAPUoWh97LQlTXnVI-1631728029-0-AYPWWvtAMfdqok84jBjT2ITS1+rt9v1ZcigSNkraN5v2GgcUJhoxwkQ7LwKvU3sgc5ZL4WGURFekTY3yt5tyYHI=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
content-type: text/html; charset=utf-8
content-length: 651
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
set-cookie: BIGipServersj20web-nginx-app_https=!H1wLQkxmhpaBpYa7iv4ewrP5TPDRswg4hCnbLsexnqgNXw5O35l9CV/lxpDrgil3MdbmozTTDf5y5B0=;Path=/;Version=1;Secure;Httponly
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 68f3adbcff17410e-PRG

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 6712 3 KB
2 KB 35ms
34ms Script
application/x-javascript 185.60.218.24
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.24 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-otp1.fbcdn.net

Software

Resource Hash

45341170f1b5ef36db1b2393b3f7669e668d0e2cb84f2aca93f3e7ad3ddb34e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: WIh6rUtmwWi1MuGLTFuNsw==
cross-origin-resource-policy: cross-origin
expires: Wed, 15 Sep 2021 18:06:57 GMT
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: IIyMVzsuEYmUgC2YF4SRzZ0voSqh9u6qZnZmfgnL2v9i8MFjJczqIYJl18bRlMDYye3JmeB0tjIdvAvd98aRkA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 8c78e8cdc10aeb5d48b8121a1520a4a9
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Sep 2021 17:47:10 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "ca235274d68fdd3726283788a99168b4"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 api.js Show response
apis.google.com/js/ Frame 6712 12 KB
6 KB 110ms
43ms Script
application/javascript 142.250.180.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.180.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s32-in-f14.1e100.net

Software

ESF /

Resource Hash

71f6ddf045f219694a515f6a9cbd397947150d872f33c9f03b7629d6f8b45c6d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-L8HoNiRVKvrWm1fysUw+6g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "6cf1a8085d365822968a50501ed9fdee"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-L8HoNiRVKvrWm1fysUw+6g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Wed, 15 Sep 2021 17:47:10 GMT

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 6712 13 KB
13 KB 14ms
13ms Image
image/svg+xml 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 12107369
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: hjdymT8LBQn6BxlRG_HRtk7ftBLylSuUipvpAVQbVWA6JK0-NTQFcw==
x-cache-hits: 0

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 0BB0 0
17 B 72ms
35ms Document
text/plain 185.60.218.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.35 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-otp1.facebook.com

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: POST
:authority: www.facebook.com
:scheme: https
:path: /tr/
content-length: 3835
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://www.rapid7.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.rapid7.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Origin: https://www.rapid7.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.rapid7.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority: u=3,i
date: Wed, 15 Sep 2021 17:47:10 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
26ms Image
image/gif 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&a=1728906341&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&dr=https%3A%2F%2Finfo.rapid7.com%2F&ul=en-us&de=UTF-8&dt=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Bound%20-%20Terminus%20Visitor%20Data&ea=Set%20Custom%20Dimensions&el=&ev=0&_u=aEDAAEABAAAAAC~&jid=&gjid=&cid=1065388984.1631728029&tid=UA-4622520-1&_gid=1784728309.1631728029&gtm=2wg9d0WBTPTVC&cd3=Reliablehosting.com&cd4=Information%20Technology%20and%20Services&cd5=737&cd6=FIFTY_TO_TWO_HUNDRED&cd7=TEN_MILLION_TO_FIFTY_MILLION&cd8=54151&cd9=strongvpn.com&cd10=function()%7Bfor(var%20e%2Ct%2Ci%3Darguments%2Cn%3Di.length%3Bn%26%26this.length%3B)for(e%3Di%5B--n%5D%3B-1!%3D%3D(t%3Dthis.indexOf(e))%3B)this.splice(t%2C1)%3Breturn%20this%7D&z=1809393965

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 07:31:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 36967
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 6712 222 KB
65 KB 71ms
35ms Script
application/x-javascript 185.60.218.24
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=2c7d12347b5476ac5c901075dc5ea87c

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.24 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

xx-fbcdn-shv-01-otp1.fbcdn.net

Software

Resource Hash

605041ae1215674abf88e3eecd5d416a9de33e80d64ac6341fa06329ebe8f347

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
Origin: https://disqus.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: gLX3kF6UlEpA7wDL9LzxAg==
cross-origin-resource-policy: cross-origin
expires: Thu, 15 Sep 2022 16:57:03 GMT
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 66944
x-fb-rlafr: 0
x-fb-debug: v2gAOuFh85bP4fQ/RfXmm8rqlYPhdSN71rQWuo9ACN+i45gPfkjGhrOdcpJW9xBOzht8lWefFnTd2g89J3EezA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 1dff4cc607a1bea5d34b7ef451c75c2d
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Sep 2021 17:47:10 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "50f6e51f4b452b6d2df1415addc1de46"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

POST
H/1.1 200
OK GetPageId Show response
ws.sessioncam.com/Record/record.asmx/ 0
192 B 549ms
364ms XHR
text/plain 35.171.170.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ws.sessioncam.com/Record/record.asmx/GetPageId?url=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&id=uppjqmlu1a1yqqmasth2nwvc
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.171.170.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-171-170-135.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Access-Control-Allow-Origin: https://www.rapid7.com
Date: Wed, 15 Sep 2021 17:47:10 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.soliK2B9LKA.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCP_VSmeyDlYE1vxFyfmddhL6RM9dw/ Frame 6712 103 KB
34 KB 62ms
20ms Script
text/javascript 142.250.180.14
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.soliK2B9LKA.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCP_VSmeyDlYE1vxFyfmddhL6RM9dw/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.180.14 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s32-in-f14.1e100.net

Software

sffe /

Resource Hash

59611414404075b2acabb597d983e323859932efab7ef0cdd45cb25b5bc87c86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 09:06:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204059
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35070
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:17:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Sep 2022 09:06:11 GMT

