www.sentinelone.com Open in urlscan Pro
172.67.74.101 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Submission: On January 19 via api (January 19th 2022, 3:08:42 am UTC) from US — Scanned from DE

Summary HTTP 216 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 56 IPs in 7 countries across 47 domains to perform 216 HTTP transactions. The main IP is 172.67.74.101, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.sentinelone.com. The Cisco Umbrella rank of the primary domain is 292282.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 9th 2021. Valid for: a year.

This is the only time www.sentinelone.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
22 25	172.67.74.101 172.67.74.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
32	2620:12a:8001::2 2620:12a:8001::2	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1 1	104.111.232.231 104.111.232.231	16625 (AKAMAI-AS) (AKAMAI-AS)
7	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	151.139.242.10 151.139.242.10	33438 (HIGHWINDS2) (HIGHWINDS2)
3	89.187.169.47 89.187.169.47	60068 (CDN77 ^_^) (CDN77 ^_^)
2	54.216.103.176 54.216.103.176	16509 (AMAZON-02) (AMAZON-02)
1	104.82.195.159 104.82.195.159	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2606:4700:10:... 2606:4700:10::6814:b844	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2008	15169 (GOOGLE) (GOOGLE)
2	3.215.119.159 3.215.119.159	14618 (AMAZON-AES) (AMAZON-AES)
1	2a02:26f0:f7:... 2a02:26f0:f7::5c7b:e053	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	142.250.185.226 142.250.185.226	15169 (GOOGLE) (GOOGLE)
1	18.66.97.53 18.66.97.53	16509 (AMAZON-02) (AMAZON-02)
1 3	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	151.101.192.65 151.101.192.65	54113 (FASTLY) (FASTLY)
3	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	104.117.217.134 104.117.217.134	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.222.236.17 52.222.236.17	16509 (AMAZON-02) (AMAZON-02)
1	151.101.129.2 151.101.129.2	54113 (FASTLY) (FASTLY)
1	199.232.136.157 199.232.136.157	54113 (FASTLY) (FASTLY)
1	2a04:4e42::396 2a04:4e42::396	54113 (FASTLY) (FASTLY)
2	2600:9000:205... 2600:9000:2057:1400:11:8a36:7200:93a1	16509 (AMAZON-02) (AMAZON-02)
1	99.86.3.92 99.86.3.92	16509 (AMAZON-02) (AMAZON-02)
1 3	185.33.221.11 185.33.221.11	29990 (ASN-APPNEX) (ASN-APPNEX)
4	104.111.233.140 104.111.233.140	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
2	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1	143.204.98.104 143.204.98.104	16509 (AMAZON-02) (AMAZON-02)
1	3.224.194.150 3.224.194.150	14618 (AMAZON-AES) (AMAZON-AES)
2	143.204.215.33 143.204.215.33	16509 (AMAZON-02) (AMAZON-02)
6 9	3.248.4.87 3.248.4.87	16509 (AMAZON-02) (AMAZON-02)
1	151.101.65.140 151.101.65.140	54113 (FASTLY) (FASTLY)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
1	143.204.215.118 143.204.215.118	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c07::9d	15169 (GOOGLE) (GOOGLE)
1 2	18.156.0.31 18.156.0.31	16509 (AMAZON-02) (AMAZON-02)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 1	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	18.135.20.243 18.135.20.243	16509 (AMAZON-02) (AMAZON-02)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1	162.247.242.18 162.247.242.18	() ()
2	35.157.40.192 35.157.40.192	16509 (AMAZON-02) (AMAZON-02)
64	18.66.112.39 18.66.112.39	() ()
216	56

25 172.67.74.101 (United States) 22 redirects

ASN13335 (CLOUDFLARENET, US)

www.sentinelone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2620:12a:8001::2 (United States)

ASN54113 (FASTLY, US)

de.sentinelone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.232.231 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-232-231.deploy.static.akamaitechnologies.com

cloud.typography.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

go.sentinelone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 151.139.242.10 (United States)

ASN33438 (HIGHWINDS2, US)

899029.smushcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 89.187.169.47 (Frankfurt am Main, Germany)

ASN60068 (CDN77 ^_^, GB)
PTR: unn-89-187-169-47.cdn77.com

a.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.216.103.176 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-216-103-176.eu-west-1.compute.amazonaws.com

collector-5527.tvsquared.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.82.195.159 (London, United Kingdom)

ASN16625 (AKAMAI-AS, US)
PTR: a104-82-195-159.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.215.119.159 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-119-159.compute-1.amazonaws.com

api.rebrandly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:f7::5c7b:e053 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-53.fra56.r.cloudfront.net

static.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

10466992.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.192.65 (United States)

ASN54113 (FASTLY, US)

tag.marinsm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.117.217.134 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-217-134.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-17.fra56.r.cloudfront.net

munchkin.brightfunnel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.2 (United States)

ASN54113 (FASTLY, US)

a.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.136.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::396 (United States)

