Submitted URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Effective URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022...
Submission: On September 29 via api from SG — Scanned from DE

Summary

This website contacted 49 IPs in 7 countries across 37 domains to perform 217 HTTP transactions. The main IP is 141.193.213.21, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is www.menlosecurity.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on July 25th 2022. Valid for: a year.
This is the only time www.menlosecurity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
7 104.17.71.206 13335 (CLOUDFLAR...)
46 141.193.213.21 209242 (CLOUDFLAR...)
10 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
5 2a00:1450:400... 15169 (GOOGLE)
9 104.103.80.163 16625 (AKAMAI-AS)
1 199.232.136.157 54113 (FASTLY)
1 65.9.66.34 16509 (AMAZON-02)
1 142.250.186.98 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
2 2a03:2880:f01... 32934 (FACEBOOK)
2 92.123.8.217 16625 (AKAMAI-AS)
1 2606:4700::68... 13335 (CLOUDFLAR...)
6 52.41.193.136 16509 (AMAZON-02)
1 2600:9000:214... 16509 (AMAZON-02)
6 54.175.93.244 14618 (AMAZON-AES)
62 143.204.215.107 16509 (AMAZON-02)
1 2600:9000:249... 16509 (AMAZON-02)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 199.232.18.109 54113 (FASTLY)
3 3 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 185.89.210.101 29990 (ASN-APPNEX)
1 2001:4860:480... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 13.32.27.21 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
10 18.66.97.13 16509 (AMAZON-02)
1 206.19.49.24 17225 (ATT-CERFN...)
1 104.244.42.133 13414 (TWITTER)
1 192.28.147.68 15224 (OMNITURE)
1 143.204.215.65 16509 (AMAZON-02)
2 35.158.89.114 16509 (AMAZON-02)
1 54.73.164.173 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 54.246.176.35 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 3 54.162.244.84 14618 (AMAZON-AES)
1 44.205.92.219 14618 (AMAZON-AES)
1 66.155.71.25 13768 (COGECO-PEER1)
1 35.244.174.68 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
4 3.94.218.138 14618 (AMAZON-AES)
2 50.16.7.188 14618 (AMAZON-AES)
217 49
Apex Domain
Subdomains
Transfer
62 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5169
732 KB
53 menlosecurity.com
pages.menlosecurity.com
www.menlosecurity.com
info.menlosecurity.com
1 MB
10 fullcircleinsights.com
st.fullcircleinsights.com — Cisco Umbrella Rank: 74216
12 KB
10 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 419
157 KB
9 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6427
c.6sc.co — Cisco Umbrella Rank: 9743
b.6sc.co — Cisco Umbrella Rank: 4593
13 KB
7 hushly.com
app.hushly.com — Cisco Umbrella Rank: 67739
hubfront.hushly.com — Cisco Umbrella Rank: 210837
219 KB
6 drift.com
metrics.api.drift.com — Cisco Umbrella Rank: 5722
bootstrap.api.drift.com — Cisco Umbrella Rank: 6032
456 B
6 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 3209
9 KB
5 clickagy.com
tags.clickagy.com — Cisco Umbrella Rank: 6404
aorta.clickagy.com — Cisco Umbrella Rank: 1441
hemsync.clickagy.com — Cisco Umbrella Rank: 6012
16 KB
5 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 595
script.hotjar.com — Cisco Umbrella Rank: 767
vars.hotjar.com — Cisco Umbrella Rank: 889
in.hotjar.com — Cisco Umbrella Rank: 1682
ws30.hotjar.com — Cisco Umbrella Rank: 60702
70 KB
5 gstatic.com
fonts.gstatic.com
116 KB
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 365
www.linkedin.com — Cisco Umbrella Rank: 625
px4.ads.linkedin.com — Cisco Umbrella Rank: 6161
4 KB
4 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 41
3 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 28
20 KB
3 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 79
googleads.g.doubleclick.net — Cisco Umbrella Rank: 42
1 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 11276
451 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 114
222 B
2 google.de
www.google.de — Cisco Umbrella Rank: 6301
564 B
2 google.com
region1.analytics.google.com — Cisco Umbrella Rank: 5431
www.google.com — Cisco Umbrella Rank: 2
852 B
2 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 14773
apt.techtarget.com — Cisco Umbrella Rank: 19277
2 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 2843
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 151
111 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 64
158 KB
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 555
98 B
1 sitescout.com
pixel-sync.sitescout.com — Cisco Umbrella Rank: 573
191 B
1 mktoresp.com
281-owv-899.mktoresp.com
318 B
1 t.co
t.co — Cisco Umbrella Rank: 495
376 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 428
711 B
1 vimeocdn.com
extend.vimeocdn.com — Cisco Umbrella Rank: 8841
6 KB
1 cloudfront.net
d2i34c80a0ftze.cloudfront.net
11 KB
1 zoominfo.com
ws.zoominfo.com — Cisco Umbrella Rank: 4853
2 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 758
3 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 129
16 KB
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 624
15 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 681
395 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 208
7 KB
0 twitter.com Failed
analytics.twitter.com Failed
217 37
Domain Requested by
62 js.driftt.com pages.menlosecurity.com
js.driftt.com
46 www.menlosecurity.com pages.menlosecurity.com
www.menlosecurity.com
10 st.fullcircleinsights.com d2i34c80a0ftze.cloudfront.net
10 cdn.cookielaw.org www.menlosecurity.com
cdn.cookielaw.org
7 b.6sc.co www.menlosecurity.com
6 tags.srv.stackadapt.com pages.menlosecurity.com
tags.srv.stackadapt.com
6 app.hushly.com pages.menlosecurity.com
app.hushly.com
6 info.menlosecurity.com www.menlosecurity.com
info.menlosecurity.com
5 fonts.gstatic.com fonts.googleapis.com
4 metrics.api.drift.com js.driftt.com
4 fonts.googleapis.com www.menlosecurity.com
info.menlosecurity.com
3 aorta.clickagy.com 2 redirects tags.clickagy.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 bootstrap.api.drift.com js.driftt.com
2 epsilon.6sense.com j.6sc.co
2 www.facebook.com www.menlosecurity.com
2 www.google.de www.menlosecurity.com
2 stats.g.doubleclick.net www.googletagmanager.com
www.google-analytics.com
2 px.ads.linkedin.com 2 redirects
2 munchkin.marketo.net pages.menlosecurity.com
munchkin.marketo.net
2 connect.facebook.net pages.menlosecurity.com
connect.facebook.net
2 www.googletagmanager.com www.menlosecurity.com
www.googletagmanager.com
1 www.google.com www.menlosecurity.com
1 id.rlcdn.com www.menlosecurity.com
1 pixel-sync.sitescout.com www.menlosecurity.com
1 hemsync.clickagy.com tags.clickagy.com
1 tags.clickagy.com ws.zoominfo.com
1 ws30.hotjar.com script.hotjar.com
1 in.hotjar.com script.hotjar.com
1 vars.hotjar.com static.hotjar.com
1 281-owv-899.mktoresp.com munchkin.marketo.net
1 t.co www.menlosecurity.com
1 apt.techtarget.com www.menlosecurity.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 script.hotjar.com static.hotjar.com
1 region1.analytics.google.com www.googletagmanager.com
1 c.6sc.co j.6sc.co
1 secure.adnxs.com j.6sc.co
1 px4.ads.linkedin.com www.menlosecurity.com
1 www.linkedin.com 1 redirects
1 extend.vimeocdn.com www.googletagmanager.com
1 trk.techtarget.com pages.menlosecurity.com
1 d2i34c80a0ftze.cloudfront.net www.googletagmanager.com
1 hubfront.hushly.com pages.menlosecurity.com
1 ws.zoominfo.com pages.menlosecurity.com
1 snap.licdn.com www.googletagmanager.com
1 www.googleadservices.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 j.6sc.co pages.menlosecurity.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 cdnjs.cloudflare.com www.menlosecurity.com
1 pages.menlosecurity.com
0 analytics.twitter.com Failed www.menlosecurity.com
217 54
Subject Issuer Validity Valid
pages.menlosecurity.com
Cloudflare Inc ECC CA-3
2022-05-02 -
2023-05-02
a year crt.sh
www.menlosecurity.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-25 -
2023-07-01
a year crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3
2022-05-01 -
2023-05-01
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh
info.menlosecurity.com
Cloudflare Inc ECC CA-3
2022-04-30 -
2023-04-30
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-09-05 -
2022-11-28
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2022-09-05 -
2022-11-28
3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3
2022-01-12 -
2023-01-12
a year crt.sh
*.gstatic.com
GTS CA 1C3
2022-09-12 -
2022-12-05
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
*.hotjar.com
Amazon
2021-11-25 -
2022-12-23
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2022-09-05 -
2022-11-28
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-07-08 -
2022-10-06
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
zoominfo.com
Cloudflare Inc ECC CA-3
2022-05-04 -
2023-05-04
a year crt.sh
*.hushly.com
Amazon
2022-08-15 -
2023-09-12
a year crt.sh
*.srv.stackadapt.com
Amazon
2021-11-09 -
2022-12-07
a year crt.sh
drift.com
Amazon
2022-08-24 -
2023-09-21
a year crt.sh
*.cloudfront.net
Amazon
2022-02-01 -
2023-01-31
a year crt.sh
*.vimeocdn.com
GlobalSign Atlas R3 DV TLS CA 2022 Q2
2022-05-17 -
2023-06-18
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-09-05 -
2022-11-28
3 months crt.sh
www.google.de
GTS CA 1C3
2022-09-12 -
2022-12-05
3 months crt.sh
aws-st.fullcircleinsights.com
Amazon
2022-06-13 -
2023-07-11
a year crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-13 -
2022-11-12
a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
*.6sense.com
Amazon
2022-05-31 -
2023-06-29
a year crt.sh
*.clickagy.com
Amazon
2021-12-15 -
2023-01-12
a year crt.sh
www.google.com
GTS CA 1C3
2022-09-05 -
2022-11-28
3 months crt.sh
*.google.de
GTS CA 1C3
2022-09-12 -
2022-12-05
3 months crt.sh

This page contains 6 frames:

Primary Page: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Frame ID: 36D6AA473067B6E0C8FBAD888F8D5720
Requests: 141 HTTP requests in this frame

Frame: https://info.menlosecurity.com/index.php/form/XDFrame
Frame ID: 78056E799310E5CD2A6697BF16A2415A
Requests: 2 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html
Frame ID: 343A2CAFA65423E22B142E3469B8C960
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 4BB8BFAD3F3CEF5A534F5D60D977EBB6
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Frame ID: 8A55CB668E276DB8A0F3AF6E4A1F6D78
Requests: 32 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Frame ID: 5B95DFC1CF786595C5FF2F7120CFC2CC
Requests: 32 HTTP requests in this frame

Screenshot

Page Title

An anatomy of HEAT attacks used by Qakbot campaigns - Blog | Menlo SecurityBack ButtonFilter Button

Page URL History Show full URLs

  1. https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xv... Page URL
  2. https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=conte... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • lodash.*\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

217
Requests

98 %
HTTPS

43 %
IPv6

37
Domains

54
Subdomains

49
IPs

7
Countries

3026 kB
Transfer

7730 kB
Size

44
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU= Page URL
  2. https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 86
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3 HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1664418000911%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%252Fblog%252Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%252F%253Futm_campaign%253Dcontentnewsletter-sep2022%2526utm_medium%253Demail%2526utm_source%253Doutboundemail%2526mkt_tok%253DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&liSync=true&e_ipv6=AQLaCN6bur4tEwAAAYOHCzG3tMdq_q-YyI0-kn5pDFdvPYvvxZZ8B1RpquT_ZNYyS1SzMkx-mDw0
Request Chain 126
  • https://aorta.clickagy.com/pixel.gif?clkgypv=jstag HTTP 302
  • https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
Request Chain 127
  • https://aorta.clickagy.com/liveramp_redir HTTP 302
  • https://id.rlcdn.com/711861.gif