GET
H3 200 status
www.facebook.com/x/oauth/ Frame 6712 0
0 172ms
171ms Fetch
text/plain 185.60.218.35
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fwww.rapid7.com&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Drapid7%26t_i%3D6130ecaf6316e72fc6dd4c84%26t_u%3Dhttps%253A%252F%252Fwww.rapid7.com%252Fblog%252Fpost%252F2021%252F09%252F02%252Factive-exploitation-of-confluence-server-cve-2021-26084%252F%26t_d%3DActive%2520Exploitation%2520of%2520Confluence%2520Server%2520CVE-2021-26084%2520%257C%2520Rapid7%2520Blog%26t_t%3DActive%2520Exploitation%2520of%2520Confluence%2520Server%2520CVE-2021-26084%2520%257C%2520Rapid7%2520Blog%26s_o%3Ddefault%23version%3D9bdb65de27b881f62b84ef54f46d1575&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

QUIC, , AES_128_GCM

Server

185.60.218.35 Bucharest, Romania, ASN32934 (FACEBOOK, US),

Reverse DNS

edge-star-mini-shv-01-otp1.facebook.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ wss://*.whatsapp.com:* v.whatsapp.net *.fbsbx.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster:;media-src *.cdninstagram.com;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com;worker-src blob: *.facebook.com;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: s2VwKtv8gPc1CqKGmoGKurD3tb1Vz+e6pfvx8Gs45SW0fQXt+ZCFXBcgYPcXbkfs3u7ccEW/aEhtMEzkzbpKwA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 15 Sep 2021 17:47:10 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame F2A5 513 B
922 B 198ms
132ms Document
text/html 142.250.200.13

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.soliK2B9LKA.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCP_VSmeyDlYE1vxFyfmddhL6RM9dw/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.200.13 -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

3329931cffa7e52ea5af6116d5dbfd83b6c0500496864a89b6d0fb1d25f55ebd

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-yDCbVO2T/0qQNo1p2Ppp1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
accept-encoding: gzip, deflate, br
cookie: NID=511=kfZOy53Wntuz2NsyLgb_fXXMw0jdo0zYAfbIGGJruqQPa6F6Owx-e_Qhw2braMz5LoE_6r48U36MttAqJ_4hNMrw9n69HGoHbh3-RWCx3L9GHeP07RXdhdsNoMtDqvba8AUZ1zHFajy0rCvK08QFzsqx2AidMk1u0kDw5QwhOB0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 15 Sep 2021 17:47:10 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-yDCbVO2T/0qQNo1p2Ppp1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 forms2.min.js Show response
app-sj20.marketo.com/js/forms2/js/ Frame D064 205 KB
68 KB 30ms
29ms Script
application/x-javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj20.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: app-sj20.marketo.com
URL: https://app-sj20.marketo.com/index.php/form/XDFrame

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://app-sj20.marketo.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 10 Aug 2021 17:41:08 GMT
server: cloudflare
age: 1
etag: "740df3-33210-5c93801bbf500"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 68f3adbe59cb410e-PRG
expires: Wed, 15 Sep 2021 21:47:10 GMT

GET
H2 200 1260035447-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame F2A5 116 KB
40 KB 73ms
19ms Script
text/javascript 172.217.169.35

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/1260035447-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.169.35 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

44c8661f02d0547ad8bc6deb777a16c9f8bd783b5d6eb4a75eeaffed8e570042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 19:09:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40581
x-xss-protection: 0
last-modified: Fri, 10 Sep 2021 02:29:46 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 13 Sep 2022 19:09:32 GMT

POST
H/1.1 204
No Content events Show response
logx.optimizely.com/v1/ 0
359 B 110ms
109ms XHR
text/plain 34.232.196.113
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://logx.optimizely.com/v1/events
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.196.113 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-196-113.compute-1.amazonaws.com
Software: nginx/1.17.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.rapid7.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 15 Sep 2021 17:47:10 GMT
Server: nginx/1.17.2
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.rapid7.com
Access-Control-Expose-Headers: X-Results-Data-Source
Access-Control-Allow-Credentials: true
Connection: keep-alive
Timing-Allow-Origin: *
X-Request-Id: 34fcaac1-55f1-4df8-8108-c0a77fee6840

GET
H2 200 core Show response
js.driftt.com/ Frame 0DA2 2 KB
1 KB 127ms
127ms Document
text/html 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1631728200000/hgzvddcpffbf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

264bca52ed6efc10977f418f888cc00cc97a6c3085005e701e390df749062f41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.rapid7.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 14 Sep 2021 19:38:19 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: oTdfCskALO1NsUB2cCG7Szm2rbT.bmKS
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 15 Sep 2021 17:47:10 GMT
cache-control: no-cache
etag: W/"b717b48eb4efe2f48224d54c902beb44"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: jYxvPER23VJ_sLjGegl-O00PYnIUKeImyTcBbh6vaVC-UQQEEUNQFg==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 0F54 2 KB
1 KB 130ms
130ms Document
text/html 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1631728200000/hgzvddcpffbf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

264bca52ed6efc10977f418f888cc00cc97a6c3085005e701e390df749062f41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.rapid7.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 14 Sep 2021 19:38:19 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: oTdfCskALO1NsUB2cCG7Szm2rbT.bmKS
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 15 Sep 2021 17:47:10 GMT
cache-control: no-cache
etag: W/"b717b48eb4efe2f48224d54c902beb44"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C2
x-amz-cf-id: C7iGDXaIWlVR0aolyWEwU7eMfLq9AptPcp8vYp8rDSAvzESSB2yUCA==