ASN54113 (FASTLY, US)

www.redditstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2057:1400:11:8a36:7200:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.abrankings.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.3.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-3-92.fra6.r.cloudfront.net

api.omappapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.11 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.233.140 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-140.deploy.static.akamaitechnologies.com

c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-104.fra50.r.cloudfront.net

script.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.224.194.150 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-194-150.compute-1.amazonaws.com

q.quora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.215.33 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-33.fra53.r.cloudfront.net

api.brightfunnel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 3.248.4.87 (Dublin, Ireland) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-248-4-87.eu-west-1.compute.amazonaws.com

pixel-geo.prfct.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.65.140 (United States)

ASN54113 (FASTLY, US)

alb.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

327-mnm-087.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-118.fra53.r.cloudfront.net

vars.hotjar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.156.0.31 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.226 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.135.20.243 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-135-20-243.eu-west-2.compute.amazonaws.com

ga.clearbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.247.242.18 (None, )

ASN- ()

bam.nr-data.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.157.40.192 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-40-192.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

64 18.66.112.39 (None, )

ASN- ()

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
64	driftt.com js.driftt.com	750 KB
64	sentinelone.com 22 redirects www.sentinelone.com — Cisco Umbrella Rank: 292282 de.sentinelone.com go.sentinelone.com — Cisco Umbrella Rank: 453224	595 KB
11	smushcdn.com 899029.smushcdn.com — Cisco Umbrella Rank: 870514	8 MB
9	prfct.co 6 redirects pixel-geo.prfct.co — Cisco Umbrella Rank: 16437	4 KB
7	gstatic.com fonts.gstatic.com	98 KB
7	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 496	114 KB
6	doubleclick.net 2 redirects 10466992.fls.doubleclick.net — Cisco Umbrella Rank: 949615 googleads.g.doubleclick.net — Cisco Umbrella Rank: 46 stats.g.doubleclick.net — Cisco Umbrella Rank: 96 cm.g.doubleclick.net — Cisco Umbrella Rank: 197	4 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 42	57 KB
5	6sc.co j.6sc.co — Cisco Umbrella Rank: 9102 c.6sc.co — Cisco Umbrella Rank: 13654 b.6sc.co — Cisco Umbrella Rank: 6546	12 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	653 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 546 www.linkedin.com — Cisco Umbrella Rank: 647 px4.ads.linkedin.com — Cisco Umbrella Rank: 5501	3 KB
4	omappapi.com a.omappapi.com — Cisco Umbrella Rank: 5850 api.omappapi.com — Cisco Umbrella Rank: 5514	74 KB
3	google.de www.google.de — Cisco Umbrella Rank: 5557 adservice.google.de — Cisco Umbrella Rank: 8028	1 KB
3	google.com www.google.com — Cisco Umbrella Rank: 13 adservice.google.com — Cisco Umbrella Rank: 80	1 KB
3	adnxs.com 1 redirects secure.adnxs.com — Cisco Umbrella Rank: 404	3 KB
3	brightfunnel.com munchkin.brightfunnel.com — Cisco Umbrella Rank: 39064 api.brightfunnel.com — Cisco Umbrella Rank: 45175	8 KB
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 146	200 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 385	11 KB
3	hotjar.com static.hotjar.com — Cisco Umbrella Rank: 644 script.hotjar.com — Cisco Umbrella Rank: 919 vars.hotjar.com — Cisco Umbrella Rank: 1012	64 KB
2	6sense.com epsilon.6sense.com — Cisco Umbrella Rank: 15490	409 B
2	yahoo.com 1 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 283	575 B
2	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 537	47 B
2	abrankings.com cdn.abrankings.com — Cisco Umbrella Rank: 51200	8 KB
2	quora.com a.quora.com — Cisco Umbrella Rank: 7936 q.quora.com — Cisco Umbrella Rank: 3455	14 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 3672	6 KB
2	rebrandly.com api.rebrandly.com — Cisco Umbrella Rank: 670158	629 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	125 KB
2	tvsquared.com collector-5527.tvsquared.com — Cisco Umbrella Rank: 909123	9 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 47	2 KB
1	nr-data.net bam.nr-data.net	322 B
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 367	13 KB
1	clearbit.com ga.clearbit.com — Cisco Umbrella Rank: 50450	2 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 312	239 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 359	274 B
1	mktoresp.com 327-mnm-087.mktoresp.com — Cisco Umbrella Rank: 810804	311 B
1	reddit.com alb.reddit.com — Cisco Umbrella Rank: 1532	125 B
1	t.co t.co — Cisco Umbrella Rank: 487	227 B
1	redditstatic.com www.redditstatic.com — Cisco Umbrella Rank: 1463	8 KB
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 630	6 KB
1	marinsm.com tag.marinsm.com — Cisco Umbrella Rank: 28681	4 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 106	15 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1098	2 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 743	458 B
1	typography.com 1 redirects cloud.typography.com — Cisco Umbrella Rank: 5992	446 B
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 1711	36 KB
0	drift.com Failed metrics.api.drift.com Failed bootstrap.api.drift.com Failed
0	onesignal.com Failed cdn.onesignal.com Failed
216	47