217 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
pages.menlosecurity.com/
658 B
1 KB
Document
General
Full URL
https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'self'; img-src 'self';script-src 'self' 'sha256-/YnUXDg3CeAuS43OqfDJbQ2/MHKriaB/H+fh1NJcllE=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private, no-cache, no-store, max-age=0
cf-cache-status
DYNAMIC
cf-ray
75213caf3f5a9bbe-FRA
content-security-policy
default-src 'self'; img-src 'self';script-src 'self' 'sha256-/YnUXDg3CeAuS43OqfDJbQ2/MHKriaB/H+fh1NJcllE=';object-src 'none';form-action:'none';frame-src:'none'
content-type
text/html;charset=UTF-8
date
Thu, 29 Sep 2022 02:19:59 GMT
referrer-policy
strict-origin
server
cloudflare
x-frame-options
SAMEORIGIN
x-request-id
d16fa82b7edd4d3c
Primary Request /
www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/
108 KB
22 KB
Document
General
Full URL
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / WP Engine
Resource Hash
1ab40eecc07bcbd5e811b6394d9be884a3a8e5fe951f94b7489d5a9ae7452e32
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://pages.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75213cb0f9ecbbfd-FRA
content-encoding
br
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-type
text/html; charset=UTF-8
date
Thu, 29 Sep 2022 02:20:00 GMT
link
<https://www.menlosecurity.com/wp-json/>; rel="https://api.w.org/" <https://www.menlosecurity.com/wp-json/wp/v2/posts/4681>; rel="alternate"; type="application/json" <https://www.menlosecurity.com/?p=4681>; rel=shortlink
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains;
vary
Accept-Encoding Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-pass-why
custom-path
x-pingback
https://www.menlosecurity.com/xmlrpc.php
x-powered-by
WP Engine
OtAutoBlock.js
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/
12 KB
3 KB
Script
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/OtAutoBlock.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c9f4550700e5b31a1b49eba49ed6962e0775bcb1beeae987d0968f273a35effd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
TV0+ku1RWSTv6i4UVe9r6A==
age
2591
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3051
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 22:17:52 GMT
server
cloudflare
etag
0x8DA9DB1752A3D74
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
eaa17447-901e-0035-4ebd-cf76b3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb66f2b9b64-FRA
expires
Thu, 29 Sep 2022 06:20:00 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/
21 KB
8 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
zvDmpz9S9y5z1XhncmOZ/w==
age
3612
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
7151
x-ms-lease-status
unlocked
last-modified
Wed, 28 Sep 2022 12:10:07 GMT
server
cloudflare
etag
0x8DAA14A6206707D
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
a96b03fa-901e-0035-234c-d376b3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb66f2d9b64-FRA
lodash.min.js
cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/
18 KB
7 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/lodash.js/0.10.0/lodash.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
536711
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6419
last-modified
Mon, 04 May 2020 16:12:02 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ed2-464d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=19pgC8lWBtyjvufJzpiQpJYCmiJ8YJFaEa87ArW8l%2B2PzILYKf6gyq3aIHsAYqqiGZgRqQzQutsN4Up8SP9u5teydJcxtGeZwsLIx4WFE5qwBeY3kl8V4Pz1qfwwR1IWZyUnDRCR8sYOEnxi5%2Fm1m42o"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
75213cb669559b7c-FRA
expires
Tue, 19 Sep 2023 02:20:00 GMT
autoptimize_cc770a94768f89fab5a217c4ee451b43.css
www.menlosecurity.com/wp-content/cache/autoptimize/1/css/
497 KB
73 KB
Stylesheet
General
Full URL
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2fdc6ebde3de6f6c81c8051a259c52dcb6145ea0e35b85e32bc208cb03cf795c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
149706
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 21 Sep 2022 18:30:27 GMT
server
cloudflare
etag
W/"632b5843-7c53b"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb64f5abbfd-FRA
dashicons.min.css
www.menlosecurity.com/wp-includes/css/
58 KB
35 KB
Stylesheet
General
Full URL
https://www.menlosecurity.com/wp-includes/css/dashicons.min.css?ver=6.0.2
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
341867
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 03 Mar 2021 21:16:22 GMT
server
cloudflare
etag
W/"603ffca6-e688"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb64f5cbbfd-FRA
jquery.min.js
www.menlosecurity.com/wp-includes/js/jquery/
87 KB
31 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
149706
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 10 Mar 2021 15:07:24 GMT
server
cloudflare
etag
W/"6048e0ac-15db1"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb64f5dbbfd-FRA
icon-search.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/
384 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-search.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364285
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-180"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70aba9182-FRA
icon-close.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/
577 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/temp/icon-close.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364285
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-241"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70abb9182-FRA
Qakbot_blog_new.jpg
www.menlosecurity.com/wp-content/uploads/2022/08/
67 KB
68 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/Qakbot_blog_new.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c49d9c346ac743df2351f62a73c3087dd91b1f51c86f6a824b2944394e04d92
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
140085
cf-polished
origSize=79729, status=webp_bigger
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
68470
cf-bgj
imgq:100,h2pri
last-modified
Fri, 26 Aug 2022 19:59:53 GMT
server
cloudflare
etag
"63092639-13771"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb70abc9182-FRA
email-decode.min.js
www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
870 B
Script
General
Full URL
https://www.menlosecurity.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 26 Sep 2022 11:11:52 GMT
server
cloudflare
etag
W/"633188f8-4d7"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
75213cb69a639182-FRA
expires
Sat, 01 Oct 2022 02:20:00 GMT
forms2.min.js
info.menlosecurity.com/js/forms2/js/
208 KB
69 KB
Script
General
Full URL
https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 23 Sep 2022 04:00:35 GMT
server
cloudflare
age
4065
etag
"1e609b1-33e51-5e9503857f309"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
75213cb6d945694c-FRA
expires
Thu, 29 Sep 2022 06:20:00 GMT
regenerator-runtime.min.js
www.menlosecurity.com/wp-includes/js/dist/vendor/
6 KB
4 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
1526
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 11 Apr 2022 12:04:30 GMT
server
cloudflare
etag
W/"6254194e-194b"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb6aa759182-FRA
wp-polyfill.min.js
www.menlosecurity.com/wp-includes/js/dist/vendor/
19 KB
8 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
493028
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 11 Apr 2022 12:04:30 GMT
server
cloudflare
etag
W/"6254194e-4ac6"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb6faaa9182-FRA
dom-ready.min.js
www.menlosecurity.com/wp-includes/js/dist/
498 B
2 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/dom-ready.min.js?ver=d996b53411d1533a84951212ab6ac4ff
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
166c7c3bb5f76f977a9f2a5490589b3466374eb2b3f064802e56f08bad71fbf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364285
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 11 Apr 2022 12:04:30 GMT
server
cloudflare
etag
W/"6254194e-1f2"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb6faab9182-FRA
hooks.min.js
www.menlosecurity.com/wp-includes/js/dist/
5 KB
3 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/hooks.min.js?ver=c6d64f2cb8f5c6bb49caca37f8828ce3
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
145199
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 11 Apr 2022 12:04:30 GMT
server
cloudflare
etag
W/"6254194e-132e"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70ab69182-FRA
i18n.min.js
www.menlosecurity.com/wp-includes/js/dist/
10 KB
5 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/i18n.min.js?ver=ebee46757c6a411e38fd079a7ac71d94
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dc4b29dd0acbed77ec2fd81036c33efd4ab5989e8182705a30615a00a0117f7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
17564
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Tue, 12 Apr 2022 15:12:47 GMT
server
cloudflare
etag
W/"625596ef-27ee"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70ab79182-FRA
a11y.min.js
www.menlosecurity.com/wp-includes/js/dist/
2 KB
2 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-includes/js/dist/a11y.min.js?ver=a38319d7ba46c6e60f7f9d4c371222c5
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5df2942db2352e49e00bcf3393b875a71d0acee986e48fbdcc5879846f5c3689
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
493028
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 11 Apr 2022 12:04:30 GMT
server
cloudflare
etag
W/"6254194e-9cc"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70ab89182-FRA
autoptimize_b8b6ea80717e90323b072574f4f1f9b5.js
www.menlosecurity.com/wp-content/cache/autoptimize/1/js/
285 KB
79 KB
Script
General
Full URL
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_b8b6ea80717e90323b072574f4f1f9b5.js
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4611e98122a2c3ddb76f6e0d3e88d1fdeee2844edb65d1a4e03aa1335c56a901
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
1524
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Wed, 21 Sep 2022 13:20:23 GMT
server
cloudflare
etag
W/"632b0f97-4759e"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb70abd9182-FRA
1a750de4-f18f-43d4-8b13-4ead3aa824f4.json
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/
4 KB
2 KB
XHR
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/1a750de4-f18f-43d4-8b13-4ead3aa824f4.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7241e72a9b6c21a28ce6531b73eed7bd11ca1bc737d88f86d74bda1682b4a123
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
0ARsqMrhy93oIwoj9vs61g==
age
4065
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
1550
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 22:17:52 GMT
server
cloudflare
etag
0x8DA9DB174EAF32B
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
867b5c7e-701e-013b-33ac-cfdced000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb6aab09164-FRA
expires
Thu, 29 Sep 2022 06:20:00 GMT
gtm.js
www.googletagmanager.com/
245 KB
83 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
da9a95d38c299c2e7c054de1fdca92d2daab3e719b7bbeb534c70d71e1bfce3f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84950
x-xss-protection
0
last-modified
Thu, 29 Sep 2022 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 29 Sep 2022 02:20:00 GMT
css2
fonts.googleapis.com/
10 KB
738 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ea6028aa03c2eda8725a67ffaff79e8498b464975d8a1744f983d9809c6810e5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 29 Sep 2022 02:20:00 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Sep 2022 02:20:00 GMT
css2
fonts.googleapis.com/
4 KB
709 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 29 Sep 2022 01:03:17 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Sep 2022 02:20:00 GMT
css2
fonts.googleapis.com/
4 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e87a8ee30b7f3e1fd90688380586a85641bc7a432e83be99cce7526e5f702136
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 29 Sep 2022 01:00:25 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Sep 2022 02:20:00 GMT
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/
201 B
395 B
XHR
General
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2962 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
028681bcca47845bfbff40c0138bbc79bf216afb3b6ab233647f63889548b9ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
75213cb6eaac9b34-FRA
access-control-allow-headers
Content-Type
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202209.1.0/
376 KB
90 KB
Script
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
229oLfugqvtMNLM3e0uPaA==
age
6352
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
91423
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 06:42:28 GMT
server
cloudflare
etag
0x8DA9D2EC8A804AD
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
90cd54b6-d01e-0076-5718-cf5c5a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb71fec9b64-FRA
logo.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
5 KB
3 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364278
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-134c"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb71ac49182-FRA
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 23 Sep 2022 13:27:29 GMT
x-content-type-options
nosniff
age
478351
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 23 Sep 2023 13:27:29 GMT
arrow-dropdown.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
207 B
1 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/arrow-dropdown.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364277
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-cf"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb71ac69182-FRA
zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v14/
18 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/ibmplexsans/v14/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=IBM+Plex+Sans:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fcecb97c12786d7a9387a81e74e4179790fd84425c9c75be1aec3aed645bf6e2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 22 Sep 2022 03:39:39 GMT
x-content-type-options
nosniff
age
600021
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18000
x-xss-protection
0
last-modified
Tue, 26 Apr 2022 15:46:52 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 22 Sep 2023 03:39:39 GMT
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v28/
45 KB
46 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v28/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Raleway:wght@300;400;600;700;800;900&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Mon, 26 Sep 2022 21:06:52 GMT
x-content-type-options
nosniff
age
191588
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46524
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:58:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Sep 2023 21:06:52 GMT
fa-solid-900.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/
76 KB
78 KB
Font
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
1524
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
78196
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
"61f2cdf1-13174"
x-frame-options
DENY
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb71ac89182-FRA
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Mon, 26 Sep 2022 16:44:52 GMT
x-content-type-options
nosniff
age
207308
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 26 Sep 2023 16:44:52 GMT
eBook_SWG_BuyersGuide_NAV-200x196.png
www.menlosecurity.com/wp-content/uploads/2021/10/
36 KB
37 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/10/eBook_SWG_BuyersGuide_NAV-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9acb38caafe1e9d1b575ce22fb7af46173b1ab43d8614f0c059240a2523bce4c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
293904
cf-polished
origFmt=png, origSize=55212
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="eBook_SWG_BuyersGuide_NAV-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
36586
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:01 GMT
server
cloudflare
etag
"61f2cded-d7ac"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb72ad49182-FRA
Datasheet_Cloud-Security-Platform-Powered-solation-core-200x196.png
www.menlosecurity.com/wp-content/uploads/2021/06/
28 KB
29 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/06/Datasheet_Cloud-Security-Platform-Powered-solation-core-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a5c1d85da5ccf4daae7b3abe3ace2b4635118fdb8e83dc99c73792811f79839
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
317503
cf-polished
origFmt=png, origSize=46970
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="Datasheet_Cloud-Security-Platform-Powered-solation-core-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
28188
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:03 GMT
server
cloudflare
etag
"61f2cdef-b77a"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb73adb9182-FRA
globe-icon-purple.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
278 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon-purple.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e80fa7380340a7651059a8b3d0d8ee3612d68c21a82206eaa5b0322b8263725
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
364278
cf-polished
origFmt=png, origSize=671
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="globe-icon-purple.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
278
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
"61f2cdf1-29f"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb75af49182-FRA
section-article-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
190 B
1 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
28
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-be"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb75af59182-FRA
section-article-pattern2.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
4 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-article-pattern2.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
28
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-1133"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb75af69182-FRA
article-single-right-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
569 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-right-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
28
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-239"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb75afa9182-FRA
article-single-left-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
595 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/article-single-left-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
28
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-253"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb75afb9182-FRA
fa-brands-400.woff2
www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/
75 KB
76 KB
Font
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/fonts/@fortawesome/fontawesome-free/webfonts/fa-brands-400.woff2
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
1524
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
76764
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
"61f2cdf1-12bdc"
x-frame-options
DENY
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb75afd9182-FRA
SolutionBrief_Migrate_on_Prem-to-SWG-200x196.png
www.menlosecurity.com/wp-content/uploads/2021/06/
32 KB
33 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/06/SolutionBrief_Migrate_on_Prem-to-SWG-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
34681d58d47f031f35460672e44c4f42139fe8bf5cbf21b3d80d501581c5b50f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
1525
cf-polished
origFmt=png, origSize=51588
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="SolutionBrief_Migrate_on_Prem-to-SWG-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
32272
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:04 GMT
server
cloudflare
etag
"61f2cdf0-c984"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb609182-FRA
Journey_SASE_Nav-200x196.png
www.menlosecurity.com/wp-content/uploads/2021/06/
27 KB
29 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/06/Journey_SASE_Nav-200x196.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c61668fe02ae42129e33ad07239d82f1b32b5377c57f37e1c36cdaca0dc04a9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
293904
cf-polished
origFmt=png, origSize=43409
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="Journey_SASE_Nav-200x196.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27868
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:04 GMT
server
cloudflare
etag
"61f2cdf0-a991"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb659182-FRA
tile-image@2x.jpg
www.menlosecurity.com/wp-content/uploads/2021/05/
76 KB
78 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/05/tile-image@2x.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
45dfb7e29904225979783d62efbf600377472d8d55c0fd886d7ea9d449387946
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
147774
cf-polished
origSize=78061, status=webp_bigger
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
78053
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:04 GMT
server
cloudflare
etag
"61f2cdf0-130ed"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb669182-FRA
icon-question.svg
www.menlosecurity.com/wp-content/uploads/2021/05/
1 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/05/icon-question.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364278
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:04 GMT
server
cloudflare
etag
W/"61f2cdf0-430"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb7fb679182-FRA
icon-phone.svg
www.menlosecurity.com/wp-content/uploads/2021/05/
1 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2021/05/icon-phone.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba482add0c02c927f05b5078b949334e4d1db145525061a0bb29b70bda92b9c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364277
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:04 GMT
server
cloudflare
etag
W/"61f2cdf0-488"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb7fb689182-FRA
qakbot-email-lure-payload-2.png
www.menlosecurity.com/wp-content/uploads/2022/08/
14 KB
15 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-payload-2.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
59cb7d5683f72d2920b70698c6a9ffecfaaf2479594108b481c94d3848750bd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=33748
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-email-lure-payload-2.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
13828
cf-bgj
imgq:100,h2pri
last-modified
Tue, 30 Aug 2022 14:53:34 GMT
server
cloudflare
etag
"630e246e-83d4"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb699182-FRA
qakbot-email-lure-evasion.png
www.menlosecurity.com/wp-content/uploads/2022/08/
8 KB
9 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-evasion.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba552b1989b489cc4c619989de193cf07efc5f26419edb00563c3cc9007706ad
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=22130
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-email-lure-evasion.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
7998
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:08:41 GMT
server
cloudflare
etag
"63077459-5672"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb6a9182-FRA
qakbot-email-lure-malicious-lnk-download.png
www.menlosecurity.com/wp-content/uploads/2022/08/
28 KB
30 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-malicious-lnk-download.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8545749101fc8aeb139c07538cfd2db5c79029985962526aa817b899c75b67ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=57759
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-email-lure-malicious-lnk-download.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
28852
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:11:48 GMT
server
cloudflare
etag
"63077514-e19f"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb6b9182-FRA
qakbot-email-lure-js.png
www.menlosecurity.com/wp-content/uploads/2022/08/
80 KB
81 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-email-lure-js.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7e5f7f0d7ed80280f0a84f08b2494b6bf509d6a44d683d8a2bafc5a690635310
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=189455
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-email-lure-js.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
81480
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:12:08 GMT
server
cloudflare
etag
"63077528-2e40f"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb6c9182-FRA
qakbot-excel-40-macros-diagram.png
www.menlosecurity.com/wp-content/uploads/2022/08/
6 KB
7 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-macros-diagram.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bef857d0d4902ce2c1e5061786720d2bde7b06ec62f44b10a14895ce8c32b1b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=13043
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-excel-40-macros-diagram.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5804
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:14:36 GMT
server
cloudflare
etag
"630775bc-32f3"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb6e9182-FRA
qakbot-excel-40-email-contents-1024x440.png
www.menlosecurity.com/wp-content/uploads/2022/08/
26 KB
28 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-email-contents-1024x440.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ce5c3f8080f47c836504791f325bc1347930bf1fd9c5eff12d45e7b60301d0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=73303
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-excel-40-email-contents-1024x440.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27084
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:15:18 GMT
server
cloudflare
etag
"630775e6-11e57"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb6f9182-FRA
qakbot-excel-40-enable-macros.png
www.menlosecurity.com/wp-content/uploads/2022/08/
13 KB
14 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-enable-macros.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8dcbdf941f2ac36658027af985c8621d3468eefde9ab793f38f6fa53bc22aec9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=21996
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-excel-40-enable-macros.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
12976
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:16:12 GMT
server
cloudflare
etag
"6307761c-55ec"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb719182-FRA
qakbot-excel-40-payload.png
www.menlosecurity.com/wp-content/uploads/2022/08/
45 KB
47 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/08/qakbot-excel-40-payload.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7501d6f1489d7878ea71a2bb48211bc0ae0ab34fd934c4129d0089610e0f4c07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origFmt=png, origSize=88150
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="qakbot-excel-40-payload.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
46508
cf-bgj
imgq:100,h2pri
last-modified
Thu, 25 Aug 2022 13:17:01 GMT
server
cloudflare
etag
"6307764d-15856"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb7fb739182-FRA
section-contact-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
2 KB
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/section-contact-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
208363
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-892"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb84ba69182-FRA
getForm
info.menlosecurity.com/index.php/form/
22 KB
5 KB
Script
General
Full URL
https://info.menlosecurity.com/index.php/form/getForm?munchkinId=281-OWV-899&form=2571&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F&callback=jQuery112409049213041236781_1664418000690&_=1664418000691
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ce9b6f41c9f13ae8712652facbd81ed5c268231ee7a64075f982b59c273e640