GET tags
www.rapid7.com/api/blog/ 0
0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
26ms Image
image/gif 142.250.187.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j93&aip=1&a=1728906341&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F%3Futm_source%3Dmarketo%26utm_medium%3Demail%26utm_campaign%3Dconfluence-q3-21%26mkt_tok%3DNDExLU5BSy05NzAAAAF_R0IDIo_louMVne3axt3_xXmDqZbJgKZ0CqKZmVg1kKTYeiRBl1-x609cUx54z1QpHviah89q-82G5556FuimsBjcyFldvNYGHjQOhzfvCphNgcA&dr=https%3A%2F%2Finfo.rapid7.com%2F&ul=en-us&de=UTF-8&dt=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=airpr&ea=visitor%20hit&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=1065388984.1631728029&tid=UA-4622520-1&_gid=1784728309.1631728029&gtm=2wg9d0WBTPTVC&cd14=secondary&cd15=contact&cd19=1065388984.1631728029&z=139598768

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.187.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr25s33-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 15 Sep 2021 07:31:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 36967
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2

204

anpx
dpx.airpr.com/
Redirect Chain

https://dpx.airpr.com/px?hostname=www.rapid7.com&profile=530642&ga_account_id=UA-4622520-1&ga_account_type=UA&ga_c=1065388984.1631728029&an=true
https://secure.adnxs.com/getuid?https://dpx.airpr.com/anpx?adnxs_uid=$UID&airpr_id=4061543988
https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdpx.airpr.com%2Fanpx%3Fadnxs_uid%3D%24UID%26airpr_id%3D4061543988
https://dpx.airpr.com/anpx?adnxs_uid=2103207750422641859&airpr_id=4061543988

0
63 B

9ms
8ms

Image
text/plain

18.194.85.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpx.airpr.com/anpx?adnxs_uid=2103207750422641859&airpr_id=4061543988
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.85.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.rapid7.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
cache-control: private
server: nginx

Redirect headers

Pragma: no-cache
Date: Wed, 15 Sep 2021 17:47:10 GMT
X-Proxy-Origin: 216.131.114.163; 216.131.114.163; 539.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 79ba5471-9dd5-42b7-be6a-74c639db3440
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dpx.airpr.com/anpx?adnxs_uid=2103207750422641859&airpr_id=4061543988
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame F2A5 14 B
58 B 158ms
119ms XHR
application/json 142.250.200.13

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/1260035447-idpiframe.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.200.13 -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
X-Requested-With: XmlHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 17:47:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Wed, 15 Sep 2021 18:47:10 GMT

GET
H2 200 runtime~main.4d9fd880.js Show response
js.driftt.com/core/assets/js/ Frame 0DA2 6 KB
3 KB 15ms
14ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

b82862f8e93a7749b8a7a1a5f718b84599f3cc191e89564f7d23d1e0c6fd946d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:38:19 GMT
content-encoding: gzip
age: 79731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 14 Sep 2021 18:57:11 GMT
server: nginx
etag: W/"5e215e545183fd2ab176b4cfd38f157d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: lASWVoPVkAuR2Cbvpp6xEF2O0gcDLjDk
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zqKq_XFz1lznvMQ2n63tqAR-S0KYRWyt_6yTFuvRmPU99UnIHNBuhw==

GET
H2 200 4.a93e53d9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0DA2 58 KB
20 KB 14ms
13ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449693
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:25 GMT
server: nginx
etag: W/"fce0b3daf28dfa888be2818f43b06ef0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CYymvqE5cS37U6Mt9C1kOcOPqnEiq_yW-3tgJ_ybZLMVrIvYljbizQ==

GET
H2 200 main~493df0b3.e771f19b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0DA2 6 KB
3 KB 18ms
17ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.e771f19b.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

2dafb4c739fbf5d52042d02b5346f60121ff607b6175e44bb5af8a4d4d5141fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:38:19 GMT
content-encoding: gzip
age: 79731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 14 Sep 2021 18:57:11 GMT
server: nginx
etag: W/"b7041fcff7097ac261c9216ad56c7aea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vz4wk8R1eqhjG37PuN6c5v1sAnjn4b1t
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: jQvI_BW157Q5eMJ7mK5X4myWX1jjw1WFGy68IXXB2WSO-KEDqbvcTA==

GET
H2 200 runtime~main.4d9fd880.js Show response
js.driftt.com/core/assets/js/ Frame 0F54 6 KB
3 KB 15ms
14ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

b82862f8e93a7749b8a7a1a5f718b84599f3cc191e89564f7d23d1e0c6fd946d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:38:19 GMT
content-encoding: gzip
age: 79731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 14 Sep 2021 18:57:11 GMT
server: nginx
etag: W/"5e215e545183fd2ab176b4cfd38f157d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: lASWVoPVkAuR2Cbvpp6xEF2O0gcDLjDk
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2RJHsZTcrHe76Wrmv5ZO1-tc4Ay1G-VaiNnWfgbcHL4MhQdRieRCUg==

GET
H2 200 4.a93e53d9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0F54 58 KB
20 KB 16ms
15ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449693
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:25 GMT
server: nginx
etag: W/"fce0b3daf28dfa888be2818f43b06ef0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bQ38OMOz8AaO2OyGIN3SxkSxEOCylCEx0N8f54BQz5K-81x872bCwA==

GET
H2 200 main~493df0b3.e771f19b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 0F54 6 KB
3 KB 17ms
16ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.e771f19b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

2dafb4c739fbf5d52042d02b5346f60121ff607b6175e44bb5af8a4d4d5141fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1631728028521
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 19:38:19 GMT
content-encoding: gzip
age: 79731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 14 Sep 2021 18:57:11 GMT
server: nginx
etag: W/"b7041fcff7097ac261c9216ad56c7aea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vz4wk8R1eqhjG37PuN6c5v1sAnjn4b1t
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vcuD-eHL2_ilUmEecsl3XTyA557GKuyPB05SO59oKD7AfIq14Rn8kQ==

GET
H2 200 42.84f5886d.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 44 KB
13 KB 18ms
18ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/42.84f5886d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 13:41:58 GMT
content-encoding: gzip
age: 4075512
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 30 Jul 2021 13:31:10 GMT
server: nginx
etag: W/"3dff2faf78d282147690e292eb6987fa"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1YCzDLaWz5s9VmMBrNnONETxLHvnH5Mc
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6qy9op-f5zxq52dZBm4Qy0oTU9vpgZVIHmoVjCXbx15p-Io0ubQWlw==