	Domain	Requested by
64	js.driftt.com	www.sentinelone.com js.driftt.com
32	de.sentinelone.com	www.sentinelone.com de.sentinelone.com
25	www.sentinelone.com	22 redirects www.sentinelone.com
11	899029.smushcdn.com	www.sentinelone.com
9	pixel-geo.prfct.co	6 redirects www.sentinelone.com
7	fonts.gstatic.com	fonts.googleapis.com
7	go.sentinelone.com	www.sentinelone.com go.sentinelone.com
7	cdn.cookielaw.org	www.sentinelone.com cdn.cookielaw.org
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com munchkin.brightfunnel.com www.sentinelone.com
4	www.facebook.com	www.sentinelone.com
3	b.6sc.co	www.sentinelone.com
3	secure.adnxs.com	1 redirects j.6sc.co www.sentinelone.com
3	connect.facebook.net	www.sentinelone.com connect.facebook.net
3	bat.bing.com	www.googletagmanager.com bat.bing.com www.sentinelone.com
3	10466992.fls.doubleclick.net	1 redirects www.googletagmanager.com www.sentinelone.com
3	a.omappapi.com	www.sentinelone.com a.omappapi.com
2	epsilon.6sense.com	munchkin.brightfunnel.com
2	ups.analytics.yahoo.com	1 redirects www.sentinelone.com
2	www.google.de	www.sentinelone.com
2	www.google.com	www.sentinelone.com
2	api.brightfunnel.com	munchkin.brightfunnel.com
2	analytics.twitter.com	static.ads-twitter.com www.sentinelone.com
2	px.ads.linkedin.com	2 redirects
2	cdn.abrankings.com	www.googletagmanager.com munchkin.brightfunnel.com
2	munchkin.marketo.net	www.sentinelone.com munchkin.marketo.net
2	api.rebrandly.com	www.sentinelone.com
2	www.googletagmanager.com	www.sentinelone.com www.googletagmanager.com
2	collector-5527.tvsquared.com	www.sentinelone.com
2	fonts.googleapis.com	www.sentinelone.com a.omappapi.com
1	bam.nr-data.net	js-agent.newrelic.com
1	js-agent.newrelic.com	www.sentinelone.com
1	ga.clearbit.com	www.googletagmanager.com
1	adservice.google.de	adservice.google.com
1	cm.g.doubleclick.net	1 redirects
1	pixel.rubiconproject.com	www.sentinelone.com
1	us-u.openx.net	www.sentinelone.com
1	stats.g.doubleclick.net	munchkin.brightfunnel.com
1	adservice.google.com	10466992.fls.doubleclick.net
1	vars.hotjar.com	static.hotjar.com
1	327-mnm-087.mktoresp.com	munchkin.marketo.net
1	alb.reddit.com	www.sentinelone.com
1	q.quora.com	www.sentinelone.com
1	script.hotjar.com	static.hotjar.com
1	t.co	www.sentinelone.com
1	px4.ads.linkedin.com	www.sentinelone.com
1	www.linkedin.com	1 redirects
1	googleads.g.doubleclick.net	www.googleadservices.com
1	c.6sc.co	j.6sc.co
1	api.omappapi.com	a.omappapi.com
1	www.redditstatic.com	www.sentinelone.com
1	static.ads-twitter.com	www.sentinelone.com
1	a.quora.com	www.sentinelone.com
1	munchkin.brightfunnel.com	www.sentinelone.com
1	tag.marinsm.com	www.sentinelone.com
1	static.hotjar.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	snap.licdn.com	www.sentinelone.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	j.6sc.co	www.sentinelone.com
1	cloud.typography.com	1 redirects
1	www.googleoptimize.com	www.sentinelone.com
0	bootstrap.api.drift.com Failed	js.driftt.com
0	metrics.api.drift.com Failed	js.driftt.com
0	cdn.onesignal.com Failed	www.sentinelone.com
216	64

This site contains links to these domains. Also see Links.

Domain
jp.sentinelone.com
de.sentinelone.com
es.sentinelone.com
fr.sentinelone.com
it.sentinelone.com
nl.sentinelone.com
kr.sentinelone.com
partners.sentinelone.com
investors.sentinelone.com
www.facebook.com
twitter.com
www.linkedin.com
reddit.com
securityaffairs.co
community.riskiq.com
goo.gl
cookiepedia.co.uk
www.onetrust.com

Subject Issuer	Validity	Valid
sentinelone.com Cloudflare Inc ECC CA-3	`2021-06-09` - `2022-06-08`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2021-06-01` - `2022-05-31`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
go.sentinelone.com Cloudflare Inc ECC CA-3	`2021-06-14` - `2022-06-13`	a year	crt.sh
*.smushcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-01-22` - `2022-03-22`	2 years	crt.sh
a.omappapi.com R3	`2022-01-08` - `2022-04-08`	3 months	crt.sh
*.tvsquared.com Amazon	`2021-08-31` - `2022-09-29`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.rebrandly.com Go Daddy Secure Certificate Authority - G2	`2021-05-07` - `2022-06-08`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.hotjar.com Amazon	`2021-11-25` - `2022-12-23`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2021-12-22` - `2022-06-22`	6 months	crt.sh
tag.marinsm.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-12-24` - `2023-01-25`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-10-28` - `2022-01-26`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.brightfunnel.com Amazon	`2021-03-15` - `2022-04-13`	a year	crt.sh
quora.com R3	`2022-01-12` - `2022-04-12`	3 months	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
www.redditstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-05` - `2022-04-02`	6 months	crt.sh
cdn.abrankings.com Amazon	`2021-05-18` - `2022-06-16`	a year	crt.sh
api.opmnstr.com Amazon	`2021-03-11` - `2022-04-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-12-27` - `2022-03-21`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-06` - `2023-01-05`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2022-01-06` - `2023-01-05`	a year	crt.sh
*.quora.com R3	`2022-01-12` - `2022-04-12`	3 months	crt.sh
*.reddit.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-05` - `2022-04-02`	6 months	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.prfct.co Sectigo RSA Domain Validation Secure Server CA	`2021-11-02` - `2022-11-02`	a year	crt.sh
clearbit.com Amazon	`2021-08-27` - `2022-09-25`	a year	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA H2 2021	`2021-10-06` - `2022-11-07`	a year	crt.sh
*.nr-data.net DigiCert SHA2 Secure Server CA	`2020-02-05` - `2022-02-08`	2 years	crt.sh
*.6sense.com Amazon	`2021-06-30` - `2022-07-29`	a year	crt.sh
drift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh