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
server
cloudflare
cf-ray
75213cb86a89694c-FRA
cached
true
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
footer-pattern.svg
www.menlosecurity.com/wp-content/themes/menlo/dist/images/
657 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/dist/images/footer-pattern.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364277
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-291"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb87bc19182-FRA
logo-footer.svg
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
4 KB
3 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/logo-footer.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
age
364277
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
W/"61f2cdf1-105f"
x-frame-options
DENY
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
75213cb87bc29182-FRA
en.json
cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/d2455243-ab24-4927-854a-4111d3e6abf4/
94 KB
19 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/consent/1a750de4-f18f-43d4-8b13-4ead3aa824f4/d2455243-ab24-4927-854a-4111d3e6abf4/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f84f90e0b8d058f6c6119cc65908765742a3f60f5f099a1eab14cd99118337c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
mOqBA1rHESg14r6aB3RJ7w==
age
2468
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
19462
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 22:18:01 GMT
server
cloudflare
etag
0x8DA9DB17A4C3B8C
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
19668c79-201e-008d-60b1-cf9440000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb88cb29164-FRA
expires
Thu, 29 Sep 2022 06:20:00 GMT
globe-icon.png
www.menlosecurity.com/wp-content/themes/menlo/resources/images/
276 B
2 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/themes/menlo/resources/images/globe-icon.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc9914192e0a743ae5573b812ab10411abd58039f8d1971fcf08f5591a8f2257
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/wp-content/cache/autoptimize/1/css/autoptimize_cc770a94768f89fab5a217c4ee451b43.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
1524
cf-polished
origFmt=png, origSize=2060
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="globe-icon.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
276
cf-bgj
imgq:100,h2pri
last-modified
Thu, 27 Jan 2022 16:53:05 GMT
server
cloudflare
etag
"61f2cdf1-80c"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb8bbf39182-FRA
Two_minutes_On-HEAT-attacks-evading-malicious-link-analysis_Blog.jpg
www.menlosecurity.com/wp-content/uploads/2022/09/
63 KB
64 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/09/Two_minutes_On-HEAT-attacks-evading-malicious-link-analysis_Blog.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_b8b6ea80717e90323b072574f4f1f9b5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b93be100a1e7d46aa5eecd3dfc15f4a9b3d18eb615d5ddff3c009bb266ab37c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origSize=76233, status=webp_bigger
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
64227
cf-bgj
imgq:100,h2pri
last-modified
Tue, 13 Sep 2022 15:33:22 GMT
server
cloudflare
etag
"6320a2c2-129c9"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb8dc199182-FRA
Menlo_Oktapus_blog.jpg
www.menlosecurity.com/wp-content/uploads/2022/09/
78 KB
80 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/09/Menlo_Oktapus_blog.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_b8b6ea80717e90323b072574f4f1f9b5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
27a1b0f5f06a48e71b246e8db0eb4cf81231a066ac127a10674ac5b7eb5e2426
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
28
cf-polished
origSize=92561, status=webp_bigger
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
80113
cf-bgj
imgq:100,h2pri
last-modified
Wed, 21 Sep 2022 20:05:23 GMT
server
cloudflare
etag
"632b6e83-16991"
vary
Accept-Encoding
x-frame-options
DENY
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb8dc1a9182-FRA
Menlo_labs_isolation_template_injection_Blog.jpg
www.menlosecurity.com/wp-content/uploads/2022/09/
75 KB
77 KB
Image
General
Full URL
https://www.menlosecurity.com/wp-content/uploads/2022/09/Menlo_labs_isolation_template_injection_Blog.jpg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/wp-content/cache/autoptimize/1/js/autoptimize_b8b6ea80717e90323b072574f4f1f9b5.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
141.193.213.21 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebaf946cd530720a8961470c0382dfb624418103367064695a177d742f8b78ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains;
x-content-type-options
nosniff
cf-cache-status
HIT
age
27
cf-polished
origFmt=jpeg, origSize=95611
content-security-policy-report-only
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://player.vimeo.com https://*.clickagy.com https://www.redditstatic.com https://app.hushly.com https://cdn.cookielaw.org https://cdnjs.cloudflare.com https://connect.facebook.net https://d2i34c80a0ftze.cloudfront.net https://googleads.g.doubleclick.net https://hubfront.hushly.com https://info.menlosecurity.com https://j.6sc.co https://js.driftt.com https://munchkin.marketo.net https://script.hotjar.com https://snap.licdn.com https://static.ads-twitter.com https://static.hotjar.com https://tags.srv.stackadapt.com https://trk.techtarget.com https://ws.zoominfo.com https://www.google-analytics.com https://www.googleadservices.com https://www.googletagmanager.com https://extend.vimeocdn.com https://www.google.com;style-src 'self' 'unsafe-inline' https://app.hushly.com https://fonts.googleapis.com https://hubfront.hushly.com https://info.menlosecurity.com https://tags.srv.stackadapt.com https://maxcdn.bootstrapcdn.com; object-src 'none'; base-uri 'self'; connect-src * data: blob:; font-src 'self' data: https://maxcdn.bootstrapcdn.com https://app.hushly.com https://fonts.gstatic.com; frame-src 'self' https://*.doubleclick.net https://info.menlosecurity.com https://js.driftt.com https://vars.hotjar.com https://www.facebook.com; img-src * data:; manifest-src 'self';media-src 'self' https://js.driftt.com; worker-src 'none'; report-uri https://csp.menlosecops.com/32d687c5-44d6-54e9-9793-d0965364f03a
content-disposition
inline; filename="Menlo_labs_isolation_template_injection_Blog.webp"
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
76952
cf-bgj
imgq:100,h2pri
last-modified
Mon, 19 Sep 2022 22:30:13 GMT
server
cloudflare
etag
"6328ed75-1757b"
x-frame-options
DENY
vary
Accept
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
75213cb8dc1b9182-FRA
6si.min.js
j.6sc.co/
30 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Mon, 22 Aug 2022 22:26:40 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"630402a0-786e"
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, no-cache, proxy-revalidate
accept-ranges
bytes
content-length
9594
expires
Thu, 29 Sep 2022 02:20:00 GMT
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
last-modified
Tue, 30 Aug 2022 15:04:19 GMT
etag
"d4de8398858246712016031c834bb061+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15317
x-served-by
cache-iad-kcgs7200095-IAD, cache-hhn11530-HHN
hotjar-1854968.js
static.hotjar.com/c/
4 KB
2 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-65-9-66-34.fra56.r.cloudfront.net
Software
/
Resource Hash
705d98d3f835e14b073f58d714f9325d2472aa62d5bbb9fc8b3683a10180e6bd
Security Headers
Name Value
Strict-Transport-Security max-age=604800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=604800; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Thu, 29 Sep 2022 02:19:22 GMT
via
1.1 9570c3a1725c20e6faed117bbb74223a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
age
38
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
etag
W/0181c4be010a1b265deee05cef56bcfe
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cache-control
max-age=60
x-amz-cf-id
e7xGWVBiD1BkTKPrN9zRZp62OGQqPZLwaOsuISBxsxicgp44xjvcMw==
conversion_async.js
www.googleadservices.com/pagead/
41 KB
16 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
cafe /
Resource Hash
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15699
x-xss-protection
0
server
cafe
etag
699633608045481581
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Thu, 29 Sep 2022 02:20:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:149b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 20:23:36 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=26883
accept-ranges
bytes
content-length
3063
fbevents.js
connect.facebook.net/en_US/
101 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 29 Sep 2022 02:20:00 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26840
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
MEHJOnZJqdX6PgC7PrLfUN9HbkKCIiLFaNasByvB4h8aFwXWAqpyLd647fUaXM64ef+7uN67fS+oGi2060yetQ==
x-fb-trip-id
686109401
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
92.123.8.217 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-8-217.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:00 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Sep 2022 01:18:39 GMT
Server
AkamaiNetStorage
ETag
"92b41a298690c047b0c4602dd843cba4:1662686319.691662"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
728
GQ57xOfAtqXGOqCfMFaF
ws.zoominfo.com/pixel/
3 KB
2 KB
Script
General
Full URL
https://ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:650c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
277c9b6c6219a0c11b324e1a82502fd207cb8ad6b48d122ad8c8fc05f7ba76b8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
server
cloudflare
x-powered-by
Express
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
access-control-allow-credentials
true
cf-ray
75213cb92ddb9142-FRA
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
widget.js
app.hushly.com/runtime/
1 KB
2 KB
Script
General
Full URL
https://app.hushly.com/runtime/widget.js?aid=83162
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
38b6e792cfa117ad887d73f850c1f7f0b6fb19ac74dce132283016cb3bcf62e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

content-type
text/javascript;charset=utf-8
pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
cache-control
no-cache, no-store, must-revalidate
expires
Thu, 01 Jan 1970 00:00:00 GMT
embed.js
hubfront.hushly.com/
194 KB
58 KB
Script
General
Full URL
https://hubfront.hushly.com/embed.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:ec00:13:a3bc:6800:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
9c03e696d15ec089b9e3ee5b6f1450019259530dd19044175a2b9953d430fa79

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
via
1.1 85dc19f43b2a0bd8840fdf8baf07d762.cloudfront.net (CloudFront)
last-modified
Tue, 05 Apr 2022 10:43:58 GMT
server
nginx
x-amz-cf-pop
FRA53-C1
etag
W/"624c1d6e-307bf"
x-cache
Miss from cloudfront
content-type
application/javascript
x-amz-cf-id
qxzobFdZ1PXo7C_r1CbLct57TSh3ymiMfPK7y2DVS4U-j4WF-PYNlA==
events.js
tags.srv.stackadapt.com/
17 KB
6 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
aeb710f8a6b5bdc7060765e78057a6ed37f596e1799477528a42aad6fe0669f1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 29 Sep 2022 02:20:01 GMT
Cache-Control
max-age=5
Content-Encoding
gzip
Connection
keep-alive
Content-Length
5394
Content-Type
text/javascript
trrsm2wf4gwm.js
js.driftt.com/include/1664418300000/
211 KB
60 KB
Script
General
Full URL
https://js.driftt.com/include/1664418300000/trrsm2wf4gwm.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f3c18a1480a0be2734d4bd401116a73bcce58d160ca8b73e5b4c1318e67c0650
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
x-amz-version-id
tphmvJ3j4YGi1NbmxTmIufCc0TPuaxsM
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
last-modified
Tue, 27 Sep 2022 18:44:02 GMT
server
nginx
etag
W/"60d23e510f9abb7c7aae14090cf517f4"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MHCj6S7iQe7H3nHSIeuRHEhaKQqM_ZaJnZDu96NZJSo6BWh8X4dFug==
fullcircle.js
d2i34c80a0ftze.cloudfront.net/
31 KB
11 KB
Script
General
Full URL
https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:b600:9:14eb:6280:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
1026dbcff11e16ec34fe5cb7369461ac343cd39b366cb612afe40d0f6d27a3d1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 02:59:46 GMT
via
1.1 9336c14434e205e440418213079c6074.cloudfront.net (CloudFront), 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
content-encoding
gzip
x-amz-cf-pop
FRA60-P1, FRA56-P6
age
84014
x-amzn-requestid
586ee6f9-df0d-4c01-97ab-b1fc1cebd2dd
x-amzn-trace-id
Root=1-6333b8a2-1f5a48837c89aa8f01e76bb7;Sampled=0
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amz-apigw-id
ZJnJXF2iPHcFmMA=
x-amz-cf-id
_np1Jq0GeC1guVXiKlxo295lXwe2yY1wenTS8Qhv0tMMEWd_nHMi_g==
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: pages.menlosecurity.com
URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:91d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Fri, 15 Oct 2021 14:31:37 GMT
server
cloudflare
age
27
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=1200
cf-ray
75213cb9aae0bb89-FRA
expires
Thu, 29 Sep 2022 02:29:33 GMT
js
www.googletagmanager.com/gtag/
215 KB
74 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
01f88b2ef74b87c24f299c6e80b39e9dd5a16c72ab3e72c29f1ef013d98a3fc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
75998
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Thu, 29 Sep 2022 02:20:00 GMT
79031691.js
extend.vimeocdn.com/ga/
17 KB
6 KB
Script
General
Full URL
https://extend.vimeocdn.com/ga/79031691.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.18.109 Vienna, Austria, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-cache-hits
49956
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
via
1.1 varnish
age
2357277
x-cache
HIT
content-length
5579
x-served-by
cache-vie6353-VIE
last-modified
Thu, 01 Sep 2022 18:23:26 GMT
server
Apache
x-timer
S1664418001.959905,VS0,VE0
etag
"421e-5e7a1b598e380-gzip"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
x-vimeo-dc
ge
x-bapp-server
assets-67ff759c65-khkw6
cache-control
max-age=86400
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 29 Aug 2032 19:32:03 GMT
forms2.css
info.menlosecurity.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://info.menlosecurity.com/js/forms2/css/forms2.css
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 16 Aug 2022 18:54:37 GMT
server
cloudflare
age
4064
etag
"e61471-3437-5e66047a81540"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
75213cb92b2d694c-FRA
content-length
2623
expires
Thu, 29 Sep 2022 06:20:00 GMT
forms2-theme-plain.css
info.menlosecurity.com/js/forms2/css/
828 B
331 B
Stylesheet
General
Full URL
https://info.menlosecurity.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 16 Aug 2022 18:54:37 GMT
server
cloudflare
age
4064
etag
"1e600ab-33c-5e66047a81540"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
75213cb92b30694c-FRA
content-length
246
expires
Thu, 29 Sep 2022 06:20:00 GMT
css
fonts.googleapis.com/
2 KB
523 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Raleway
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:810::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7d3b9b124ab86b33b4c72d29ceca9c5a56e5205e546394f55e1ca7fac57d58d5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Thu, 29 Sep 2022 01:08:41 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 29 Sep 2022 02:20:00 GMT
otFloatingFlat.json
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/
10 KB
3 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otFloatingFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
F4B+/RlyrlF0UtYV/kDZHw==
age
4064
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
2702
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 06:42:19 GMT
server
cloudflare
etag
0x8DA9D2EC31E5610
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
da3c30c4-a01e-00be-0dac-cfcd6d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb94d799164-FRA
otPcTab.json
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/v2/
63 KB
14 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33939bb9d827d73e58f184dd1b06e5024b34d62373bd41ce2aea6058d62aa902
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
MrbBPvSp/nr/pc7Rs9pb+g==
age
4064
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
14053
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 06:42:21 GMT
server
cloudflare
etag
0x8DA9D2EC455C01D
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
34847560-601e-0081-0fac-cf7ab1000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cb94d7b9164-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202209.1.0/assets/
22 KB
5 KB
Fetch
General
Full URL
https://cdn.cookielaw.org/scripttemplates/202209.1.0/assets/otCommonStyles.css
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202209.1.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
B55i3ZY9miZIaUrwjufy0w==
age
4064
x-ms-lease-status
unlocked
last-modified
Fri, 23 Sep 2022 06:42:32 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
7591bfa3-b01e-000b-33ac-cfc092000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
75213cb94d7d9164-FRA
1626328370711236
connect.facebook.net/signals/config/
292 KB
84 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/1626328370711236?v=2.9.84&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
82f2ed7025e02d8cfe7cc0dc70af22445159aa40de8e4003f11f502560885ae1
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; preload; includeSubDomains
date
Thu, 29 Sep 2022 02:20:00 GMT
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
85869
x-fb-rlafr
0
x-xss-protection
0
pragma
public
x-fb-debug
tyd+ycPWLh7SNnTn6C+8LGSLjatCDG17cub8lVgesFVu+8bxFza/av7BFBoaAKFQKTlAHBsW2+dVjnxvwkgiTw==
cross-origin-opener-policy
same-origin-allow-popups
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D474058%26time%3D1664418000911%26url%3Dhttps%253A%252F%252Fwww.menlosecurity.com%2...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&liSync=true&e_ipv6=AQLaCN6bur4tEwAAAYOHCzG3tMdq_q-YyI0-kn5pDFdvPYvvxZZ8B1RpquT_ZNYyS1SzMkx-mDw0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:00 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 4277C038EDC64EE38CC95C142CBC66EF Ref B: FRAEDGE1217 Ref C: 2022-09-29T02:20:01Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-fabric
prod-lva1
x-li-proto
http/2
content-length
0
x-li-uuid
AAXpx4O8OqWP6zQjnXRTrA==