GET
H2 200 18.9c5cc161.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 44 KB
13 KB 19ms
18ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.9c5cc161.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 08:46:52 GMT
content-encoding: gzip
age: 1069218
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 01 Sep 2021 13:56:15 GMT
server: nginx
etag: W/"9628e411ea23d2bee3311d3ce5be363c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: tH6yixdodWlxFA_WVMSHZAGEkCkSqYIj
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bs89-iP4tfrKk91q1pFY4N5SaX8lHeeO7K_ulF1pFshz1DxY_w1UWA==

GET
H2 200 35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 25 KB
8 KB 14ms
14ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:08:17 GMT
content-encoding: gzip
age: 1985933
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 23 Aug 2021 17:42:07 GMT
server: nginx
etag: W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1I09NUqlw54C3qTPS3eShOaQpBS5lcLu
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 75cMyhIe7FtcgZGJ9Ojnvd3wpCjjE46M8diA3YWUPUZ2-2zz3F5f-A==

GET
H2 200 15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 16 KB
5 KB 14ms
14ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449692
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:24 GMT
server: nginx
etag: W/"db60664de2c8d54d23e359c94e68f6ce"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 3Lit_GR0K_e3yyTyyAPf_WyqhFyqI1X7
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QVzH0haN7aVioSqGYKAcgcYtNCzIQqUwu4ZSszN8TDXYDvfrFBmfyw==

GET
H2 200 19.990a7667.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 68 KB
21 KB 15ms
15ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.990a7667.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 03 Sep 2021 14:03:24 GMT
content-encoding: gzip
age: 1050226
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 03 Sep 2021 13:37:01 GMT
server: nginx
etag: W/"e90795967e116591284f1b56d8085a5d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: sqAeBNndNqCDnUDpxtBkko44xwryPo34
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QCQPsqlIlaSadZhiZbZ_CGiUTy4QKR_d-Av1MmW_6FZvg8j_77wRmw==

GET
H2 200 32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 16 KB
6 KB 18ms
17ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:08:17 GMT
content-encoding: gzip
age: 1985933
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 23 Aug 2021 17:42:07 GMT
server: nginx
etag: W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SPqSo.47y7907Wglh2zWsWSyACYHB_Zc
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VEGjpStu_Ins7SeQU8J6lNp5INSqUJH-wl37XILRZED1lwumJMOjBw==

GET
H2 200 22.3cdbe392.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 59 KB
0 22ms
21ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.3cdbe392.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449693
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:24 GMT
server: nginx
etag: W/"7f2ec762df0bb02422b2b6a96490de86"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: y2Fsxlxg91.mo6q6kJR67dQNB9q9Qh.8
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: JB3t3JGCMOBvJbUmOGdeK1DyLwXU7kWMJvrhEk-UhtnBxGWgyRL1nA==

GET
H2 200 10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 91 KB
0 25ms
24ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449693
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:24 GMT
server: nginx
etag: W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: UOl6S4j5SMc3.AEsWYEwY54XYaImySKe
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CvBD7C7YqQ7qB3L2c2JT-LiqHR-lQAgUniIkQueULItHe_f3C-7FUw==

GET
H2 200 9.a48906f3.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 23 KB
7 KB 18ms
17ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.a48906f3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449692
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:26 GMT
server: nginx
etag: W/"60e5547ed381473c15e63274bcd796b6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: gA_0cz7CJfhJ8aNbtPMgs.3Fr8VDJHGb
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HOkxEA9Eeoa1PLKiWrRXdwujydcZFc1WSExr5_50QMntvsP76BpGTQ==

GET
H2 200 12.d1052a14.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 62 KB
0 19ms
18ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/12.d1052a14.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 3449692
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:24 GMT
server: nginx
etag: W/"6f74e88fed60d2dd5a602a0de2bd8452"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _b0FYDX.3mAxA0VaBf8nhWaHS5Vbtsw1
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: prRD2_Ewy05E5ubyaypF0CCbQhupLcPy1462FmgYRIc6EJvm3gM0DA==

GET
H2 200 40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 105 KB
0 28ms
27ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:08:17 GMT
content-encoding: gzip
age: 1985934
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 23 Aug 2021 17:42:08 GMT
server: nginx
etag: W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 9jXV8w0bWzHPQtgsCAjrFrN9PLNAN.Ap
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WZZw2eoz-HIZRMjCqPqU8IAGm0B-bnKk-5ODa6PAU691vs5gWQwI2A==

GET
H2 200 33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 12 KB
0 26ms
25ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:08:17 GMT
content-encoding: gzip
age: 1985934
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 23 Aug 2021 17:42:07 GMT
server: nginx
etag: W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ocjv..MVaCaOGNo5kiC5l3ewWVKjMwbS
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -Gxj9cqshEMuBn-poXoThXxKf6fu9oWKP2VUSl_hP8exs2USER8pQg==

GET 24.1ac10846.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 0
0

GET
H2 200 16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 17 KB
0 30ms
29ms Script
application/javascript 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 23 Aug 2021 18:08:17 GMT
content-encoding: gzip
age: 1985934
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 23 Aug 2021 17:42:07 GMT
server: nginx
etag: W/"b451093ecfaa012f364641010ed13346"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mlbxReFt8YmdLvOZ4ChXgFfj8NP88809
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: PthBclZ5wPW7gQQElCH30Wq6Z27mCaUDKTQyvBa6DBKW20lkcKfgAA==

GET
H2 200 7.e7855ffa.chunk.css
js.driftt.com/core/assets/css/ Frame 0DA2 12 KB
3 KB 30ms
29ms Stylesheet
text/css 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/7.e7855ffa.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 17:56:05 GMT
content-encoding: gzip
age: 1641066
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 27 Aug 2021 16:20:59 GMT
server: nginx
etag: W/"7d15d8ca77c5224990008b95f855f068"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _KkaYuOVnNJgDqYnVHO6FMmLzVtkgHHQ
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Qbmk59SJVcmoez9W1x_8CWSGm0Ob3EBZ7idjVWbr047naVmQEQC-kQ==