This page contains 10 frames:

Primary Page: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Frame ID: 99977871593E9CD333D74CF4D416A130
Requests: 158 HTTP requests in this frame

Frame: https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F
Frame ID: 0D016852212E7033F89DD3F7416CADAD
Requests: 1 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-21ccaa45726c0f3c8c458f7a87eb2298.html
Frame ID: 7A4E6E247BF3D90830DFC44BC8E20D0C
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F
Frame ID: 0758F882A0D49ECF5249CDEF49ADD109
Requests: 1 HTTP requests in this frame

Frame: https://go.sentinelone.com/index.php/form/XDFrame
Frame ID: 705C074DE9BC8896C50978A0B46C97DE
Requests: 2 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F
Frame ID: EFB59A6F564E750DA06C1B2DDCEE3A5F
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: A763C8B0DF4F0B324423ECA026F9B649
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: DA2A812AF0335BA33627D0623AF6FEDE
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
Frame ID: C8A76E5633414760277A0A8651EEC053
Requests: 32 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
Frame ID: 4BC27DE30ABCDAA8B3FFC9502F33D14D
Requests: 33 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Ursnif - A Polymorphic Delivery Mechanism Explained - SentinelOneBack ButtonSearch IconFilter Icon

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Clipboard.js (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

clipboard(?:-([\d.]+))?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Hotjar (Analytics) Expand

Overall confidence: 100%
Detected patterns

//static\.hotjar\.com/

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

216
Requests

84 %
HTTPS

34 %
IPv6

47
Domains

64
Subdomains

56
IPs

7
Countries

10210 kB
Transfer

14958 kB
Size

49
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://jp.sentinelone.com//
Title: 日本語

Search URL Search Domain Scan URL

URL: https://de.sentinelone.com//
Title: Deutsch

Search URL Search Domain Scan URL

URL: https://es.sentinelone.com//
Title: Español

Search URL Search Domain Scan URL

URL: https://fr.sentinelone.com//
Title: Français

Search URL Search Domain Scan URL

URL: https://it.sentinelone.com//
Title: Italiano

Search URL Search Domain Scan URL

URL: https://nl.sentinelone.com//
Title: Dutch

Search URL Search Domain Scan URL

URL: https://kr.sentinelone.com//
Title: 한국어

Search URL Search Domain Scan URL

URL: https://partners.sentinelone.com/English/
Title: Channel Partners

Search URL Search Domain Scan URL

URL: https://investors.sentinelone.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https://s1.ai/wcVawH

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?url=https://s1.ai/wcVawH&text=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://s1.ai/wcVawH

Search URL Search Domain Scan URL

URL: https://reddit.com/submit?url=https://s1.ai/wcVawH

Search URL Search Domain Scan URL

URL: https://securityaffairs.co/wordpress/82921/malware/ursnif-threatening-italy.html
Title: active

Search URL Search Domain Scan URL

URL: https://community.riskiq.com/
Title: RiskIQ

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/2886771/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/SentinelOne
Title: Twitter

Search URL Search Domain Scan URL

URL: https://goo.gl/e5C9f4
Title: YouTube

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SentinelOne
Title: Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/SentinelOne/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sentinelone/

Search URL Search Domain Scan URL

URL: https://cookiepedia.co.uk/giving-consent-to-cookies
Title: More information

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0 HTTP 302
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0

Request Chain 4

https://cloud.typography.com/7197018/6979812/css/fonts.css HTTP 302
https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css HTTP 302
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css

Request Chain 5

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422 HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Request Chain 6

https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0 HTTP 302
https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0

Request Chain 7

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js

Request Chain 9

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339 HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339

Request Chain 10

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg

Request Chain 11

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg

Request Chain 12

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg

Request Chain 13

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg

Request Chain 14

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg

Request Chain 15

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg

Request Chain 16

https://www.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg HTTP 302
https://de.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg

Request Chain 17

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg

Request Chain 23

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg

Request Chain 24

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg

Request Chain 25

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg

Request Chain 26

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg

Request Chain 27

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg

Request Chain 28

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg

Request Chain 30

https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b HTTP 302
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b

Request Chain 31

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339 HTTP 302
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339