Redirect headers

date
Thu, 29 Sep 2022 02:20:01 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 8944114C0E134DF693E35ACD8CFA8DBD Ref B: FRAEDGE1409 Ref C: 2022-09-29T02:20:01Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=474058&time=1664418000911&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&liSync=true&e_ipv6=AQLaCN6bur4tEwAAAYOHCzG3tMdq_q-YyI0-kn5pDFdvPYvvxZZ8B1RpquT_ZNYyS1SzMkx-mDw0
x-li-proto
http/2
content-length
0
x-li-uuid
AAXpx4O6CEdqJJwiu/kXfA==
1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
fonts.gstatic.com/s/raleway/v28/
21 KB
21 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v28/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrE.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c78a1da5fd0868a547cf285748c7fb73006571190385eb71c0d601b6b240ffaf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.menlosecurity.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 23:43:26 GMT
x-content-type-options
nosniff
age
95794
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21280
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:57:59 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 27 Sep 2023 23:43:26 GMT
XDFrame
info.menlosecurity.com/index.php/form/ Frame 7805
2 KB
900 B
Document
General
Full URL
https://info.menlosecurity.com/index.php/form/XDFrame
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
75213cb9dbb0694c-FRA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 29 Sep 2022 02:20:01 GMT
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
truncated
/
817 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Content-Type
image/svg+xml
Logo_MenloSecurity_Signature_Purple_RGB.png
cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/
12 KB
13 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/2f43eebf-9aac-4632-87e4-6268b1418b72/90dd6f8b-4c69-4515-bc68-3c27f610be65/9430bd48-82b5-4ae6-b08d-761d94b06151/Logo_MenloSecurity_Signature_Purple_RGB.png
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
lwzbnoHyDnRH4s89KRrv8A==
age
2587
content-length
12496
x-ms-lease-status
unlocked
last-modified
Tue, 29 Jun 2021 19:44:30 GMT
server
cloudflare
etag
0x8D93B364FFCA162
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
58a1a39b-801e-002a-553b-5aada3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
75213cba4b0d9b64-FRA
poweredBy_ot_logo.svg
cdn.cookielaw.org/logos/static/
3 KB
2 KB
Image
General
Full URL
https://cdn.cookielaw.org/logos/static/poweredBy_ot_logo.svg
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 29 Sep 2022 02:20:01 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
LpuayL42jB78xRllx0vkOw==
age
3377
x-ms-lease-status
unlocked
last-modified
Wed, 28 Sep 2022 12:10:15 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
9a782341-501e-0023-2d4d-d3b72d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
cf-ray
75213cba4b0e9b64-FRA
getuidj
secure.adnxs.com/
11 B
711 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.101 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 29 Sep 2022 02:20:01 GMT
AN-X-Request-Uuid
9ad2a1b9-836e-46d1-a744-e28c6bfec9e0
Server
nginx/1.21.3
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.menlosecurity.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
178.162.209.130; 178.162.209.130; 953.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
7 B
206 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/html
access-control-allow-origin
https://www.menlosecurity.com
access-control-allow-credentials
true
access-control-allow-headers
*
content-length
7
munchkin.js
munchkin.marketo.net/162/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/162/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
92.123.8.217 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-8-217.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:01 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Jul 2022 00:59:12 GMT
Server
AkamaiNetStorage
ETag
"75daf56f6191efe42577301908659c29:1656637152.894482"
Vary
Accept-Encoding
Content-Type
application/x-javascript
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4677
Expires
Sat, 07 Jan 2023 02:20:01 GMT
collect
region1.analytics.google.com/g/
0
351 B
Ping
General
Full URL
https://region1.analytics.google.com/g/collect?v=2&tid=G-C2G0PCSJKE&gtm=2oe9q0&_p=2073816051&_gaz=1&cid=1329568452.1664418001&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_z=ccd.v9B&_s=1&sid=1664418001&sct=1&seg=0&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&dr=https%3A%2F%2Fpages.menlosecurity.com%2F&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
351 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-C2G0PCSJKE&cid=1329568452.1664418001&gtm=2oe9q0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-C2G0PCSJKE&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
501 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-C2G0PCSJKE&cid=1329568452.1664418001&gtm=2oe9q0&aip=1&z=137773177
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
0
204 B
Image
General
Full URL
https://www.facebook.com/tr/?id=1626328370711236&ev=PageView&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&rl=https%3A%2F%2Fpages.menlosecurity.com%2F&if=false&ts=1664418001048&sw=1600&sh=1200&v=2.9.84&r=stable&ec=0&o=30&fbp=fb.1.1664418001047.1945415945&it=1664418000872&coo=false&rqm=GET
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Thu, 29 Sep 2022 02:20:01 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
modules.cf44a0a6b448df1b035e.js
script.hotjar.com/
254 KB
65 KB
Script
General
Full URL
https://script.hotjar.com/modules.cf44a0a6b448df1b035e.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-21.fra56.r.cloudfront.net
Software
/
Resource Hash
78d8ab2b9baadd2598db1f3035673d66f361b5111238ce78b80deedc0508efb3
Security Headers
Name Value
Strict-Transport-Security max-age=604800; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 28 Sep 2022 11:37:06 GMT
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=604800; includeSubDomains
via
1.1 7d3c59ee1b45f72158a8cbce053c8978.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
age
52975
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
66148
last-modified
Wed, 28 Sep 2022 11:36:53 GMT
etag
"5f131c93ccff63ccc86d0067d0eebf99"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
8R0jFDsyJJBVFUcMvQq-F2TR55GWCN7Oj99C9yMDWjvvoLjwHCiZgg==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/
43 B
691 B
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/684820168/?random=1664418001057&cv=9&fst=1664418001057&num=1&rdp=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg9q0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&ref=https%3A%2F%2Fpages.menlosecurity.com%2F&tiba=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&auid=1015236252.1664418001&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
63
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash
4445c4bd516128597fa60e58eafeaa3a0aab2dfc051700bde95d836707c3bf36

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.56
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-633500d1-6359d9387d5126a458fcd36d;Sampled=0
x-amzn-requestid
366c1e23-4d02-4c61-9c17-8e06aac18b07
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
ZM0Q0H2IPHcFh9Q=
content-length
1428
x-amz-cf-id
4-VSJz2AsMc2HOYg4r9u-mHA3x_4QzlNeshIcgqr9htKVaaWwT0zLw==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-apigw-id
ZM0QwGufPHcFhyg=
x-amz-cf-id
yjn7zL8Bm_ePDt4WZpVH6lCfYC1SLx9XXu-KEFicmfeyQ5ZDkmt_Ww==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
954e69fa-27e3-4349-8dd0-570dc1cb8758
x-cache
Miss from cloudfront
activity.gif
apt.techtarget.com/activity/
43 B
324 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=16648054&version=2.1.1&ref=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&r=1664418001079
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:01 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
Server
Apache/2.4.6 (CentOS)
ETag
"2b-5850384029cff"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
43
create
st.fullcircleinsights.com/v1/visitors/
1 KB
2 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash
fbbc9565977aefcc0feb1d5dc6fe8a5f0e2b855f451618acd946af84bdce926f

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.56
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-633500d1-431aed377d14f2451006ab88;Sampled=0
x-amzn-requestid
440ab9cd-cc0d-4d4f-9224-666a6d8256a2
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
ZM0QyGqVvHcFT6A=
content-length
1428
x-amz-cf-id
RymV21z6cGqniWhyn8zX4LM1RgDZQvfvAUSW-csgPFCH7wGa_YRz0g==
create
st.fullcircleinsights.com/v1/visitors/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visitors/create
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-apigw-id
ZM0QwFRCvHcF5hA=
x-amz-cf-id
3b3LF71rVksXcmzgSAXDjXKx9QOiTpltJR_9PQOO2MKfjfhGtjg8Ww==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
33bf0f36-4a45-4aa1-a8b8-8f15d88c42a0
x-cache
Miss from cloudfront
adsct
t.co/i/
43 B
376 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=6bd7d42a-fb60-4e2c-b65a-96e52a5ed248&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=166fe2be-2444-419b-ac4d-6b917f686e0e&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.27
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-response-time
107
date
Thu, 29 Sep 2022 02:20:00 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4c7269bc944e6e1d
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
3ab6e3cabaf0a75901a554c60a8de60267923f22564097d1f95e31e11f8eb90c
content-length
43
adsct
analytics.twitter.com/i/
0
0

img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A01%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
visitWebPage
281-owv-899.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://281-owv-899.mktoresp.com/webevents/visitWebPage?_mchNc=1664418001101&_mchCn=&_mchId=281-OWV-899&_mchTk=_mch-menlosecurity.com-1664418001100-34915&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&_mchHo=www.menlosecurity.com&_mchPo=&_mchRu=%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fpages.menlosecurity.com%2F&_mchQp=utm_campaign%3Dcontentnewsletter-sep2022__-__utm_medium%3Demail__-__utm_source%3Doutboundemail__-__mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:02 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
00823b52-3ef5-4ada-9581-c8d77018e9df
box-69edcc3187336f9b0a3fbb4c73be9fe6.html
vars.hotjar.com/ Frame 343A
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-69edcc3187336f9b0a3fbb4c73be9fe6.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1854968.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.65 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-65.fra53.r.cloudfront.net
Software
/
Resource Hash
867b23a408fa99143955de5665345cda886857174c328d2828e5dcd33bd98cd1
Security Headers
Name Value
Strict-Transport-Security max-age=604800; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1875774
cache-control
max-age=31536000
content-encoding
br
content-length
1044
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 07 Sep 2022 09:17:07 GMT
etag
"f6a9ca04b0687ea3c0d98e8430c8c77b"
last-modified
Wed, 07 Sep 2022 09:16:57 GMT
strict-transport-security
max-age=604800; includeSubDomains
vary
Accept-Encoding
via
1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront)
x-amz-cf-id
jFxyiQlGl_Jbx2ys0oWBCMtASOTTcaHmvoTCXR299gteEquX4Q11cA==
x-amz-cf-pop
FRA53-C1
x-cache
Hit from cloudfront
x-robots-tag
none
forms2.min.js
info.menlosecurity.com/js/forms2/js/ Frame 7805
208 KB
69 KB
Script
General
Full URL
https://info.menlosecurity.com/js/forms2/js/forms2.min.js
Requested by
Host: info.menlosecurity.com
URL: https://info.menlosecurity.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://info.menlosecurity.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Fri, 23 Sep 2022 04:00:35 GMT
server
cloudflare
age
4066
etag
"1e609b1-33e51-5e9503857f309"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
75213cbb0ca0694c-FRA
expires
Thu, 29 Sep 2022 06:20:01 GMT
details
epsilon.6sense.com/v3/company/
461 B
451 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.89.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-89-114.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a5e66f504cadc4d8337b616b6feac08f9e315629cb20bafae90875fc5de66fac

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
Authorization
Token cb6b946368e1bb01c6dac9732a72e3bc7e1fdd12
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
access-control-allow-credentials
true
content-length
262
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.89.114 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-158-89-114.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization
Access-Control-Request-Method
GET
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.menlosecurity.com
access-control-max-age
1800
date
Thu, 29 Sep 2022 02:20:01 GMT
server
nginx
visit-data
in.hotjar.com/api/v2/client/sites/1854968/
147 B
322 B
XHR
General
Full URL
https://in.hotjar.com/api/v2/client/sites/1854968/visit-data?sv=7
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.cf44a0a6b448df1b035e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.73.164.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-73-164-173.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
977930fc96f7aeda8c849fe1022320d3c8ceb631dea2f1e0db36a6ad16ecf9cc

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
br
vary
Accept-Encoding
access-control-max-age
86400
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, no-store
access-control-allow-credentials
true
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WL64MFJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 29 Sep 2022 01:15:57 GMT
last-modified
Sun, 11 Sep 2022 13:50:09 GMT
server
Golfe2
age
3844
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19826
expires
Thu, 29 Sep 2022 03:15:57 GMT
sa.css
tags.srv.stackadapt.com/
65 B
292 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
a8c5b8661bffd49a78d3e246245a68fee8890d578a839e550f38097c87ae22db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 29 Sep 2022 02:20:01 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
65
Content-Type
text/css
sa.jpeg
tags.srv.stackadapt.com/
0
881 B
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 29 Sep 2022 02:20:01 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
sa.jpeg
tags.srv.stackadapt.com/
0
881 B
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Thu, 29 Sep 2022 02:20:01 GMT
Cache-Control
only-if-cached, no-transform, private, max-age=7776000
Connection
keep-alive
Content-Length
651
Content-Type
image/jpeg
content
ws30.hotjar.com/api/v2/sites/1854968/recordings/
66 B
258 B
XHR
General
Full URL
https://ws30.hotjar.com/api/v2/sites/1854968/recordings/content
Requested by
Host: script.hotjar.com
URL: https://script.hotjar.com/modules.cf44a0a6b448df1b035e.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.246.176.35 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-246-176-35.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
5ad3e9b8814017f830cf1e24acda2861569f987fd58da61f028aa53195032037

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
br
vary
Accept-Encoding
access-control-max-age
86400
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, no-store
access-control-allow-credentials
true
widget-ad27a380d131c4896fae620f6d8a3a79.js
app.hushly.com/assets/
415 KB
125 KB
Script
General
Full URL
https://app.hushly.com/assets/widget-ad27a380d131c4896fae620f6d8a3a79.js
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/runtime/widget.js?aid=83162
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
a980fc04a01d4c539a6c8e3c5e8ef4663cee2eecdd45ceed3c908fe979e7ca26

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
last-modified
Mon, 26 Sep 2022 08:44:26 GMT
etag
"widget-ad27a380d131c4896fae620f6d8a3a79.js"
vary
Accept-Encoding
content-type
application/javascript;charset=UTF-8
cache-control
public, max-age=31536000
content-length
127299
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j97&a=2073816051&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&dr=https%3A%2F%2Fpages.menlosecurity.com%2F&ul=en-us&de=UTF-8&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=YADAAEABAAAAAC~&jid=998208108&gjid=993675129&cid=1329568452.1664418001&tid=UA-41161362-2&_gid=1013979325.1664418001&_r=1&gtm=2wg9q0WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=1790799478
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
25 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j97&tid=UA-41161362-2&cid=1329568452.1664418001&jid=998208108&gjid=993675129&_gid=1013979325.1664418001&_u=YADAAEAAAAAAAC~&z=970770803
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.menlosecurity.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
data.js
tags.clickagy.com/
38 KB
14 KB
Script
General
Full URL
https://tags.clickagy.com/data.js?rnd=62fe5c0e6ad95
Requested by
Host: ws.zoominfo.com
URL: https://ws.zoominfo.com/pixel/GQ57xOfAtqXGOqCfMFaF
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1fcd , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b05f32b262a8ddfa4c0322b0b4b376258b7996177b98d5a1e2b4585d20cba27

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
x-amz-version-id
voLTTawX.GcVEDQiIRYzY2txm8P5Ii8i
via
1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
cf-cache-status
DYNAMIC
content-encoding
gzip
x-amz-cf-pop
FRA60-P3
age
58339
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Fri, 16 Sep 2022 04:12:14 GMT
server
cloudflare
etag
W/"9d3ea74a65932cc93f95029e15978232"
vary
Accept-Encoding
content-type
application/javascript
cf-ray
75213cbd0edd698f-FRA
x-amz-cf-id
RdP3s2YhfnQmHkUVwHDHjcPcbawakscTASDnIinHG7hwouYTtkPhBQ==
data
aorta.clickagy.com/
57 B
511 B
XHR
General
Full URL
https://aorta.clickagy.com/data
Requested by
Host: tags.clickagy.com
URL: https://tags.clickagy.com/data.js?rnd=62fe5c0e6ad95
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.162.244.84 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-162-244-84.compute-1.amazonaws.com
Software
Aorta/20220928.2d330c3d9 /
Resource Hash
27ffddbdf026a02fd33149cb67c390598afb35ba650e4e1b3e1dc4a989de0614

Request headers

Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
server
Aorta/20220928.2d330c3d9
expect
0
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-aorta-region
us-east-1
x-aorta-host
fda5bad05aa6
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
content-length
82
hasHashes
hemsync.clickagy.com/external/
2 B
330 B
XHR
General
Full URL
https://hemsync.clickagy.com/external/hasHashes?clkgypv=jstag
Requested by
Host: tags.clickagy.com
URL: https://tags.clickagy.com/data.js?rnd=62fe5c0e6ad95
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.205.92.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-205-92-219.compute-1.amazonaws.com
Software
/
Resource Hash
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
content-encoding
gzip
vary
origin
content-type
text/plain; charset=utf-8
access-control-allow-origin
https://www.menlosecurity.com
access-control-expose-headers
content-length, last-modified, expires, content-type
access-control-allow-credentials
true
content-length
28
usersync
pixel-sync.sitescout.com/connectors/clickagy/
Redirect Chain
  • https://aorta.clickagy.com/pixel.gif?clkgypv=jstag
  • https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
0
191 B
Image
General
Full URL
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Server
66.155.71.25 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
cache-control
max-age=0,no-cache,no-store
server
AC1.1
expires
Tue, 11 Oct 1977 12:34:56 GMT

Redirect headers

date
Thu, 29 Sep 2022 02:20:01 GMT
server
Aorta/20220928.2d330c3d9
expect
0
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json
location
https://pixel-sync.sitescout.com/connectors/clickagy/usersync?redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D5%26cm%3D%7BuserId%7D
access-control-allow-origin
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-aorta-region
us-east-1
x-aorta-host
f02b8ad37480
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
content-length
0
711861.gif
id.rlcdn.com/
Redirect Chain
  • https://aorta.clickagy.com/liveramp_redir
  • https://id.rlcdn.com/711861.gif
0
98 B
Image
General
Full URL
https://id.rlcdn.com/711861.gif
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0