GET 7.91ba1517.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 0
0

GET
H2 200 14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 0DA2 24 B
667 B 30ms
29ms Stylesheet
text/css 52.222.186.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.4d9fd880.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.186.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-186-63.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hgzvddcpffbf&region=US&forceShow=false&skipCampaigns=false&sessionId=72fa65ea-79f3-486f-b892-dfbb6817c1ab&sessionStarted=1631728030.804&campaignRefreshToken=978fc976-27ac-43ab-8a94-602418b898df&hideController=false&pageLoadStartTime=1631728028521&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
via: 1.1 42d6fa6bba37b1a120fb1adae0e0e8c8.cloudfront.net (CloudFront)
age: 3449693
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Fri, 06 Aug 2021 18:47:22 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: HAM50-C2
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: t5yS0ZP89U3zf_ATfvryofnzAXFNqmjApI7FaEzHMCq76T4vLt6hWQ==

GET 14.878d84dc.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 0
0

GET 21.0829076b.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 0
0

GET 13.865e8a6f.chunk.js
js.driftt.com/core/assets/js/ Frame 0DA2 0
0

GET 42.84f5886d.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 18.9c5cc161.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 35.3e4eba7e.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 15.8065fdbf.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 19.990a7667.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 32.04864e7d.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 22.3cdbe392.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 10.704ab67c.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 9.a48906f3.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 12.d1052a14.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 40.01f4f7b3.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 33.c1910d43.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 24.1ac10846.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 16.fab21cf4.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 7.e7855ffa.chunk.css
js.driftt.com/core/assets/css/ Frame 0F54 0
0

GET 7.91ba1517.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 0F54 0
0

GET 14.878d84dc.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 21.0829076b.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET 13.865e8a6f.chunk.js
js.driftt.com/core/assets/js/ Frame 0F54 0
0

GET
H2 200 avatar92.jpg
c.disquscdn.com/uploads/forums/524/8537/ Frame 6712 1 KB
2 KB 16ms
16ms Image
image/jpeg 52.222.179.113
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/524/8537/avatar92.jpg?1503943901

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.a394e8c4e3eaa98fc6ab1dfa2e322bd4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.179.113 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-179-113.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://disqus.com/embed/comments/?base=default&f=rapid7&t_i=6130ecaf6316e72fc6dd4c84&t_u=https%3A%2F%2Fwww.rapid7.com%2Fblog%2Fpost%2F2021%2F09%2F02%2Factive-exploitation-of-confluence-server-cve-2021-26084%2F&t_d=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&t_t=Active%20Exploitation%20of%20Confluence%20Server%20CVE-2021-26084%20%7C%20Rapid7%20Blog&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 10 Jul 2021 14:29:01 GMT
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 5800690
x-cache: Hit from cloudfront
content-length: 1323
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Mon, 28 Aug 2017 18:11:42 GMT
server: nginx
etag: "bd78a5b693572c6e236917dfdd5c4d7b"
content-type: image/jpeg
expires: Sun, 10 Jul 2022 14:29:01 GMT
cache-control: max-age=31536000, public, immutable
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: aJ6Ad93axoY4h1TXR4qYOuLaLLKh277_YLf5_FMbVUujfJRDn0uqkw==
x-cache-hits: 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.rapid7.com
URL: https://www.rapid7.com/api/blog/tags

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/24.1ac10846.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/7.91ba1517.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/14.878d84dc.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/21.0829076b.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/13.865e8a6f.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.84f5886d.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/18.9c5cc161.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/19.990a7667.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/22.3cdbe392.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/9.a48906f3.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/12.d1052a14.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/24.1ac10846.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/css/7.e7855ffa.chunk.css

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/7.91ba1517.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/14.878d84dc.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/21.0829076b.chunk.js

Domain: js.driftt.com
URL: https://js.driftt.com/core/assets/js/13.865e8a6f.chunk.js