Request Chain 83

https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F HTTP 302
https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F

Request Chain 111

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2225260%252C432890%26time%3D1642561715401%26url%3Dhttps%253A%252F%252Fwww.sentinelone.com%252Fblog%252Fursnif-polymorphic-delivery-mechanism-explained%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true&e_ipv6=AQKVOTU6_VewhgAAAX5wTr9ZXv557ioQ_iqcOcP17uXvqw9uHxyc-Btje_0FmwfyfUe4nDvRKxsY5dSivngF1bYjsmpgaw

Request Chain 119

https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag HTTP 302
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag

Request Chain 139

https://pixel-geo.prfct.co/cs/?partnerId=twtr HTTP 302
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_j2atkZMYVHC1wo8L2

Request Chain 140

https://pixel-geo.prfct.co/cs/?partnerId=yah HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1 HTTP 302
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1&verify=true

Request Chain 141

https://pixel-geo.prfct.co/cs/?partnerId=opx HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_j2atkZMYVHC1wo8L2

Request Chain 142

https://pixel-geo.prfct.co/cs/?partnerId=rbcn HTTP 302
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_j2atkZMYVHC1wo8L2

Request Chain 143

https://pixel-geo.prfct.co/cs/?partnerId=goo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfajJhdGtaTVlWSEMxd284TDI HTTP 302
https://pixel-geo.prfct.co/cb?partnerId=goo

Request Chain 145

https://secure.adnxs.com/seg?t=2&add=4530935 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935

216 HTTP transactions
19 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/ 120 KB
26 KB 564ms
500ms Document
text/html 172.67.74.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.74.101 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b104f3eafc945a3963971d3d55fa0f9d57133e442f28c6c1dc407c9ec071af40

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security	max-age=15768000;, max-age=300
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Wed, 19 Jan 2022 03:08:33 GMT
content-type: text/html; charset=UTF-8
cf-ray: 6cfcdbf35d0ebfd4-MAN
cache-control: max-age=60
last-modified: Wed, 19 Jan 2022 03:08:33 GMT
link: <https://www.sentinelone.com/wp-json/>; rel="https://api.w.org/", <https://www.sentinelone.com/wp-json/wp/v2/posts/18093>; rel="alternate"; type="application/json", <https://www.sentinelone.com/?p=18093>; rel=shortlink
strict-transport-security: max-age=15768000;, max-age=300
vary: Accept-Encoding, Cookie, Cookie
via: 1.1 varnish, 1.1 varnish
cf-cache-status: MISS
cf-edge-cache: cache,platform=wordpress
content-security-policy: frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
expect-ct: enforce; max-age=2592000;
referrer-policy: origin-when-cross-origin
traceparent: 00-81cc2093bb4340d3b317c0ec528b3bed-bcab07604a6c7782-00
x-cache: HIT, MISS
x-cache-hits: 1, 0
x-cloud-trace-context: 81cc2093bb4340d3b317c0ec528b3bed/13594968010294851458;o=0
x-content-type-options: nosniff
x-frame-options: ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-4557j
x-served-by: cache-mdw17332-MDW, cache-man4127-MAN
x-styx-req-id: 0b6baa6e-78d5-11ec-9a50-aeb17b54446d
x-timer: S1642561714.532884,VS0,VE106
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BCVwD%2Fo0frwmrZB2P2IH3414EuZ%2BRFpN6xsStZWHyXddSzSYh3lisN9sx3iuYlaTrDEQPFRpfRt7aWfu%2F1vnPb53egvfjpfjkJQVbfOokV85alxinncqiCibHnzQ9%2FAdNf8KJ38%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 19 KB
7 KB 64ms
23ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: IVhKS9vCZ6N2xbLKU0Dl/w==
age: 7994
vary: Accept-Encoding
content-length: 6456
x-ms-lease-status: unlocked
last-modified: Tue, 18 Jan 2022 03:31:35 GMT
server: cloudflare
etag: 0x8D9DA3307CEA0BD
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ed6a0a4a-a01e-00b5-7327-0cd519000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdbf6d90d3761-MXP

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 90 KB
36 KB 54ms
16ms Script
application/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=OPT-W2VRGSJ

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a64ee2e2a7ae726b4dab3b2c1c3a0f25aa600aff793409f03817948d883f5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:33 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36228
x-xss-protection: 0
expires: Wed, 19 Jan 2022 03:08:33 GMT

GET
H2

200

tp_twitter_plugin.css
de.sentinelone.com/wp-content/plugins/recent-tweets-widget/
Redirect Chain

https://www.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0

529 B
609 B

169ms
123ms

Stylesheet
text/css

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462ac-211"
age: 56531
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-9nzkq
x-cache: HIT, MISS
x-cloud-trace-context: 5ae1308e9ce74a39a79ff7c902ba1d84/5645784502970865804;o=0
content-length: 286
x-served-by: cache-mdw17370-MDW, cache-mxp6922-MXP
last-modified: Sun, 16 Jan 2022 18:23:40 GMT
server: nginx
traceparent: 00-5ae1308e9ce74a39a79ff7c902ba1d84-4e59db17c1fbd88c-00
x-timer: S1642561714.788069,VS0,VE108
date: Wed, 19 Jan 2022 03:08:33 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
expires: Thu, 19 Jan 2023 11:26:22 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 76dc451b-7851-11ec-97de-169490dea942
x-cache-hits: 1, 0