Redirect headers

date
Thu, 29 Sep 2022 02:20:01 GMT
server
Aorta/20220928.2d330c3d9
expect
0
access-control-max-age
31536000
access-control-allow-methods
POST, GET, OPTIONS
content-type
application/json
location
https://id.rlcdn.com/711861.gif
access-control-allow-origin
access-control-expose-headers
Set-Cookie
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
x-aorta-region
us-east-1
x-aorta-host
83dd95bd0d8b
access-control-allow-headers
Origin,cache-control,content-type,man,messagetype,soapaction
content-length
0
ga-audiences
www.google.com/ads/
42 B
501 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-41161362-2&cid=1329568452.1664418001&jid=998208108&_u=YADAAEAAAAAAAC~&z=334211106
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j97&tid=UA-41161362-2&cid=1329568452.1664418001&jid=998208108&_u=YADAAEAAAAAAAC~&z=334211106
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 29 Sep 2022 02:20:01 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/ Frame 4BB8
0
18 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.menlosecurity.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Thu, 29 Sep 2022 02:20:01 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
saq_pxl
tags.srv.stackadapt.com/
94 B
403 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=Xve1da1krYlzEarKmNXl-g&is_js=true&landing_url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&t=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&tip=RzrGXjlNZranpUSPjA6PV7k-xsTIeIXexJZVFsfiNhE&host=https://www.menlosecurity.com&sa_conv_data_css_value=%20%220-c3c8c983-aa0a-4081-437d-80d36a6aeef0%22&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9512c6e1c1b9148a642d53074d88cb377b2a2d182&sa-user-id-v2=s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0%2524ip%2524178.162.209.130.F32rR9XePOYqDxnTKNsH1VeKbGp1r3nDmtnuB5b1kTM&sa-user-id=s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0.fNaEvZogzAFFpdF3pzgQSCuTrMw8sCci4fwL1VIdpXg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:01 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.menlosecurity.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
94
saq_pxl
tags.srv.stackadapt.com/
94 B
403 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=Qx2zgcBp28NGsaKUIZmZkg&is_js=true&landing_url=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&t=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&tip=RzrGXjlNZranpUSPjA6PV7k-xsTIeIXexJZVFsfiNhE&host=https://www.menlosecurity.com&sa_conv_data_css_value=&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd9f24cc8d7d2a845674c0ee7a958cc4fbab2a2d182&sa-user-id-v2=s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0%2524ip%2524178.162.209.130.F32rR9XePOYqDxnTKNsH1VeKbGp1r3nDmtnuB5b1kTM&sa-user-id=s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0.fNaEvZogzAFFpdF3pzgQSCuTrMw8sCci4fwL1VIdpXg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.175.93.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-175-93-244.compute-1.amazonaws.com
Software
/
Resource Hash
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date
Thu, 29 Sep 2022 02:20:01 GMT
Access-Control-Allow-Methods
GET
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://www.menlosecurity.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
94
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash
bbc51bef34cba008dfc2d34de147d0591a4862740f461c6345b5aa2932553c8f

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.56
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:02 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-633500d2-2d3158d8028c9dea05928061;Sampled=0
x-amzn-requestid
8593f83b-3f48-4f80-b146-0f13b706115a
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
ZM0Q2F7HvHcF7pw=
content-length
2398
x-amz-cf-id
ZJDk_Ng78XnYg-aS2gZrEhrdPq3xFbh-vqWnicvfhm0DnVzBIehTFA==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Thu, 29 Sep 2022 02:20:01 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-apigw-id
ZM0Q1Eo7vHcF02g=
x-amz-cf-id
ofiWZ67SfR_1DfiHkBGIvHfDqv3_A8kME2mImOwgmp2IxiXqFbYp3Q==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
6678ab11-436c-4665-873c-be518102fc75
x-cache
Miss from cloudfront
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A02%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A01%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Requested by
Host: www.menlosecurity.com
URL: https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:02 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
widget-86616d5946edd9a2cd99f210fd4931af.css
app.hushly.com/assets/
68 KB
12 KB
Stylesheet
General
Full URL
https://app.hushly.com/assets/widget-86616d5946edd9a2cd99f210fd4931af.css
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ad27a380d131c4896fae620f6d8a3a79.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
ecb4cf1400337bb3e1f8d6e9c312534a7e4a786832b909799c1d26373371861e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:02 GMT
content-encoding
gzip
last-modified
Mon, 26 Sep 2022 08:44:26 GMT
etag
"widget-86616d5946edd9a2cd99f210fd4931af.css"
vary
Accept-Encoding
content-type
text/css;charset=UTF-8
cache-control
public, max-age=31536000
content-length
11705
83162
app.hushly.com/runtime/widgets/
5 KB
3 KB
XHR
General
Full URL
https://app.hushly.com/runtime/widgets/83162
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ad27a380d131c4896fae620f6d8a3a79.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
91623c33aade4a8d9370f6b51c6baf9680e6de834d33185a4f672ba7778fbed6

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin
https://www.menlosecurity.com
date
Thu, 29 Sep 2022 02:20:02 GMT
content-encoding
gzip
access-control-allow-credentials
true
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
83162
app.hushly.com/runtime/visitor/
39 B
701 B
Script
General
Full URL
https://app.hushly.com/runtime/visitor/83162?callback=hushlyVisitorCallback&sid=e8f1434e-7925-4916-b03e-e340c8d9c4ee&vid=83dd3f5c-4374-4e04-a24c-a6bb23855b2a&version=2&hly-ip-address=&_=1664418002051
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ad27a380d131c4896fae620f6d8a3a79.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:02 GMT
cache-control
max-age=31536000, public
content-encoding
gzip
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash
f0f531f80dc4f4cc608c980ef4b861051671b4b24cd9c63c21fea43f4effc341

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.56
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:03 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-633500d3-343b87d5484564530fa3189f;Sampled=0
x-amzn-requestid
99efe560-9cd0-40bc-824f-2ef995d1feac
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
ZM0RAF2zPHcFk4g=
content-length
2398
x-amz-cf-id
lHDvXRnAzULLPSdRXE2lttsizi1TLlayLqawzlZIzfhvRTnJ0Nw0gA==
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Thu, 29 Sep 2022 02:20:02 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-apigw-id
ZM0Q6GOQPHcFq6Q=
x-amz-cf-id
GZ0EobBPVriXspqgQFvNm9HzH2BP1es_ohRulHvWouDfWKswPTXmhg==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
4d9ba48b-62af-4cd5-95e7-2284de0e979f
x-cache
Miss from cloudfront
core
js.driftt.com/ Frame 8A55
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1664418300000/trrsm2wf4gwm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
083e034c141e8d22cfd41ec3547b841a3f5409043304ad4df96a17f9d9991b1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 29 Sep 2022 02:20:02 GMT
etag
W/"a19cc51ce2bc8cc7788ff868535321e4"
last-modified
Tue, 27 Sep 2022 18:43:35 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-id
2JPLH0uQ5IGUd9N-6egh4UJB6nnQ0taSlbdBgd-1nIVM1VLLmFuHlQ==
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
YM0.5Pl0oxKY9zRE3MfN27mvMbk3eXMD
x-cache
RefreshHit from cloudfront
chat
js.driftt.com/core/ Frame 5B95
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1664418300000/trrsm2wf4gwm.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
083e034c141e8d22cfd41ec3547b841a3f5409043304ad4df96a17f9d9991b1b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.menlosecurity.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Thu, 29 Sep 2022 02:20:02 GMT
etag
W/"a19cc51ce2bc8cc7788ff868535321e4"
last-modified
Tue, 27 Sep 2022 18:43:35 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-id
cBXwlhXS7rKN52Xtr5CFwP5fuSOBYlzrUj6_SHKdK-asvnojzuMDxQ==
x-amz-cf-pop
FRA53-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
YM0.5Pl0oxKY9zRE3MfN27mvMbk3eXMD
x-cache
RefreshHit from cloudfront
queue
st.fullcircleinsights.com/v1/visits/ Frame
0
0
Preflight
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
js-version,origin-fci,x-api-key
Access-Control-Request-Method
POST
Origin
https://www.menlosecurity.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,X-Amz-User-Agent,origin-fci,js-version
access-control-allow-methods
OPTIONS,POST
access-control-allow-origin
https://www.menlosecurity.com
content-length
1
content-type
application/json
date
Thu, 29 Sep 2022 02:20:02 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-apigw-id
ZM0Q9G2mvHcFV2Q=
x-amz-cf-id
6rrsMJO-Q0jQvtMzQAnhuqah7plFSQvyUoUSA8V6f3Ve_g68bHxqxA==
x-amz-cf-pop
FRA56-P2
x-amzn-requestid
db001aad-3f2b-42e6-b59a-c2ef34848a83
x-cache
Miss from cloudfront
queue
st.fullcircleinsights.com/v1/visits/
2 KB
3 KB
XHR
General
Full URL
https://st.fullcircleinsights.com/v1/visits/queue
Requested by
Host: d2i34c80a0ftze.cloudfront.net
URL: https://d2i34c80a0ftze.cloudfront.net/fullcircle.js?cid=187d2103-bdc5-4e3f-b070-b5c6a4000840&domain=menlosecurity.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.97.13 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-97-13.fra56.r.cloudfront.net
Software
/
Resource Hash
7802fc0fe623626f3bb3f3b4c1bc7d7180680a22d2b6c2486776d5fbcb272117

Request headers

origin-fci
https://www.menlosecurity.com
Referer
https://www.menlosecurity.com/
accept-language
de-DE,de;q=0.9
js-version
1.0.56
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
x-api-key
uSI2bzqNHv34zA8znmW0LgfsY9TBayMx9gZJf430
Content-Type
text/plain;charset=UTF-8