Verdicts & Comments Add Verdict or Comment

214 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

48 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
info.rapid7.com/	1969-12-31 23:59:59	Name: BIGipServersj_mailtracking_http Value: !87nbX31RzvNEKm67iv4ewrP5TPDRszPdyK/F07lQFMMpSuj6cIxErhmxZd9OARiuVFJAkkcjxwLIX/o=
.info.rapid7.com/	1970-01-19 21:15:29	Name: __cf_bm Value: MKWkTBxzxpmWo6KMh1Md_D3q0f_lonVCk_S9pl6JwT8-1631728026-0-AXVsHUIcLgBphFr1QTYcajunE2ulBupVZa+mHsM+5oJCO+awy9UsIVgeHnEYNFJaPklVMaTyr2oUl/24xRKrJWw=
www.rapid7.com/	1969-12-31 23:59:59	Name: r7-session Value: mqvt44sv0nocwgnlngkqxus3
www.rapid7.com/	1969-12-31 23:59:59	Name: r7-vc Value:
.rapid7.com/	1970-01-20 01:34:40	Name: optimizelyEndUserId Value: oeu1631728028664r0.00773964388229631
.information.rapid7.com/	1970-01-19 21:15:29	Name: __cf_bm Value: dypnZiSEKfzfxiIOl9dm0HUkSffTYAvYR_o3qcOXE_s-1631728028-0-AWbf88OS9jgPYq0TNhhXu91D1h5pQQBJbLigYdG6LRfKTIjM0g8P33qUoIixm9llntyE2ypkN5u4Y29ixsKxdbQ=
.app-sj20.marketo.com/	1970-01-19 21:15:29	Name: __cf_bm Value: JDBeo3iimHm3X5ZvMkKknErTJzwAPUoWh97LQlTXnVI-1631728029-0-AYPWWvtAMfdqok84jBjT2ITS1+rt9v1ZcigSNkraN5v2GgcUJhoxwkQ7LwKvU3sgc5ZL4WGURFekTY3yt5tyYHI=
.rapid7.com/	1970-01-20 06:01:04	Name: r7gdprAll Value: notRequired US
.rapid7.com/	1970-01-20 06:01:04	Name: r7gdprAnalytics Value: notRequired US
.rapid7.com/	1970-01-19 23:25:04	Name: _gcl_au Value: 1.1.1125148112.1631728029
.rapid7.com/	1970-01-20 14:46:40	Name: _ga Value: GA1.2.1065388984.1631728029
.rapid7.com/	1970-01-19 21:16:54	Name: _gid Value: GA1.2.1784728309.1631728029
.rapid7.com/	1970-01-19 21:15:28	Name: _gat_UA-4622520-1 Value: 1
www.rapid7.com/	1970-01-20 06:01:04	Name: d-a8e6 Value: 2b023085-ea6c-4d1e-8cdb-da4e16beeb33
www.rapid7.com/	1970-01-19 21:15:28	Name: s-9da4 Value: 371d0fb9-d026-4b00-8293-58fedffad150
.rapid7.com/	1970-01-20 06:01:04	Name: _biz_uid Value: 9e7e0de41f7d4f6b892f762d53603197
.rapid7.com/	1970-01-19 21:15:29	Name: _biz_sid Value: 2f20f0
.rapid7.com/	1970-01-20 06:01:04	Name: _biz_nA Value: 2
.bizible.com/	1970-01-20 06:01:04	Name: _BUID Value: 9e7e0de41f7d4f6b892f762d53603197
.rapid7.com/	1970-01-20 06:01:04	Name: _biz_pendingA Value: %5B%5D
.rapid7.com/	1970-01-20 06:01:04	Name: _biz_ABTestA Value: %5B1030588531%5D
www.rapid7.com/	1969-12-31 23:59:59	Name: gscs Value: 1631728030.1631728030.1631728030
www.rapid7.com/	1970-01-20 14:46:40	Name: gscv Value: 1631728030.1631728030.1631728030.1
.rapid7.com/	1970-01-19 23:25:04	Name: _fbp Value: fb.1.1631728029701.865585914
.doubleclick.net/	1970-01-19 21:15:28	Name: test_cookie Value: CheckForPermission
.bizibly.com/	1970-01-20 06:01:04	Name: _BUID Value: ea338ebadc7bcad09c91fa5b0f1ee374
.twitter.com/	1970-01-20 14:46:40	Name: personalization_id Value: "v1_gFPRSp+v6UWj7FgA31EZVw=="
.rapid7.com/	1970-01-20 14:46:40	Name: _mkto_trk Value: id:411-NAK-970&token:_mch-rapid7.com-1631728029739-54904
.rapid7.com/	1970-01-20 06:01:04	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.adsrvr.org/	1970-01-20 06:01:04	Name: TDID Value: 934c99ca-67f8-41e8-b020-007491042a32
.adsrvr.org/	1970-01-20 06:01:04	Name: TDCPM Value: CAEYBSABKAIyCwjCiNiq8p78ORAFOAE.
disqus.com/	1970-01-19 21:15:29	Name: __jid Value: 1i26gt916nqdef
.disqus.com/	1970-01-20 06:01:04	Name: disqus_unique Value: 1i26gva16a48oc
.linkedin.com/	1970-01-19 21:58:40	Name: UserMatchHistory Value: AQL2upEgoFERYgAAAXvqkdDxbOh0BtzdzA5Zh-v4n7LkjR1P1OZ2kjIT7UC2mo3jbR2S5DrPs1HsTw
.linkedin.com/	1970-01-19 21:58:40	Name: AnalyticsSyncHistory Value: AQJ4MTu6FCyA6AAAAXvqkdDxXMnHXGig706EpR3KyxwejpulvAGMssL3L_gSlNGCaEpQt776MFOo83XCL1TKew
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:47:21	Name: bcookie Value: "v=2&ae038089-629b-4272-8c83-35e75501a921"
.linkedin.com/	1970-01-19 21:16:54	Name: lidc Value: "b=TGST00:s=T:r=T:a=T:p=T:g=2672:u=1:x=1:i=1631728029:t=1631814429:v=2:sig=AQFJ6U3aeE5tri4R2MLX14QVplFA1SCE"
ws.sessioncam.com/	1969-12-31 23:59:59	Name: sc.ASP.NET_SESSIONID Value: uppjqmlu1a1yqqmasth2nwvc
www.rapid7.com/	1969-12-31 23:59:59	Name: sc.ASP.NET_SESSIONID Value: uppjqmlu1a1yqqmasth2nwvc
s.getsmartcontent.com/	1970-01-19 21:25:32	Name: AWSALBTGCORS Value: KliCoFP2M0qQtqZ+pv3xukDOXogflaY0NjlHsBfDlFZzpIJYM7i4+ytejbQMQ8MOc6gK+MHIxAcVMG9p8BgXFuj8SKPJAvGE3INuTv7HUM03CpwwKJStisUEVA0yLz4ISTV38UgKOyLX9TFykfrHB31xhvETGvoIQ+k0AyxxBT1z
s.getsmartcontent.com/	1970-01-19 21:25:32	Name: AWSALBCORS Value: 244hCcsgCmYjmFvg/OKw5B83OlfRKp8l92TRlSkCJ+IfQwko+stQfFVido7IxaoGgjgWZo7zt2o2YfXUzGqzDAYtTPkgyZ+BrOaEGN3oBTXfyoYry5i3M8Ulvhr/
s.getsmartcontent.com/	1970-01-20 14:46:40	Name: gsci Value: p1p1swrngpqqdywppwalh4bzqk8ljgb5
www.rapid7.com/	1970-01-20 14:46:40	Name: gsci Value: 7c82adb6c554c96d00789a4d845f8665aa1dcde7
www.rapid7.com/	1970-01-20 06:01:04	Name: sc.UserId Value: 9e9770fe-736f-4293-a9a8-b66e09136060
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:47:21	Name: bscookie Value: "v=1&202109151747103d05e831-1a5a-4932-83bb-4eb94bbcf790AQH0s2LFourrgFq8mtmdwd2YpbeaUfjZ"
.google.com/	1970-01-20 01:38:59	Name: NID Value: 511=kfZOy53Wntuz2NsyLgb_fXXMw0jdo0zYAfbIGGJruqQPa6F6Owx-e_Qhw2braMz5LoE_6r48U36MttAqJ_4hNMrw9n69HGoHbh3-RWCx3L9GHeP07RXdhdsNoMtDqvba8AUZ1zHFajy0rCvK08QFzsqx2AidMk1u0kDw5QwhOB0