Redirect headers

date: Wed, 19 Jan 2022 03:08:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=chC0KjGEglbSA8Bo1Y8J9Lgg%2FEaKXI4JdLc9BtZbrdFYS5unnqe%2FYh%2FS6uO%2B67IR3z16KMtDLM5RXOuKr9d2eVDzZgWM0rz3R%2Fn17rCCHeLLc4k4MPU1frziUyf0CQhhheBcVn4%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/plugins/recent-tweets-widget/tp_twitter_plugin.css?ver=1.0
cf-ray: 6cfcdbf69d94bfd4-MAN
content-length: 0

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 39ms
16ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e05047926caff00bd8838e1bd26284ac1b5b9bbc3a754361e60f79d41ee77d71

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 19 Jan 2022 02:12:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 19 Jan 2022 03:08:33 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jan 2022 03:08:33 GMT

GET
H2

200

2EC96BA1F5C4837D6.css
de.sentinelone.com/fonts/804059/
Redirect Chain

https://cloud.typography.com/7197018/6979812/css/fonts.css
https://www.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css

104 KB
80 KB

19ms
18ms

Stylesheet
text/css

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def4f9-1a12c"
age: 549743
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-4557j
x-cache: HIT, HIT
x-cloud-trace-context: 1cfd68a6dcd740e5a10d95c7e233f9c2/4123783218595224802;o=0
content-length: 81369
x-served-by: cache-mdw17328-MDW, cache-mxp6922-MXP
last-modified: Wed, 12 Jan 2022 15:34:17 GMT
server: nginx
traceparent: 00-1cfd68a6dcd740e5a10d95c7e233f9c2-393a9efd1315dce2-00
x-timer: S1642561715.891666,VS0,VE2
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:26:12 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 1ec02233-73d5-11ec-9a50-aeb17b54446d
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6AooGORFPEe489z1TY7z7sqbPok824bTEHdk5s%2BO4It%2B5kjzlHyZnkIw151XJMNq1QpswQ7C6062jq9wkf5LZigZvlEtw2n3TlyaYzS7exHwrzjYyJC95cOY%2BU6fIwG7iAjZIjs%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/fonts/804059/2EC96BA1F5C4837D6.css
cf-ray: 6cfcdbfdce64bfd4-MAN
content-length: 0

GET
H2

200

style.min.css
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

678 KB
108 KB

75ms
30ms

Stylesheet
text/css

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cc9ca4084b17e68f51fc3dff6c030e842306d1b62bdf2064ef9ec044c9376886

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462ae-a974c"
age: 156082
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: 744f7cec58274968861ecb2780cf4c1b/2222516795976969793;o=0
content-length: 109772
x-served-by: cache-mdw17335-MDW, cache-mxp6922-MXP
last-modified: Sun, 16 Jan 2022 18:23:42 GMT
server: nginx
traceparent: 00-744f7cec58274968861ecb2780cf4c1b-1ed7f740238bee41-00
x-timer: S1642561714.788149,VS0,VE1
date: Wed, 19 Jan 2022 03:08:33 GMT
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 07:47:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: addd2281-7769-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jBO2yVsBDcVm3%2FZv0SRKAyAxBaDJR0JupnQz8cKK%2Fx7m6nvw%2B7n98i2QzLLEUz2nJHtffDiTkt1XPkF573Z5%2BCl9U%2FFM%2BMuDj6qQTtVgc6v6nVRx%2BGHPyDZAMmOqhsgPOic722Y%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
cf-ray: 6cfcdbf69d95bfd4-MAN
content-length: 0

GET
H2

200

wpp.min.js Show response
de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/
Redirect Chain

https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0
https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0

3 KB
2 KB

57ms
15ms

Script
application/x-javascript

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def501-bc3"
age: 551185
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-wmx8t
x-cache: HIT, HIT
x-cloud-trace-context: 0bf5e887ea9f465589830ac23fd4e488/116115345546815004;o=0
content-length: 1422
x-served-by: cache-mdw17374-MDW, cache-mxp6922-MXP
last-modified: Wed, 12 Jan 2022 15:34:25 GMT
server: nginx
traceparent: 00-0bf5e887ea9f465589830ac23fd4e488-019c864aa44a261c-00
x-timer: S1642561714.788233,VS0,VE0
date: Wed, 19 Jan 2022 03:08:33 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:09 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c281cd15-73d1-11ec-a0f1-a6bcc005142a
x-cache-hits: 1, 2

Redirect headers

date: Wed, 19 Jan 2022 03:08:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BVxlVLJNMT1Ut1%2BZTvHKA0q2hN42L98nr0M4MzBJ6%2B8%2F2LjldA20tK67qNF%2BpFjRXphrExPrg28MmQN2dIxXzMkHKHl0x74%2BtzIrvnOejzs18HAmDRjRlyTqLmC%2F51wYsmwjGUM%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0
cf-ray: 6cfcdbf69d96bfd4-MAN
content-length: 0