Response headers

date
Thu, 29 Sep 2022 02:20:03 GMT
via
1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P2
x-amzn-trace-id
Root=1-633500d3-739a58af0ea3f6c521f39541;Sampled=0
x-amzn-requestid
cdab938f-3fdb-4125-996b-d0e5554cf1fd
vary
Origin
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
https://www.menlosecurity.com
x-amz-apigw-id
ZM0RDGoIPHcFTGQ=
content-length
2398
x-amz-cf-id
RK4nuEMpDDGhmxKkEHpixTnRwqroi_JQiSUXKhY7o6c48ocv1vzDSA==
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j97&a=2073816051&t=pageview&_s=1&dl=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&dr=https%3A%2F%2Fpages.menlosecurity.com%2F&ul=en-us&de=UTF-8&dt=An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAAC~&jid=&gjid=&cid=1329568452.1664418001&tid=UA-41161362-2&_gid=1013979325.1664418001&gtm=2wg9q0WL64MFJ&cd1=&cd2=&cd3=&cd4=&cd5=&cd6=&z=474940221
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 28 Sep 2022 06:35:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
71077
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
runtime~main.7659985d.js
js.driftt.com/core/assets/js/ Frame 5B95
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
65840540a4eb64f7174e6aede36b1ecc0f5108394f90929eb4f03e2d54e0bf76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 18:43:35 GMT
x-amz-version-id
mSxbgu0A5xVHVEpma7hGTqdi1ysbZ5c6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
113787
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 17:50:23 GMT
server
nginx
etag
W/"eee0013799e25fc1f62cf8d6f310943e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
9oB6fLoMhscVgXPFJUSEgKlVSQ_5Vhj5O49GBsrzzNY_4R340vuMmQ==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
_RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ICi4EgbYoAXgbtV_sQh1Gpri8nG1xjLSHd_krkR7ECzyKclAw8AAFg==
main~493df0b3.36fddc5f.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.36fddc5f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ba1b5ba457e3244bfc1b5e32428086b59e9738588b18a6620b9b437b31e48211
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Mon, 26 Sep 2022 18:51:29 GMT
x-amz-version-id
9EnD3a2xqmtsRD1N0L0ke0M639lGWwZ6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
199713
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 26 Sep 2022 18:38:51 GMT
server
nginx
etag
W/"d67b9f21a56510a527a7f7537b00473f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
g5sfIvOzv2qNRm80wGt17sW1D--Z5voAenIqrp4qXExeJLTJT027Cg==
runtime~main.7659985d.js
js.driftt.com/core/assets/js/ Frame 8A55
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
65840540a4eb64f7174e6aede36b1ecc0f5108394f90929eb4f03e2d54e0bf76
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 18:43:35 GMT
x-amz-version-id
mSxbgu0A5xVHVEpma7hGTqdi1ysbZ5c6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
113787
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 17:50:23 GMT
server
nginx
etag
W/"eee0013799e25fc1f62cf8d6f310943e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pc7CIAEhbQZORlY8ewTyeEsP3WT2FQp_EqXIZK-MvY3nuVsnDS4sMA==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
_RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
44KbRh5koV39EnhozOY_VxM1wW9ux7p1UIVAfGna7TLHFwy86rRIew==
main~493df0b3.36fddc5f.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.36fddc5f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ba1b5ba457e3244bfc1b5e32428086b59e9738588b18a6620b9b437b31e48211
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Mon, 26 Sep 2022 18:51:29 GMT
x-amz-version-id
9EnD3a2xqmtsRD1N0L0ke0M639lGWwZ6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
199713
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 26 Sep 2022 18:38:51 GMT
server
nginx
etag
W/"d67b9f21a56510a527a7f7537b00473f"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bmdxbiRLXBAQUA4rnOdVy56SzZ6b9Ns7kCaZEZ_S2eDQZ1S3l0ZJCQ==
83162
app.hushly.com/runtime/countries/
75 KB
20 KB
Script
General
Full URL
https://app.hushly.com/runtime/countries/83162?callback=hushlyCountriesCallback&_=1664418002052
Requested by
Host: app.hushly.com
URL: https://app.hushly.com/assets/widget-ad27a380d131c4896fae620f6d8a3a79.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.41.193.136 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-41-193-136.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:02 GMT
cache-control
max-age=31536000, public
content-encoding
gzip
x-robots-tag
noindex
vary
Accept-Encoding
content-type
text/javascript
48.36272856.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/48.36272856.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a77bb1b8bfef4a56cbbb32a3f0db155355f7259e1505797dcce1c128be3a97a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
k8.uxYl53iC1oeWvq0NE3PJ03yVM0lns
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:20 GMT
server
nginx
etag
W/"11fc6ce0a6034588f5e23638e2b6c3f2"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hH1FQL9g7sl93zycsAhAWe8mM_KIHV5cM5fy3rWtHe9K1icDkFnyLg==
22.fd21eb42.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.fd21eb42.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:05 GMT
x-amz-version-id
rhriNS8WygjGEv2GTbSa16tsLJlBsIO5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:56 GMT
server
nginx
etag
W/"cbf1bca421271b2567e00a478296192b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XDuumRg0pOQTzJVgVBKzrXCdEnOEVExN7dvJ1pLLW2GQ45M_aMVZZg==
18.40ab7295.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.40ab7295.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
597514d432ff2059b3e477385c44fb38d44c73f5d640eebe645cf3b340bcff56
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
3ktfD2K4Jga.M1SWwwN9gtZLMJ_jJceE
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:19 GMT
server
nginx
etag
W/"fafe5f62fc3aec49b7966fa154962db8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bddGGIKYlc0MF3acb3L9sTD_BbMm0zjt5ZQSSL35W0Ien_VJLcky4A==
39.0cc86423.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/39.0cc86423.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 05:13:08 GMT
x-amz-version-id
oKmg4FrWOfQibH6GiwTJD5mzxlfV.GJ_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
6037614
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:36 GMT
server
nginx
etag
W/"3cbfbd7bb911f7cfc3b4394f334cdb67"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Y8g2-FAPYrPvugpCKBQS8Bm-IOgBdpmRj4gf6KNP8IAf9ASH7LC-Vw==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
GCkJ4tZ_JW3xcmjJsO05feXt7md0igxo
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
anSM-uVd7PJkmCk8Zwa0hqTaXI3oLDko9jVrM5DAdDTIzDaX72k98A==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:05 GMT
x-amz-version-id
WcCqQoAG3H9hj_QsryoONfIqJXy6i_Vu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:56 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
WIzy53g5QffkkBFq9jkPG_3Rwp03wuv_xDVVtHVhswdYmEAM0yqMfw==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 20:28:27 GMT
x-amz-version-id
p9hPb_BoaQT.rfo1ve74yYgdVe7_JTph
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
4859495
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 03 Aug 2022 20:13:17 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
oJd9Iqz9at_XG2wxvWoiaT0Qiz4V6xGlsW_bGHJPddqqnvBWfoa5Iw==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:06 GMT
x-amz-version-id
7WrloWWSc22pVf.7ICrUs7406unnhgom
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:55 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
S_5BBFbq5UfcHfM-gTUy23FASKP10TS_KhwFX8tfGKLb9QQZN6Nadw==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 03:22:54 GMT
x-amz-version-id
Czs8PHX517U6kDfcy5c9LsKW5uxut099
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
6044228
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
s0kPKKXzutsRUBFgMZQJunM0VudBXVC4Vn2aqHv1ZtqBjwpwuNd5GA==
46.c9d569f4.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/46.c9d569f4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
79d8bfb0ff06d8516e46d4457bd951ed893d2deed31ab348227e06c91a5a35cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
z4GuioFw41AUfQig_beaXDNkINlEfczX
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:20 GMT
server
nginx
etag
W/"60ea9f8ff45a51f96f67728ef12e7e79"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
qqXg-5SwMU8awSDzDFMq5yN4MyyPKt9YVLaRwrd1MZ7Ms_qNtaelrQ==
37.9da17c94.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.9da17c94.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 00:36:46 GMT
x-amz-version-id
uo_6OKHcHDCBfHJOyNP63YTxUQ5cnt_W
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
4758196
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 04 Aug 2022 20:35:47 GMT
server
nginx
etag
W/"e5c98ad7a7e70a1957477e33db39149c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rACiqVx15SFLjC_DCihjcbFZxjkZ7sSQK-j2Y1Uzon1u1aZGJPNCzA==
28.190877b8.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.190877b8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
G0DP4jvUaKtIbfyIxWqyC1CIhSHB9xO6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:19 GMT
server
nginx
etag
W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1n4PaOMtrN7xIMmZoWraKYzPBMmeA4Z4swUwB7zAh5HJSmISu1YHgw==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 00:55:28 GMT
x-amz-version-id
f.0PmvFwFO6wHvpJ0r6JG1gTthOACCRK
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
5966674
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pRCtECcmZh05N6b9D9XkBaD-hWRoYKWPQ2wAeZ90P-vaxSppiqIvKg==
9.7980313a.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.7980313a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 13:41:58 GMT
x-amz-version-id
CxerwMRS6CdLERPs5NVshkyA9cHh0Tkt
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
650284
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 21 Sep 2022 13:23:52 GMT
server
nginx
etag
W/"97ab5d7bf24ef1c4f1e14801b9a510ed"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
uWEzYqNVpI3hYT0vfArM_jiE_kv9hfnW0lZ4KFfN0V_xWhONPFNcoQ==
9.c27a5ac4.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
75 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.c27a5ac4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
46bfa786e5eb8e2a57006959a64f6271b8c0a6cafb891f87f65685da63432289
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
9HVIwBGKWGaN.WcUjWmce0CWN6ELYlZD
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:39 GMT
server
nginx
etag
W/"95ca3f477c2bf8ee2859a27fb7831d42"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3ZwvR_KynigK0w45lMBeP-vM7vfhsNo2BQ1jOFrgU8D5hOOpVyL4KA==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
24 B
665 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
ykspFRt4QsihJmMduj_fPY2DMuvVpMeo
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rflVeisAEJ4gX_ghL5Y7aP0GJlRat3Qeg_kVKiOR95Q-h7MBEE7t1A==
17.9f871eab.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
78 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.9f871eab.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
0f9be297502b6ab0826a96ea3dc949fc5a970c993aadff30a4bdd2553a3c0f0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
XqJN.BQurZ.WvwfHTo0gzIwh2iUhCmfF
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"1c17301b3219dfcdc54b018eed28e592"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
XLyJV2uOOmFjYVcVf4PbTvTf0n3H0klQ4XLOlnJCmMFzRlb0I8pfXA==
24.9e93913f.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
49 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.9e93913f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9166b352495a70d02631c9792d021598f6ee53bef4f49baa766a059e6f9c8190
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
TKLLvkDHW8MNe4LTIWvBlrDRRNKrxHZ.
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"b0ce2074e6898eaf63dee45cca7a4495"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KkdoUp3Basp9PcDc97jkTIOEhFbPRpixOF8Zx5p0kyr8GRXo3YKRJw==
15.208ab4b1.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.208ab4b1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ac5c3099d242c2fd07f0fa0d35c9b3ed1b92131c3695cf57f9bc705265f6a015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 18:43:35 GMT
x-amz-version-id
KNuTtXlcmMzrg4EKw.awx9impLtGSw_Q
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
113787
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 17:50:20 GMT
server
nginx
etag
W/"a3fa3f203c479117841708b0658154b7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wNIGleNQuouk3VdBwWkMOWqQKshkJE6K4XmKiaEThbHUpsdIEv5dMg==
48.36272856.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/48.36272856.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a77bb1b8bfef4a56cbbb32a3f0db155355f7259e1505797dcce1c128be3a97a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
k8.uxYl53iC1oeWvq0NE3PJ03yVM0lns
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:20 GMT
server
nginx
etag
W/"11fc6ce0a6034588f5e23638e2b6c3f2"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MUpm7k02VWLuWPXLD7Q8IhKD5CBbI3Q2XvLSz6VwgMSF7fCZvGv8ww==
22.fd21eb42.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.fd21eb42.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:05 GMT
x-amz-version-id
rhriNS8WygjGEv2GTbSa16tsLJlBsIO5
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:56 GMT
server
nginx
etag
W/"cbf1bca421271b2567e00a478296192b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
YLtTrLpXahFuyEdGcJecskQFlcUxKebc3StvaL73GHV-zBPRGFSUtg==
18.40ab7295.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.40ab7295.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
597514d432ff2059b3e477385c44fb38d44c73f5d640eebe645cf3b340bcff56
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
3ktfD2K4Jga.M1SWwwN9gtZLMJ_jJceE
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:19 GMT
server
nginx
etag
W/"fafe5f62fc3aec49b7966fa154962db8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
x9G4px7bwZlNL8HSoyJDbc3SkIEZM0QcZcFiqD0fanBXZtwPswQNOA==
39.0cc86423.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/39.0cc86423.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 05:13:08 GMT
x-amz-version-id
oKmg4FrWOfQibH6GiwTJD5mzxlfV.GJ_
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
6037614
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:36 GMT
server
nginx
etag
W/"3cbfbd7bb911f7cfc3b4394f334cdb67"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Q5zVKOCV9ftHL_A6H0-mtHr2tWZOKNm0XJsyqKL4bhmHhmXvPooGpw==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
GCkJ4tZ_JW3xcmjJsO05feXt7md0igxo
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
X5yQ5QnkyIsToppZQNQ4kq6BTUoZjn-vv6KG5YsroBWGBvPAfCt_4A==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:05 GMT
x-amz-version-id
WcCqQoAG3H9hj_QsryoONfIqJXy6i_Vu
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527897
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:56 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TwOYUnnDqUphbDlu3wdm2en-puMP61f8k89vbTFNrsB3E4BuMEvAnA==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 03 Aug 2022 20:28:27 GMT
x-amz-version-id
p9hPb_BoaQT.rfo1ve74yYgdVe7_JTph
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
4859495
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 03 Aug 2022 20:13:17 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
c7RvYA99-UL9LJPqEpn33iziggxet6VASdDyk0w1fWzCwRNTrUZFhw==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:06 GMT
x-amz-version-id
7WrloWWSc22pVf.7ICrUs7406unnhgom
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527896
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:55 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
cKpXTKe9gNULcLSOV7an1dyKsTuwgkFK1SVKP5QZtUBPLpwtYJfjCg==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 21 Jul 2022 03:22:54 GMT
x-amz-version-id
Czs8PHX517U6kDfcy5c9LsKW5uxut099
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
6044228
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Th4yBdTk_LY_F9VmX2GWHMlmX8IVG8E_p4KKm9Xr8DTU4aP8HBit0A==
46.c9d569f4.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/46.c9d569f4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
79d8bfb0ff06d8516e46d4457bd951ed893d2deed31ab348227e06c91a5a35cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
z4GuioFw41AUfQig_beaXDNkINlEfczX
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:20 GMT
server
nginx
etag
W/"60ea9f8ff45a51f96f67728ef12e7e79"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lbdozbWUo0PxG5uzy6BhH9GJs9N4VdEVda44epwBaxTAvGwzi50rww==
37.9da17c94.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.9da17c94.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 05 Aug 2022 00:36:46 GMT
x-amz-version-id
uo_6OKHcHDCBfHJOyNP63YTxUQ5cnt_W
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
4758196
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 04 Aug 2022 20:35:47 GMT
server
nginx
etag
W/"e5c98ad7a7e70a1957477e33db39149c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tLNNroKnqOXUYZ0CJScgYmhQ6hMapZDX4fWSCt-sFRqup-2_Z9SUHw==
28.190877b8.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.190877b8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:25 GMT
x-amz-version-id
G0DP4jvUaKtIbfyIxWqyC1CIhSHB9xO6
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858477
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:19 GMT
server
nginx
etag
W/"94c7e7cb2f40e10abeee8e28c0f68eb7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EmZbYQ0ILstnUc9Vf9dI2vXJZ_sZLZZ9-lp0TFtQ5Tq2dviDTGCaRw==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 22 Jul 2022 00:55:28 GMT
x-amz-version-id
f.0PmvFwFO6wHvpJ0r6JG1gTthOACCRK
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
5966674
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
stywvOksWT_SVK3GQVifvlBCAkKQQi2FwJSz3ApXmuWHjGd627WqfA==
9.7980313a.chunk.css
js.driftt.com/core/assets/css/ Frame 8A55
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.7980313a.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 13:41:58 GMT
x-amz-version-id
CxerwMRS6CdLERPs5NVshkyA9cHh0Tkt
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
650284
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 21 Sep 2022 13:23:52 GMT
server
nginx
etag
W/"97ab5d7bf24ef1c4f1e14801b9a510ed"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
moDTNKXCNVjjwmrcJOMV75MpDRlDBtoN5JbCcX-_L2tPlWZ4lxO35Q==
9.c27a5ac4.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
75 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.c27a5ac4.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
46bfa786e5eb8e2a57006959a64f6271b8c0a6cafb891f87f65685da63432289
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
9HVIwBGKWGaN.WcUjWmce0CWN6ELYlZD
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:39 GMT
server
nginx
etag
W/"95ca3f477c2bf8ee2859a27fb7831d42"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tUH6tjg1Z0myb2hxv7qakGR1SRE6CI1PmogM4r8bZx42K36U9a0__Q==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 8A55
24 B
666 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
x-amz-version-id
ykspFRt4QsihJmMduj_fPY2DMuvVpMeo
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA53-C1
age
9613213
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
GTKA8vKtjETI3RGdcHn8D4CfT0LP3GKF2HUj1rhXkPnbReAeCSarwg==
17.9f871eab.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
78 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.9f871eab.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
0f9be297502b6ab0826a96ea3dc949fc5a970c993aadff30a4bdd2553a3c0f0b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
XqJN.BQurZ.WvwfHTo0gzIwh2iUhCmfF
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"1c17301b3219dfcdc54b018eed28e592"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
SRUpOrd5vIhJA-0G060PlgGXUrSfHRPVCOqpJrrZEY0j_QWyFqFBpA==
24.9e93913f.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
49 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.9e93913f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
9166b352495a70d02631c9792d021598f6ee53bef4f49baa766a059e6f9c8190
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:09 GMT
x-amz-version-id
TKLLvkDHW8MNe4LTIWvBlrDRRNKrxHZ.
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133973
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"b0ce2074e6898eaf63dee45cca7a4495"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ifefMQl__9t95CdoKAjUaPKQCXkmTKgZARMFHQPS3XJe5r9Flft1kw==
15.208ab4b1.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.208ab4b1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ac5c3099d242c2fd07f0fa0d35c9b3ed1b92131c3695cf57f9bc705265f6a015
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 18:43:35 GMT
x-amz-version-id
KNuTtXlcmMzrg4EKw.awx9impLtGSw_Q
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
113787
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 17:50:20 GMT
server
nginx
etag
W/"a3fa3f203c479117841708b0658154b7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
X5qQPo59GiiIE--E5DzvmJaEJkIHbFZwhzrrTymnXtkQErhg39GpmQ==
34.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/34.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sat, 02 Jul 2022 23:19:59 GMT
x-amz-version-id
_3ypchvV2Y1htZw1RZMu3A33yhTTURn1
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7614003
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:54 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
eY239BJO-o975ZlB7owKxj8xHqibvkhh_xE-oZ5u-HKmbJl46X4-3Q==
34.07340d2f.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/34.07340d2f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
5949dc5ef9ac0f8cb0d210d221d6eceeca2ffad94e3600b41566f468e146ae9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 04 Sep 2022 10:39:43 GMT
x-amz-version-id
jA_v_qJOBqqVuVuzFLKFbJbdj51OP00D
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
2130018
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 25 Aug 2022 18:10:17 GMT
server
nginx
etag
W/"f732dfb3db72f996e1f4bc0225629a20"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fyEW7fkV4mIiCuHKEIAjMA6ULq06iv5thLQucftRPBiXmcFDS7mPsQ==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 23:25:32 GMT
x-amz-version-id
FXhpBdntUhclEQbRyN38j73SJPN5DG6s
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
8477670
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 17 Jun 2022 14:39:26 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
i_kbNL8tRREyq1yu1QjPmiA08SrgJUAVhZutol66jj7k9Rd7Csk3XA==
26.2d4cdbd1.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
34 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.2d4cdbd1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
71e905aff9bad1d3b5a783336fcdd013cc97beb8985e4cd2cf7d195925a48211
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 31 Aug 2022 18:23:27 GMT
x-amz-version-id
siv4sYmLp3BEOV5kWKjSS9V7tHMZAkGl
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
2447795
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 31 Aug 2022 18:10:09 GMT
server
nginx
etag
W/"c55d27c90bd5affbf7c7047151ac3b6a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mUyFiORvmWx_l1vnFp1i7v8J-KJPW1QFirwkGPSXFBvJW2DWAwkxAA==
27.9bf46b67.chunk.css
js.driftt.com/core/assets/css/ Frame 8A55
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/27.9bf46b67.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Fri, 12 Aug 2022 18:08:02 GMT
x-amz-version-id
OwtYu1UfCDk9O65HArj6B6mV7fLBXaFN
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
4090320
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 12 Aug 2022 17:25:54 GMT
server
nginx
etag
W/"4f21faf2ba450e5fcdf7eda90813e185"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EQA8UK2EuvndikGgQZsKAXOEByOVwp-bICn8lb0Ihfq4LPoWYgx66g==
27.8ce71763.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
13 KB
6 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.8ce71763.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
70a312bca25d7ef781c740dbd24da745dd7497e9189ac319983b7ab8d7ecc6dc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:11 GMT
x-amz-version-id
4m89pd1hZD6.1b2OhUNLYqPxt2viGYcz
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"95bfb1423cbba7940f8fdc86ec6829d8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
83fle8EK1uizW4YI5NWg_R6BOYMHN8uM3esPsM_zY5o3qvsnYRB-KA==
19.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame 8A55
365 B
1012 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/19.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:07 GMT
x-amz-version-id
_GKDVm7cwHRbprAEZ8WoHMzXEQGGTOt2
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-pop
FRA53-C1
age
7527895
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Fri, 01 Jul 2022 20:20:53 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
4bLIHEkEltdEqtvuZwMRTXVVBKuRj1VSFAXhz3sNwL0ruSLACPoMVQ==
19.ccc4dd0f.chunk.js
js.driftt.com/core/assets/js/ Frame 8A55
90 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.ccc4dd0f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
b54842779c45583692387ab3c5a25856b096651ce71ca021bf4851dd695d957a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=trrsm2wf4gwm&region=US&forceShow=false&skipCampaigns=false&sessionId=8b201b8a-bfb2-4e2e-86d6-ff43c7a2db5a&sessionStarted=1664418002.303&campaignRefreshToken=a5bde463-6f7b-4b75-883d-7df8e3a90963&hideController=false&pageLoadStartTime=1664418000348&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:11 GMT
x-amz-version-id
IEfu.nS.7rMKDGUmIJ2zWU7noVl9Gbdv
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"1c76d62c0affe1337ebc4f2f2fe16a18"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
f5_nuTk7_XRCco-xUwsSdBOJmNU1kXNT9OZpJs_EsJ6LXhCIMfbdFA==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 23:25:32 GMT
x-amz-version-id
FXhpBdntUhclEQbRyN38j73SJPN5DG6s
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
8477670
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 17 Jun 2022 14:39:26 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
NUcGAWml1MsxLzQwO6OS4Jn2c5rd0JGFwlynZ-uNNvD15yOpsxmwpQ==
3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Sun, 03 Jul 2022 23:15:07 GMT
x-amz-version-id
tCdSVILzeupU.nQrAVkA0bwYUW3c2XL3
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
7527895
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 01 Jul 2022 20:20:54 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
bK7sVaLU3jKcZc-WhW8a-Dh0UPYMpzRqh9PptK76UAFR1ncC_qwpsA==
3.f50b964b.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
54 KB
15 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/3.f50b964b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 07 Sep 2022 14:05:26 GMT
x-amz-version-id
_kry5Vt7qkbP1XHkOczJttIwv4KZoljE
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
1858476
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 06 Sep 2022 19:38:20 GMT
server
nginx
etag
W/"1ac37bf2b93050f29058b66a9ad43e10"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
dShJDXTtkNkGHy5zjfJxf0Yd0Fd80rGLWtR3greYvgqtdpf8ztXggQ==
1.2744e555.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
43 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.2744e555.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
7073fd7f7f86e4d7fa4ee64df42999c3a58d3ffd7f842b0e8e98001407a1966b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 22 Sep 2022 21:23:14 GMT
x-amz-version-id
h6NxhuFNLOMjRNKgXauNxPDXvquTMVXm
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
536208
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Thu, 22 Sep 2022 21:13:24 GMT
server
nginx
etag
W/"faf2e5ac2f9cf40f3d49e4c4f468e306"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
JOI260-COwJp6xe2arRYt96YQB_FkpYXW9_NH4DNU7lV5VvIXLSFpw==
1.1c7fb383.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
73 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.1c7fb383.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
d8bcf63d35af3a96f7d4452d9e1c101088ea24b1d1468e8a3d83b4cb2c461b36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:11 GMT
x-amz-version-id
d_s8TzPhBP39_AYJc0vsTfLmMiuEJ4oi
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:36 GMT
server
nginx
etag
W/"ac64b4f4915282bfbeec816a742bd570"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
x5A4FUy7GuGthW43VS3-zGZ3NTu2C14vgEqtUIKVjwH463luz2xAkg==
32.a3318c5e.chunk.css
js.driftt.com/core/assets/css/ Frame 5B95
14 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/32.a3318c5e.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Wed, 21 Sep 2022 13:41:58 GMT
x-amz-version-id
Tq0yzJUum5RyM1Vf648gx8d4gVPONjH2
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
650283
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Wed, 21 Sep 2022 13:23:51 GMT
server
nginx
etag
W/"b06e02b360914b25e58305b1b9b954dc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
CvqONB4aexmxmIPcPCQZA-K2dkE3Kyt2wgxTRHhZYT-05SlRDbmGJg==
32.d5d47ece.chunk.js
js.driftt.com/core/assets/js/ Frame 5B95
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.d5d47ece.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.7659985d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.215.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-215-107.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
650c03f603ba5cfdfbecf0d8f7a031c73e1321e27c0c419230e1af7be12112e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1664418000348
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Tue, 27 Sep 2022 13:07:11 GMT
x-amz-version-id
wXCfB9nghzbvqtVACieGZDuOZ6xciMKI
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
via
1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
age
133971
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Tue, 27 Sep 2022 12:54:37 GMT
server
nginx
etag
W/"eeddb065f27c76dc4eec2ca704676575"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pQCjQiGF4uzaCYaw1oxLvXE6bYxn9c1MEXFVGEFZKm5bWyxa2Hwpgg==
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 8A55
25 B
123 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/48.36272856.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
Authorization
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 29 Sep 2022 02:20:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
8c6c7639a6c16449
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
23
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Thu, 29 Sep 2022 02:20:03 GMT
requestid
drift90db87d4c3e9eb222f888aa29ae
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 8A55
147 B
245 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/48.36272856.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 29 Sep 2022 02:20:03 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
9669fcd14fe344c3
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
147
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.16.7.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-16-7-188.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Thu, 29 Sep 2022 02:20:03 GMT
requestid
drifta9763df4ccdb0945a6003718cf7
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
8
img.gif
b.6sc.co/v1/beacon/
43 B
494 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A03%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A02%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:03 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"60bb2e15-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A03%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%223006%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:04 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A05%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A04%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%224008%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:05 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame 8A55
25 B
88 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/48.36272856.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
Authorization
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 29 Sep 2022 02:20:05 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
istio-envoy
requestid
fecdbd1d2f77c734
access-control-max-age
1209600
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
vary
Accept-Encoding
access-control-allow-credentials
true
x-envoy-upstream-service-time
25
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Thu, 29 Sep 2022 02:20:05 GMT
requestid
drift9e9398241ff95820ffd7716cee7
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A06%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A05%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225009%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:06 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
493 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=978e5d07c2a3a90aa4884115fca62376&svisitor=null&visitor=38bad774-5999-47f3-8ec9-2fdbc9ea5ba0&session=f0aaeafb-54b6-44e2-87b3-f8e71785046c&event=active_time_track&q=%7B%22currentTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A07%20GMT%22%2C%22lastTrackTime%22%3A%22Thu%2C%2029%20Sep%202022%2002%3A20%3A06%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%226012%22%7D&isIframe=false&m=%7B%22description%22%3A%22The%20Menlo%20Labs%20research%20team%20analyzes%20Qakbot%2C%20one%20of%20the%20leading%20banking%20Trojans%20around%20the%20globe.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22An%20anatomy%20of%20HEAT%20attacks%20used%20by%20Qakbot%20campaigns%20-%20Blog%20%7C%20Menlo%20Security%22%7D&cb=&r=https%3A%2F%2Fpages.menlosecurity.com%2F&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&pageViewId=89452cf2-3613-4179-8566-46d8828947ca&an_uid=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.menlosecurity.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date
Thu, 29 Sep 2022 02:20:07 GMT
x-content-type-options
nosniff
content-length
43
pragma
no-cache
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
etag
"615ccf10-2b"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
image/gif
access-control-allow-origin
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials
true
accept-ranges
bytes
access-control-allow-headers
*
expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
analytics.twitter.com
URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=6bd7d42a-fb60-4e2c-b65a-96e52a5ed248&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=166fe2be-2444-419b-ac4d-6b917f686e0e&tw_document_href=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nx5nr&type=javascript&version=2.3.27