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://d2oh4tlt9mrke9.cloudfront.net/Record/js/sessioncam.recorder.js(Line 8) Message: Unrecognized feature: 'SessionCamAutoPlayautoplay'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

411-nak-970.mktoresp.com
a13222550.cdn.optimizely.com
accounts.google.com
analytics.twitter.com
apis.google.com
app-sj20.marketo.com
blog.rapid7.com
c.disquscdn.com
cdn.bizible.com
cdn.bizibly.com
cdn.getsmartcontent.com
cdn.jsdelivr.net
cdn.optimizely.com
cdn.rawgit.com
connect.facebook.net
d2oh4tlt9mrke9.cloudfront.net
disqus.com
dpx.airpr.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
info.rapid7.com
information.rapid7.com
js.driftt.com
logx.optimizely.com
match.adsrvr.org
munchkin.marketo.net
platform.twitter.com
px.ads.linkedin.com
px.airpr.com
rapid7.disqus.com
s.getsmartcontent.com
secure.adnxs.com
snap.licdn.com
ssl.gstatic.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
vidassets.terminus.services
ws.sessioncam.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.rapid7.com
js.driftt.com
www.rapid7.com
104.16.93.80
104.17.73.206
104.17.74.206
104.244.42.3
104.244.42.5
108.174.11.69
13.107.42.14
142.250.180.14
142.250.187.206
142.250.200.13
142.250.200.36
151.101.0.134
151.101.112.134
151.101.113.229
151.101.12.157
151.139.237.219
152.195.15.58
172.217.169.35
172.217.169.74
172.217.169.8
18.194.85.80
184.30.21.40
184.30.24.149
185.60.218.24
185.60.218.35
192.28.147.68
216.58.212.194
216.58.213.2
216.58.213.3
23.45.104.85
23.67.128.30
34.232.196.113
35.171.170.135
35.174.150.252
37.252.173.27
52.222.179.113
52.222.186.16
52.222.186.59
52.222.186.63
52.222.190.34
54.230.206.112
54.230.206.61
74.125.206.156
76.223.111.131
89.187.169.47
93.184.220.66
026c5db877da222d2316bf1197b8947a96c7623d51a4d462c91bf927dece3429
0a92d224a35aab3de7aa661df5c11272eea7f7fc8065230cf6b221a2e4961c31
0e4b8d24a97bf67e39fcebe6b138ff9db6a5a01b38b3f2d2d2ab0ee90f44a729
0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14c8c62dc692fd8faa04434e3fed25e7c23d596b732f9db88f6e9f9ff5dfa61c
173766c85b077cac6612a19f37dfd086d800fe1438ba4e887a81848c6d0a8570
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
264bca52ed6efc10977f418f888cc00cc97a6c3085005e701e390df749062f41
26896559e0cc85fb441792c86279304693546375f1144040e46cd910362b8e43
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
2dafb4c739fbf5d52042d02b5346f60121ff607b6175e44bb5af8a4d4d5141fb
2dd8e940e47cb067ab22aadfe8ccc4f744ddd724bfac7f058915413ae8974909
2f6f8ef5cbba4c5c44c2612efc7f64e4d8398ecd6096e3a16e144058148837ca
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
3329931cffa7e52ea5af6116d5dbfd83b6c0500496864a89b6d0fb1d25f55ebd
335b59e615135313a66319e641cdad6ac3489a600e04d4181c859699bed4babe
3a50103004f1b8789103e6f8ba96dd51f2c071a2b7a71dcc1f33f9c8de33382f
3ec0b189cbac8dfe42e34b2ffea5d7f632dc0c0b0ddea73d57c2d48ae59f1137
443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0
44c8661f02d0547ad8bc6deb777a16c9f8bd783b5d6eb4a75eeaffed8e570042
44fc485dc1ebae37e5b965b0295dd07e645a2a4065a68b1c2416d0911ac92007
45341170f1b5ef36db1b2393b3f7669e668d0e2cb84f2aca93f3e7ad3ddb34e3
4769d42009cae6acf42fdaf1604feff36f8a5bb6c37c049a035fbc9a6802766c
4b20b79d8999b2516d971378ec1b7a3bb36108838a22d3c6f2e1d9a47dbe7f08
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
529b9c583e6cf8da02c9cadf8c38b5714198f0fde2dcde01da2d5ee681228738
5533ce540540315ff7caca642d2c348d516821c569688aabe0c4b1ce8ce81d50
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
59611414404075b2acabb597d983e323859932efab7ef0cdd45cb25b5bc87c86
5d39ff82989d5d48695a4c9ef8883fbbb9f68ee83b7bc771b68d18281548889a
605041ae1215674abf88e3eecd5d416a9de33e80d64ac6341fa06329ebe8f347
6068f86ff5e6d3a3e100e95fd0ab03a5fb9ebfca9386b2c0ee131361a62526c2
652667975f4e5bc9b68363e77211b87c5739566baed70c21fe835d7969995478
6e7528c07c5c49c54d62806dc1d5413526a338a085df22b73cda2362013008b3
6ea2a98492ef856efe0731923957339e2920c0430dae00f289eb98c8a8b54ec3
71f6ddf045f219694a515f6a9cbd397947150d872f33c9f03b7629d6f8b45c6d
7285646ea1d6480a26b5c3d66f75edac636a664b9ef84bbd5fb63122065bb668
7a1fb34bc02c96391342ed535200c029f5a03f2a9a2ca99d44cb32994f26fcf1