GET
H2

200

jquery-3.5.1.min.js Show response
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js

87 KB
36 KB

51ms
17ms

Script
application/x-javascript

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-15d84"
age: 551184
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-s6pld
x-cache: HIT, HIT
x-cloud-trace-context: 7b607d7bfc234263b1e3d6f5ae9a7b9c/17021362385343075325;o=0
content-length: 36067
x-served-by: cache-mdw17356-MDW, cache-mxp6922-MXP
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-7b607d7bfc234263b1e3d6f5ae9a7b9c-ec3806e80b91d3fd-00
x-timer: S1642561714.788284,VS0,VE1
date: Wed, 19 Jan 2022 03:08:33 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:09 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c2824291-73d1-11ec-bb51-4afd07c6b579
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vhBKoXmS8Cyx%2FqGi4tya5S605ClDFPw6qZJ5iQl8iQEgCL2gtzfElWogZHsCBZVkDFl%2BhlUKrB4eXVfzypykbjC9UbIbs8cOpEgqWqB0j784oXOGc3yec7mIjpZ8w1yUbd9LhRQ%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js
cf-ray: 6cfcdbf69d97bfd4-MAN
content-length: 0

GET
H2 200 forms2.min.js Show response
go.sentinelone.com/js/forms2/js/ 205 KB
68 KB 268ms
46ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/js/forms2.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 12 Oct 2021 18:01:53 GMT
server: cloudflare
etag: "5e0326-33210-5ce2ba3f1c640"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 6cfcdbf7fb29361c-MAN
vary: Accept-Encoding
expires: Wed, 19 Jan 2022 07:08:33 GMT

GET
H2

200

header.min.js Show response
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339

151 KB
48 KB

18ms
18ms

Script
application/x-javascript

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ebbfcf00d982ffc70935655966e42b6b5083371d59ad9a3be6acad251b612a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e4625b-25b9f"
age: 156082
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-7w5gl
x-cache: HIT, HIT
x-cloud-trace-context: e57bb4c2eacb45388d47af37837dbbe0/3110193426436905182;o=0
content-length: 48898
x-served-by: cache-mdw17364-MDW, cache-mxp6922-MXP
last-modified: Sun, 16 Jan 2022 18:22:19 GMT
server: nginx
traceparent: 00-e57bb4c2eacb45388d47af37837dbbe0-2b29a0715d86d8de-00
x-timer: S1642561714.854824,VS0,VE1
date: Wed, 19 Jan 2022 03:08:33 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 07:47:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: addd19a9-7769-11ec-98eb-62d9c1505fbf
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GcxFeBM5dI3%2Ffvf3IL4jNtQfxv4y1pjeuUyRSXtiE9XayNo7TziqfYPm358aTa%2BUTkeK48vBFcwEPDkh8xBUfc5E5QDZt9rqkBXhGv5gXADXFnr7ezmzZUqjrZklgk%2FBaQKwfgs%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339
cf-ray: 6cfcdbf69d98bfd4-MAN
content-length: 0

GET
H2

200

search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg

681 B
698 B

18ms
17ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-2a9"
age: 551184
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: 1fd198e9405749c3ac81c794c5915c82/15021013651606646848;o=0
content-length: 385
x-served-by: cache-mdw17345-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-1fd198e9405749c3ac81c794c5915c82-d0755c54d64eb040-00
x-timer: S1642561714.325360,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:10 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3662d7d-73d1-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CDgrlBWw4FonaiA2ScT2oEIPWo0%2BUmPZHaqc3vv%2BhMXrnMYzDb2Aa1ws5H5U3%2BW4XOsmqO9071tZ%2FQ%2F3ATCHzt2BIB%2Btj0pLT61cOXw%2FSjy7tzgTxKdmH%2BzBbVLUIINiO%2FCdvRo%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg
cf-ray: 6cfcdbfa3e12bfd4-MAN
content-length: 0

GET
H2

200

search-icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg

681 B
691 B

17ms
16ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def501-2a9"
age: 551184
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-wmx8t
x-cache: HIT, HIT
x-cloud-trace-context: 6242a499987f4ddd9f2b2b91a3239b9b/583847694898584497;o=0
content-length: 385
x-served-by: cache-mdw17358-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:25 GMT
server: nginx
traceparent: 00-6242a499987f4ddd9f2b2b91a3239b9b-081a3e62995c5bb1-00
x-timer: S1642561714.397954,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:10 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3a3258c-73d1-11ec-a0f1-a6bcc005142a
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nWxCuGsmhbNqyCA8K7BcCxDf%2BRfizYCPvyXmYwLjCYqyPzOzX1Y3jywAdEtgWh6fidNEEX5wYFoZ6Thuxh5rVgtQ7ghcjGmVz49k9s3b1YY7wy8p2Rb%2F7mLLimpTiNxk7hu344M%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg
cf-ray: 6cfcdbfaae1bbfd4-MAN
content-length: 0

GET
H2

200

navigation-close.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg

667 B
705 B

193ms
193ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462bd-29b"
age: 156083
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, MISS
x-cloud-trace-context: 7ba863627688487fb47a852dffb2cea1/18289681088886669213;o=0
content-length: 339
x-served-by: cache-mdw17364-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:57 GMT
server: nginx
traceparent: 00-7ba863627688487fb47a852dffb2cea1-fdd2000c2644ff9d-00
x-timer: S1642561714.466944,VS0,VE166
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 07:47:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: ae1c6368-7769-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 0