Verdicts & Comments Add Verdict or Comment

200 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| OneTrustStub function| OptanonWrapper object| dataLayer function| _ undefined| $ function| jQuery string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData object| MktoForms2 object| runtime object| regeneratorRuntime function| setImmediate function| clearImmediate object| wp function| sprintf function| vsprintf object| gform_i18n object| gf_global object| gf_legacy_multi object| gform function| postscribe object| google_tag_manager_external object| google_tag_manager object| google_tag_data function| announceAJAXValidationErrors function| gformBindFormatPricingFields function| Currency function| gformCleanNumber function| gformGetDecimalSeparator function| gformIsNumber function| gformIsNumeric function| gformDeleteUploadedFile object| _gformPriceFields undefined| _anyProductSelected function| gformIsHidden function| gformCalculateTotalPrice function| gformGetShippingPrice function| gformGetFieldId function| gformCalculateProductPrice function| gformGetProductQuantity function| gformIsProductSelected function| gformGetBasePrice function| gformFormatMoney function| gformFormatPricingField function| gformToNumber function| gformGetPriceDifference function| gformGetOptionLabel function| gformGetProductIds function| gformGetPrice function| gformRoundPrice function| gformRegisterPriceField function| gformInitPriceFields function| gformShowPasswordStrength function| gformPasswordStrength function| gformToggleShowPassword function| gformToggleCheckboxes function| gformToggleRadioOther function| gformAddListItem function| gformDeleteListItem function| gformAdjustClasses function| gformAdjustRowAttributes function| gformToggleIcons function| gformAddRepeaterItem function| gformDeleteRepeaterItem function| gformResetRepeaterAttributes function| gformToggleRepeaterButtons function| gformMatchCard function| gformFindCardType function| gformToggleCreditCard function| gformInitChosenFields function| gformInitCurrencyFormatFields function| GFMergeTag function| GFCalc undefined| __gf_keyup_timeout function| gformFormatNumber function| getMatchGroups function| gf_get_field_number_format function| renderRecaptcha function| gformIsRecaptchaPending function| gformValidateFileSize function| gformInitSpinner function| gformAddSpinner function| gformReInitTinymceInstance function| gf_raw_input_change function| gf_get_input_id_by_html_id function| gf_get_form_id_by_html_id function| gf_get_ids_by_html_id function| gf_input_change function| gformExtractFieldId function| gformExtractInputIndex function| rgars function| rgar object| addComment function| HandleUnsavedChanges object| gfMultiFileUploader object| Placeholders function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si function| twq function| hj object| _hjSettings string| _linkedin_data_partner_id function| fbq function| _fbq function| hushly object| __hly_widget_object object| HushlyEmbed object| __hly_embed_object function| saq function| _saq function| drift undefined| driftt object| techtargetic object| Optanon object| OneTrust function| addCaptchaScript object| jQuery112409049213041236781 function| lintrk boolean| _already_called_lintrk function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin function| onYouTubeIframeAPIReady object| gaGlobal object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO object| $jscomp object| fcdsc function| fcdscLoad function| ES6Promise object| Vimeo function| __vimeoRefresh object| twttr object| MunchkinTracker object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked boolean| _storagePopulated object| google_noFurtherRedirects string| GoogleAnalyticsObject function| ga string| widgetSource object| gaplugins object| gaData object| ziws function| _initClickagy string| res object| saCookies string| current_window_url_param function| webpackHotUpdateHushlyEmbed object| core object| global object| System function| asap function| Observable boolean| _babelPolyfill function| hushlyForm object| jQuery1124016688068778065257 function| hushlyCountriesCallback function| hushlyWidgetsCallback function| hushlyVisitorCallback function| hushlyFormSubmitCallback boolean| hushlyIsReady object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id

44 Cookies

Domain/Path Name / Value
.pages.menlosecurity.com/ Name: __cf_bm
Value: HqSz2_gKarXiT9QSXDqihoeApLJBEa9KB4Omg2kB8lU-1664417999-0-ARCQFwyVyZ74t4egT7AYPrGzaE4WDy6I5K8nqmCsX41UAMB+QFgmD43aks3PKIy5klvVaxGwUQCVCwqr0ZOGVMc=
.info.menlosecurity.com/ Name: __cf_bm
Value: FQOTeCR7flfnnLPhyZlFE5.aaY3OXC6AijrlIBoxKDU-1664418000-0-AXAa2lU6c9lpLhdQG/9GrmAngo2gB/vC+nEROQbAcKTX5z5Mwrz7UrXrFN1oSNg5GoNMw5bvl37VKkisPvVVOS0=
.menlosecurity.com/ Name: _gcl_au
Value: 1.1.1015236252.1664418001
.techtarget.com/ Name: __cf_bm
Value: dRTooFoP9qvvxfxX6HIauKjoXFFOLgX5b0nMCJvY7oY-1664418000-0-AVa8R/zbsPVZbbww2eligXft1fh03QJomiL4FJFt5ETmMnojycpmupzen1xBoncDbDuXb/nRwvgNu08HgL/6kPA=
.menlosecurity.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Thu+Sep+29+2022+02%3A20%3A01+GMT%2B0000+(GMT)&version=202209.1.0&isIABGlobal=false&hosts=&consentId=58605c8e-8266-4b1f-beea-5a50284a07ba&interactionCount=0&landingPath=https%3A%2F%2Fwww.menlosecurity.com%2Fblog%2Fan-anatomy-of-heat-attacks-used-by-qakbot-campaigns%2F%3Futm_campaign%3Dcontentnewsletter-sep2022%26utm_medium%3Demail%26utm_source%3Doutboundemail%26mkt_tok%3DMjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3&groups=C0003%3A0%2CC0002%3A0%2CC0004%3A0%2CC0001%3A1
.menlosecurity.com/ Name: _ga_C2G0PCSJKE
Value: GS1.1.1664418001.1.0.1664418001.60.0.0
.menlosecurity.com/ Name: _fbp
Value: fb.1.1664418001047.1945415945
.menlosecurity.com/ Name: _fcdscst
Value: MTY2NDQxODAwMTA2MA==
.linkedin.com/ Name: UserMatchHistory
Value: AQJqNoEyy1gS9wAAAYOHCzBuB_37ooDaVKNzR89mwUzCu7mKiZVyXuSLfMPF8xP9eFjSBfstO9WurQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQLLzitfJyIHUQAAAYOHCzBuhP11DVGFTWSw7h1j9Dt1BVTNZ-OArp1QWJiYSzsdbLmvpoTDFFgTcIUDUVFuRg
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&1f20d067-fb72-4a52-8f00-e0de806e6945"
.linkedin.com/ Name: lidc
Value: "b=VGST06:s=V:r=V:a=V:p=V:g=2489:u=1:x=1:i=1664418001:t=1664504401:v=2:sig=AQGc2jNOGsusZ-RA5fnU1JZ8zn5m540E"
www.menlosecurity.com/ Name: _an_uid
Value: 0
www.menlosecurity.com/ Name: _gd_visitor
Value: 38bad774-5999-47f3-8ec9-2fdbc9ea5ba0
www.menlosecurity.com/ Name: _gd_session
Value: f0aaeafb-54b6-44e2-87b3-f8e71785046c
.menlosecurity.com/ Name: _mkto_trk
Value: id:281-OWV-899&token:_mch-menlosecurity.com-1664418001100-34915
info.menlosecurity.com/ Name: BIGipServersj21web-nginx-app_https
Value: !ZjJA7EZOtJOxhELOF/6EdpB26h7ooOElxrJNSzwJjYNOo4/xJ1DBA0LJVSPYxXrB/gBPT14vdba3Xn8=
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.menlosecurity.com/ Name: _hjSessionUser_1854968
Value: eyJpZCI6ImJkYTBiNTI0LTc3YTUtNTQzZi05Mzc5LTkyZDQzOTg3MDk2MyIsImNyZWF0ZWQiOjE2NjQ0MTgwMDExNzUsImV4aXN0aW5nIjpmYWxzZX0=
.menlosecurity.com/ Name: _hjFirstSeen
Value: 1
www.menlosecurity.com/ Name: _hjIncludedInSessionSample
Value: 1
.menlosecurity.com/ Name: _hjSession_1854968
Value: eyJpZCI6ImIwMTVhOTNiLWU0ZjctNDYxZS05MmY5LWRmZGIxYTRhMDcyZCIsImNyZWF0ZWQiOjE2NjQ0MTgwMDExOTcsImluU2FtcGxlIjp0cnVlfQ==
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&20220929022001b8ae0fd3-2fd9-4330-8e04-1b36ba853108AQHpL98lUpqslYqgoCKkC3ba9do1EdTc"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NjQ0MTgwMDE7MjswMjEpmPL/R8pgNvbL26RMvLWA2pVN89uX/v/jg7UZNARQ2A==
www.menlosecurity.com/ Name: _hjIncludedInPageviewSample
Value: 1
.menlosecurity.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0.fNaEvZogzAFFpdF3pzgQSCuTrMw8sCci4fwL1VIdpXg
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3Aw8jJg6oKQIFDfYDTamru8LKi0YI.OCbDpFB3qhbnxW%2F9XzyBKEvgaV%2BWlLZtv8WYkPxmRMs
www.menlosecurity.com/ Name: sa-user-id
Value: s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0.fNaEvZogzAFFpdF3pzgQSCuTrMw8sCci4fwL1VIdpXg
www.menlosecurity.com/ Name: sa-user-id-v2
Value: s%253A0-c3c8c983-aa0a-4081-437d-80d36a6aeef0%2524ip%2524178.162.209.130.F32rR9XePOYqDxnTKNsH1VeKbGp1r3nDmtnuB5b1kTM
.6sc.co/ Name: 6suuid
Value: 2d496768ca5b0000d10035633001000067435201
.t.co/ Name: muc_ads
Value: 53ce0b71-a95a-4e4d-998b-a3fef661ff7e
.menlosecurity.com/ Name: _ga
Value: GA1.2.1329568452.1664418001
.menlosecurity.com/ Name: _gid
Value: GA1.2.1013979325.1664418001
.menlosecurity.com/ Name: _gat_UA-41161362-2
Value: 1
.ws.zoominfo.com/ Name: visitorId
Value: 3af7459cf3a4710e6253e1eda28d1121ec91726c76b4fdeb0adf65e7893466c2
.zoominfo.com/ Name: __cf_bm
Value: G6Bj693_cDFUh5ZDYFFGMkQvZeNM5iI2UEtb4MbeJ18-1664418001-0-AUdpq2liEub5mMncT3pjm7m6LrpAA7DqzHFTw34my0iGfjERcJ1yZcFlvo8eXouWId97q8ZNK8Eoz8Ukyb2Z9QI=
.menlosecurity.com/ Name: _hly_vid
Value: 83dd3f5c-4374-4e04-a24c-a6bb23855b2a
www.menlosecurity.com/ Name: _hly_sid
Value: e8f1434e-7925-4916-b03e-e340c8d9c4ee
www.menlosecurity.com/ Name: drift_campaign_refresh
Value: a5bde463-6f7b-4b75-883d-7df8e3a90963
app.hushly.com/ Name: AWSALBCORS
Value: ZU6gutu0NROS7ylSdqt228v8NWF3+xzr97WHgssGZRooIyIBXQuv303gNBxWxmPH+SqK5D9hS+O9qL9PBBgdtimpY7fwp6rLKLi/qJQ1I5WCkHWpSiKrgR+E34RX
.menlosecurity.com/ Name: _fcdscv
Value: eyJDdXN0b21lcklkIjoiMTg3ZDIxMDMtYmRjNS00ZTNmLWIwNzAtYjVjNmE0MDAwODQwIiwiVmlzaXRvciI6eyJFbWFpbCI6bnVsbCwiRXh0ZXJuYWxWaXNpdG9ySWQiOiJkYWUwMmI0MS1lZjc2LTRhNjMtOTIxMi01ZDQ5YzRlNmEzY2YifSwiVmlzaXRzIjpbXSwiQWN0aXZpdGllcyI6W10sIkRpYWdub3N0aWNNZXNzYWdlIjpudWxsfQ==