7d3b9af0b596b6cee1705514cfc32bf8b2d87a153591c3f03f9e664827cf8a24
7d7f64f89927a0c843f4ae2f589c776643aa23ead9ce829bb39c8f3a40d4955d
7e4db0925a0f8500f77e268985894d2a77a600786d4c6eb0b8cd84781cb05743
7e8ee8f9d56ca7e35629a7c16b9f1c09fbb1e7d19fe922833a2f4edec48bfeea
8227a862b924b10dd6f1937cc73288d73111599d2968728fc762baf159cc3e78
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
861402dadc9f3e8a4911565d1730f4112956f54c4808c10836b330de177d3e8e
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
8dedd8362bb42b3e64a65b7bc88013fd669da19133f0f63e930f0c8c86681b7e
8f0a8aeb7295594ad2a432cb24687f3bc9eef6837443f73a5aa7aeea7417e268
8f5315ed9f5e070e85a60e405d9aac92286319c20c2fcb39cc2d6c01090c652d
8f572e55d1260c84e42865af82f2fe8572c8544b29d9cb887c3dc405e3718ccf
8f89cb57447f4e42714685a45fe3feb68d6a09323d228be12a7529bdb7416325
948ef5fb4409b53579bee0c26ee642ed9fbc77f0e279d5aed6b8cfdff8f3182a
951ad1312a6cf6133f66cf429454c360b0fcbd606f12b3b261128c669c6e61eb
97a641fead8dfd832fc2a2f271e9e498f2ced8e32cc335f5b19a7a51e35d4b2c
9904ff6810e17c1ffc108bf92dbee7f8a6318d0c8c58c1d70555d0a3945fb9da
99fa5a280296b5fc7b63433ee121a359fc68c4a37f04a87d363e751164b96ff1
a1e5e79263b670b9f325e1b03db57992cc05c556289f2ea31b9393f265364263
a2ac7d27583731c7b8390949ca3884a647f16f7e499fef291bc73881ac4400b9
a4d6553c8eda4f55ee8692903953e7cdbb4e4ea5418db70f796b7fe68675d592
a7bb5549e621d9880bf17153afe6929624427fb38e2d7ced1f9df37794abd61d
a8aa8c94d42d57cd377de305aed2169249f6f6bd2fd31b5f1d2671cc1502a1d1
ac2a270e60c15fdaaf9957f52bab00aaefd32ac7782a62b141c66c2ce3f6369c
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad859925a743729da634c6989f2ad78fd7b27a4096081619937d4fc14c068ec9
ad86bd1c6c30f9d98ce71fe5d96cfe5ea52e4b5aca3eda1dc6e963be44ac3afe
ae40a082914cb6ab8c858235a780dd1b9c3fd5e1a584b9eaf10c8115539993a9
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1aad362c22adc49a9d6ec917da6601d8982cd44a7a91a5e6d97bdf84e75ba19
b74154f3076c165261c6f878c19f1f3de6b261e77f301212a32a5634a71b47cd
b82862f8e93a7749b8a7a1a5f718b84599f3cc191e89564f7d23d1e0c6fd946d
ba0663ff1abcd5e2909fbf118f907f4b1c7d2b36cd0ddc29fb9294af37bab918
c65ffa9b8e350747e5dec76cbf16729482008fa1b57be07c53d3c509bebcfadd
c7bc8a2914e073cc57c8e2d8530cf1cfcbfa05c48663224d30e53fdb6b700368
c89a8bee77d21587af1a9e0dcd26a779b62436084eaf136c354ff1bf39f2c280
c988151143acb47893d98e3bff41fb02b952e55b9be4aed9ecc79315964324d8
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
ce48f94ab14e16d6a7140b1b813874847f20ee5e94a1642b2a77c20ead3e55d2
cf7ffb56cda8d58d7a7783e442a5729573c7e5d7098785c9a6cb382f2a772b56
cffd0317df77f6cca959bf9cf11db68960d73262907aaaae3a9b8a2e5f565316
daaa4757566b582fa2e3bfb4c49a0996d279a0e8deaa2ff1b15d582cacb357cb
db320734b1ceba11653b78882616887e436b37fb99bebbd9ec6d388642550a6a
de22a1f465480545ea9595d61c16ad21ad40e6b2509cca0e76d2601980e52988
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dea35a199ac7d32e9d486b6779d82202a3abdee5a8fb1bb2929ba8ab3bba96ec
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f37423bbf836a90c48b4bb4c13fcc828e2664540cb97fa8ad135d6e26e50eb
e96622a932374b7be800e0c4d622609002e8a63087f0dd88fb13816b874cd16e
e9dddbbd48a572a38b0ae1c9452f38616ce7b949492856ddf39de557d9e7c4cb
ee61d0d70457124d456851d06fbc7de0204b99c7b930305cd7bc26bfccd25c5d
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f00e805fa94ee0f20b2c0f3c3f3a1f1c617d5735d93fd78e30047a04c976ac25
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f6a7ad54334944eee92788a72ddf72f0e4f6f8d32b6eb5f9442d6103eddf0a27
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

www.rapid7.com Open in urlscan Pro 52.222.186.59 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

172 Requests

85 %HTTPS

0 %IPv6

33 Domains

47 Subdomains

43 IPs

5 Countries

2583 kBTransfer

7544 kBSize

48 Cookies

18 Outgoing links

Page URL History

Redirected requests

172 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.rapid7.com Open in urlscan Pro
52.222.186.59 Public Scan

Screenshot
Live screenshot

Full Image

172
Requests

85 %
HTTPS

0 %
IPv6

33
Domains

47
Subdomains

43
IPs

5
Countries

2583 kB
Transfer

7544 kB
Size

48
Cookies

172 HTTP transactions
0 data transactions