3 Console Messages

Source Level URL
Text
security error URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Message:
The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security error URL: https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Message:
The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
network error URL: https://id.rlcdn.com/711861.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'self'; img-src 'self';script-src 'self' 'sha256-/YnUXDg3CeAuS43OqfDJbQ2/MHKriaB/H+fh1NJcllE=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

281-owv-899.mktoresp.com
analytics.twitter.com
aorta.clickagy.com
app.hushly.com
apt.techtarget.com
b.6sc.co
bootstrap.api.drift.com
c.6sc.co
cdn.cookielaw.org
cdnjs.cloudflare.com
connect.facebook.net
d2i34c80a0ftze.cloudfront.net
epsilon.6sense.com
extend.vimeocdn.com
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
googleads.g.doubleclick.net
hemsync.clickagy.com
hubfront.hushly.com
id.rlcdn.com
in.hotjar.com
info.menlosecurity.com
j.6sc.co
js.driftt.com
metrics.api.drift.com
munchkin.marketo.net
pages.menlosecurity.com
pixel-sync.sitescout.com
px.ads.linkedin.com
px4.ads.linkedin.com
region1.analytics.google.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
st.fullcircleinsights.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tags.clickagy.com
tags.srv.stackadapt.com
trk.techtarget.com
vars.hotjar.com
ws.zoominfo.com
ws30.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.menlosecurity.com
analytics.twitter.com
104.103.80.163
104.17.71.206
104.244.42.133
13.107.42.14
13.32.27.21
141.193.213.21
142.250.186.98
143.204.215.107
143.204.215.65
18.66.97.13
185.89.210.101
192.28.147.68
199.232.136.157
199.232.18.109
2001:4860:4802:34::36
206.19.49.24
2600:9000:214f:ec00:13:a3bc:6800:93a1
2600:9000:2490:b600:9:14eb:6280:93a1
2606:4700:4400::6812:2962
2606:4700:4400::ac40:91d9
2606:4700::6810:650c
2606:4700::6810:9440
2606:4700::6811:190e
2606:4700::6812:1fcd
2620:1ec:21::14
2a00:1450:4001:808::200e
2a00:1450:4001:812::2004
2a00:1450:4001:82a::2008
2a00:1450:4001:82f::2002
2a00:1450:4001:830::2003
2a00:1450:4001:831::2003
2a00:1450:400c:c00::9b
2a00:1450:400e:810::200a
2a02:26f0:3500:16::215:149b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.94.218.138
35.158.89.114
35.244.174.68
44.205.92.219
50.16.7.188
52.41.193.136
54.162.244.84
54.175.93.244
54.246.176.35
54.73.164.173
65.9.66.34
66.155.71.25
92.123.8.217
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
01cbac3c4e6bb2c6e2006fc5b2c60181bb18f6c0e75c3d12e5030508bd0afdfc
01f88b2ef74b87c24f299c6e80b39e9dd5a16c72ab3e72c29f1ef013d98a3fc1
028681bcca47845bfbff40c0138bbc79bf216afb3b6ab233647f63889548b9ed
0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849
073b97779f9dc3c731a8c153f3f8dcfe2dc8f99a2c5ad7a279361a08e0302dc0
078f3dd88e751c3c421b2007e1cb27bcb65a95daf278bd25de81ba7b2bf3c4e4
083e034c141e8d22cfd41ec3547b841a3f5409043304ad4df96a17f9d9991b1b
0ce5c3f8080f47c836504791f325bc1347930bf1fd9c5eff12d45e7b60301d0f
0e80fa7380340a7651059a8b3d0d8ee3612d68c21a82206eaa5b0322b8263725
0f9be297502b6ab0826a96ea3dc949fc5a970c993aadff30a4bdd2553a3c0f0b
1026dbcff11e16ec34fe5cb7369461ac343cd39b366cb612afe40d0f6d27a3d1
11374f38070555c45a2cf29c753bcd7442517ef7d7afdbe2d381f8235efeffcc
146b085fcb240a04c301d265173b47e2794d3fd86c26ccb986ca01095fe8f847
166c7c3bb5f76f977a9f2a5490589b3466374eb2b3f064802e56f08bad71fbf0
179a0ba55c3bbf759340ba2a57846f81a7de249ed7e502b5e8814af2ef964533
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1ab40eecc07bcbd5e811b6394d9be884a3a8e5fe951f94b7489d5a9ae7452e32
1c27bb55dc2fe6453e72fdfa7726fc8b74473bbffdbc424df999dc7751bf7ce3
1dc4b29dd0acbed77ec2fd81036c33efd4ab5989e8182705a30615a00a0117f7
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
277c9b6c6219a0c11b324e1a82502fd207cb8ad6b48d122ad8c8fc05f7ba76b8
27a1b0f5f06a48e71b246e8db0eb4cf81231a066ac127a10674ac5b7eb5e2426
27ffddbdf026a02fd33149cb67c390598afb35ba650e4e1b3e1dc4a989de0614
2b065a0026be768ecfa77a6645a074c5c65a789f2889c1d1c4b22e96fd38f1da
2c49d9c346ac743df2351f62a73c3087dd91b1f51c86f6a824b2944394e04d92
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2fdc6ebde3de6f6c81c8051a259c52dcb6145ea0e35b85e32bc208cb03cf795c
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
33939bb9d827d73e58f184dd1b06e5024b34d62373bd41ce2aea6058d62aa902
34681d58d47f031f35460672e44c4f42139fe8bf5cbf21b3d80d501581c5b50f
38b6e792cfa117ad887d73f850c1f7f0b6fb19ac74dce132283016cb3bcf62e4
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
41b758f84ab2dd5da6f7ba488813d17410ebb48bc2074d304c26d63c5ece003d
43c072c16c9ee6d67acdfa6c6d6685ff1e74eb4237b7cc3c1348ab1c108b26af
4445c4bd516128597fa60e58eafeaa3a0aab2dfc051700bde95d836707c3bf36
45dfb7e29904225979783d62efbf600377472d8d55c0fd886d7ea9d449387946
4611e98122a2c3ddb76f6e0d3e88d1fdeee2844edb65d1a4e03aa1335c56a901
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
46bfa786e5eb8e2a57006959a64f6271b8c0a6cafb891f87f65685da63432289
487d3252e04d702f033dd508688732af1b78b9a5a604a5699288b652ae9f9b5a
49b9b4996d1ff0a8e3de643a0c623255bf631f298f2799b949c29de93926ee7a
4c61668fe02ae42129e33ad07239d82f1b32b5377c57f37e1c36cdaca0dc04a9
4eda4b5575532ad6a713d3d9bbcde581c519d9b8d0202363925ddc80049eed6d
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5949dc5ef9ac0f8cb0d210d221d6eceeca2ffad94e3600b41566f468e146ae9a
597514d432ff2059b3e477385c44fb38d44c73f5d640eebe645cf3b340bcff56
59cb7d5683f72d2920b70698c6a9ffecfaaf2479594108b481c94d3848750bd9
5ad3e9b8814017f830cf1e24acda2861569f987fd58da61f028aa53195032037
5bcbd83d020ff272645c59dff179841df9374a6295f324eee00b9de4e67bc1cd
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5df2942db2352e49e00bcf3393b875a71d0acee986e48fbdcc5879846f5c3689
62c994195bf30d1607e2d7b8cc5eaf8d9c30c7f78e6e32eecc676a3f74932e43
650c03f603ba5cfdfbecf0d8f7a031c73e1321e27c0c419230e1af7be12112e9
65840540a4eb64f7174e6aede36b1ecc0f5108394f90929eb4f03e2d54e0bf76
68b4b6fc343811ef9268a786ba1a6d45532277051d2db7804896df2b58a9b429
6a5c1d85da5ccf4daae7b3abe3ace2b4635118fdb8e83dc99c73792811f79839
6c45006c40d76e72f40e88dc8e91670aeb859178d60536c3b412f79fe5399b21
6c649cc3d4aee7683250622541a6045ad4ac3beb93df1fcdd3ec1f7f12a1ff44
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
6f51bbe7b57914a96209c33c6a7a2d21f01b93f346fe27e5349249bc6a991679
6fecb89a29ee2bd397bb1bf58ecaa530a76f0654db71fadefd3cc70b0bc302bf
705d98d3f835e14b073f58d714f9325d2472aa62d5bbb9fc8b3683a10180e6bd
7073fd7f7f86e4d7fa4ee64df42999c3a58d3ffd7f842b0e8e98001407a1966b
70a312bca25d7ef781c740dbd24da745dd7497e9189ac319983b7ab8d7ecc6dc
71e905aff9bad1d3b5a783336fcdd013cc97beb8985e4cd2cf7d195925a48211
7241e72a9b6c21a28ce6531b73eed7bd11ca1bc737d88f86d74bda1682b4a123
7501d6f1489d7878ea71a2bb48211bc0ae0ab34fd934c4129d0089610e0f4c07
77d5fe96defd6c8c1e3b0466b4827cf83dc7e5c727a10177e115d25132fa86f6
7802fc0fe623626f3bb3f3b4c1bc7d7180680a22d2b6c2486776d5fbcb272117
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
78d8ab2b9baadd2598db1f3035673d66f361b5111238ce78b80deedc0508efb3
79d8bfb0ff06d8516e46d4457bd951ed893d2deed31ab348227e06c91a5a35cf
7ce9b6f41c9f13ae8712652facbd81ed5c268231ee7a64075f982b59c273e640
7d3b9b124ab86b33b4c72d29ceca9c5a56e5205e546394f55e1ca7fac57d58d5
7e5f7f0d7ed80280f0a84f08b2494b6bf509d6a44d683d8a2bafc5a690635310
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
82f2ed7025e02d8cfe7cc0dc70af22445159aa40de8e4003f11f502560885ae1
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8545749101fc8aeb139c07538cfd2db5c79029985962526aa817b899c75b67ca
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
867b23a408fa99143955de5665345cda886857174c328d2828e5dcd33bd98cd1
8dcbdf941f2ac36658027af985c8621d3468eefde9ab793f38f6fa53bc22aec9
91623c33aade4a8d9370f6b51c6baf9680e6de834d33185a4f672ba7778fbed6
9166b352495a70d02631c9792d021598f6ee53bef4f49baa766a059e6f9c8190
91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
958c2ecbdd6c6708cf566ceb9b10ffd133ceef822ce81ef460db8ca29e44bcb5
977930fc96f7aeda8c849fe1022320d3c8ceb631dea2f1e0db36a6ad16ecf9cc
9acb38caafe1e9d1b575ce22fb7af46173b1ab43d8614f0c059240a2523bce4c
9b05f32b262a8ddfa4c0322b0b4b376258b7996177b98d5a1e2b4585d20cba27
9b93be100a1e7d46aa5eecd3dfc15f4a9b3d18eb615d5ddff3c009bb266ab37c
9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134
9c03e696d15ec089b9e3ee5b6f1450019259530dd19044175a2b9953d430fa79
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
9e25469f734732205f33dd80ff8ca12080406c18d2fa99a1f368103e51f7999f
a5e66f504cadc4d8337b616b6feac08f9e315629cb20bafae90875fc5de66fac
a77bb1b8bfef4a56cbbb32a3f0db155355f7259e1505797dcce1c128be3a97a1
a7d6070b955f11f31a679ff7742f6fe382348f7b71934cf2e8596ef1908c684a
a8c5b8661bffd49a78d3e246245a68fee8890d578a839e550f38097c87ae22db
a980fc04a01d4c539a6c8e3c5e8ef4663cee2eecdd45ceed3c908fe979e7ca26
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac5c3099d242c2fd07f0fa0d35c9b3ed1b92131c3695cf57f9bc705265f6a015
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
aeb710f8a6b5bdc7060765e78057a6ed37f596e1799477528a42aad6fe0669f1
b43508242f21a59b37bba45231dd25c6c861e079ef05607273c620337e217b9b
b54842779c45583692387ab3c5a25856b096651ce71ca021bf4851dd695d957a
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b71f76186117ab510aca8eb8208815da837acdd4b29e171c9897993175c28878
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b8bc4ed1493c1977120d12182cb046732ffad208a75d936ce32944c7deddddd2
ba1b5ba457e3244bfc1b5e32428086b59e9738588b18a6620b9b437b31e48211
ba482add0c02c927f05b5078b949334e4d1db145525061a0bb29b70bda92b9c7
ba552b1989b489cc4c619989de193cf07efc5f26419edb00563c3cc9007706ad
bbc4456bca95006683a8f081d0d2ed645eef5b14c62eca12c70f7e1cec26c1a0
bbc51bef34cba008dfc2d34de147d0591a4862740f461c6345b5aa2932553c8f
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bef857d0d4902ce2c1e5061786720d2bde7b06ec62f44b10a14895ce8c32b1b9
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c78a1da5fd0868a547cf285748c7fb73006571190385eb71c0d601b6b240ffaf
c9f4550700e5b31a1b49eba49ed6962e0775bcb1beeae987d0968f273a35effd
cc9914192e0a743ae5573b812ab10411abd58039f8d1971fcf08f5591a8f2257
d0b4256abed72481585662971262eabee345c19f837af00d7ce24239d3b40eef
d14e287ddae470b06c4639e73260ca21a4c9b7cfdf56e02965a8f50fb5333b42
d31c8324cb19809562244b53cc52b67032e5cb663b758de4cdc5a28169743d99
d7ead427aca51c227410c4595b49b48dde8f9e76864b4f3fcb32861034b0c6a2
d8bcf63d35af3a96f7d4452d9e1c101088ea24b1d1468e8a3d83b4cb2c461b36
da9a95d38c299c2e7c054de1fdca92d2daab3e719b7bbeb534c70d71e1bfce3f
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1cd92144ff9e7af94bc45cac521e92d5534c7447b4de28afc365dbbf8828658
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e87a8ee30b7f3e1fd90688380586a85641bc7a432e83be99cce7526e5f702136
ea6028aa03c2eda8725a67ffaff79e8498b464975d8a1744f983d9809c6810e5
ebaf946cd530720a8961470c0382dfb624418103367064695a177d742f8b78ef
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ecb4cf1400337bb3e1f8d6e9c312534a7e4a786832b909799c1d26373371861e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0f531f80dc4f4cc608c980ef4b861051671b4b24cd9c63c21fea43f4effc341
f30769ea0b80a5d900c5f0de30b1aad1ab461195e69223d5ef63c2c5de8b6c1a
f3342c52eee43a2ea931cae2ee2d6d9a2939432ffcb03bb4f2983ac7e49b26cc
f38bfa814ad4096dccf3892ea2c80c4d8b79e5e8ba7043c7c730b2061a2d2102
f3c18a1480a0be2734d4bd401116a73bcce58d160ca8b73e5b4c1318e67c0650
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
f595a7eeaf2e9ef60746074e0ff87a1b6bf60355ece3559d666b9b59041dc976
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f84f90e0b8d058f6c6119cc65908765742a3f60f5f099a1eab14cd99118337c7
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fb6bcf7d9261064812fe1b4d2b59b8c8ca52b7d0c522746ba9cec2dc01b3a7d4
fbbc9565977aefcc0feb1d5dc6fe8a5f0e2b855f451618acd946af84bdce926f
fcecb97c12786d7a9387a81e74e4179790fd84425c9c75be1aec3aed645bf6e2
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a