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i12QJlzg8YCrxa%2BuDR9wLKkdMrRLNkKvozGJiFyolib3yWmzpFZ%2Ff4LUr3OOlWoNIO2LB7ZEQJzub4bK%2BHNN0ATm4HXqH4hMp%2BE1K89vfO8b4uiH%2BF47WSbfwQF%2BkRzYYdpl35w%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg
cf-ray: 6cfcdbfb2e25bfd4-MAN
content-length: 0

GET
H2

200

navigation-close-dark.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg

667 B
629 B

134ms
134ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462a9-29b"
age: 61419
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-wmx8t
x-cache: HIT, MISS
x-cloud-trace-context: 2705c746b2384d5c969ed22e9eab28a8/5086567348752856655;o=0
content-length: 339
x-served-by: cache-mdw17351-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:37 GMT
server: nginx
traceparent: 00-2705c746b2384d5c969ed22e9eab28a8-46971e0dcc83b64f-00
x-timer: S1642561715.717571,VS0,VE118
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Thu, 19 Jan 2023 10:04:55 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 1657c0ec-7846-11ec-a0f1-a6bcc005142a
x-cache-hits: 1, 0

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YYjlLUu6ruGHiCXuY%2FdNaO5fgI5hqB9okfVzp49RRD36l9JL5PAkwyUdofA2Dbp%2F0MhJOh0U2hskcwRC5pqpnmXQDgtSiE4OkD3QTphO7HtH14C3wcssE63K1X14L54msFG3pZc%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg
cf-ray: 6cfcdbfcae49bfd4-MAN
content-length: 0

GET
H2

200

s1-logo-color-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg

5 KB
2 KB

22ms
21ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f3927c309fec9aca7f0dab152c4fbd8e5aa69a1f744a2eda686f01f45d2d3b37

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def4fb-128c"
age: 550976
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-7w5gl
x-cache: HIT, HIT
x-cloud-trace-context: e73e55b6f3ad42cea689058e61a44ef9/1355416677766016681;o=0
content-length: 2080
x-served-by: cache-mdw17332-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:19 GMT
server: nginx
traceparent: 00-e73e55b6f3ad42cea689058e61a44ef9-12cf684980e22ea9-00
x-timer: S1642561715.894923,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:05:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 3f852cde-73d2-11ec-98eb-62d9c1505fbf
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yaud5jHql8ePp75JZIjLSonNdWzWsPbja0rPu2HwDfqO0SDT27pln5E8i23o223jPmhyi9jfzsZwwbCbs3PFKIhX%2F1T5jXI2ydFcKY31TOqMJgZuTzJeOz6I%2Fu8q036f6BJlxWc%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color-light.svg
cf-ray: 6cfcdbfdde67bfd4-MAN
content-length: 0

GET
H2

200

s1-logo-color.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg

4 KB
2 KB

17ms
17ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

ef990e608982588e9c0e86de964fefb24d33a5229965c5d9a0f2c6cd9d86c3fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def4fb-11bb"
age: 550976
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: dc1f70fccac04fa4a5a3b10ce07b39ce/12765509187589202332;o=0
content-length: 2036
x-served-by: cache-mdw17372-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:19 GMT
server: nginx
traceparent: 00-dc1f70fccac04fa4a5a3b10ce07b39ce-b12832f8b73d619c-00
x-timer: S1642561715.040873,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:05:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 3f88ead7-73d2-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uew3BlMposThXEDGZFse087Q%2By9%2Fz%2BQB4g2dKc0E2zs7yi1uqVBlDkqEaKuhZev7u4sUZhczdLlsmIiebwzXlVrGEwKQctAV0iBTczW0s1Ns1oB4HgDFHMs7o5MKyk6ivOMty94%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/s1-logo-color.svg
cf-ray: 6cfcdbfe4e74bfd4-MAN
content-length: 0

GET
H2

200

Singularity_XDR_tall.svg
de.sentinelone.com/wp-content/uploads/2021/11/
Redirect Chain

https://www.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg
https://de.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg

13 KB
6 KB

230ms
229ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

bfbfa1f0038354da826498b8f9101a61fba78329305f5861a566667ad4fbc9ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"6185b2bf-335e"
age: 550976
x-pantheon-styx-hostname: styx-fe2-a-85cc7bb74c-m2j8r
x-cache: HIT, HIT
content-length: 6231
x-served-by: cache-mdw17331-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Fri, 05 Nov 2021 22:39:59 GMT
server: nginx
x-timer: S1642561715.040803,VS0,VE213
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 07 Dec 2022 11:40:55 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 5fc8fa71-5689-11ec-8a4c-caed5d281030
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O3pb2sky8LRIv0eROiixkTZkapbEcAK8hCJ3YL7QzLg5x5qFBPxopwwXR5VMkmlaDaxxXu6dsJm8vG5UkueKprKmcg2Enf%2FAmdkTjZFC9YOvaljyzuzqyBztCDs0C9qYPj0HIFI%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/uploads/2021/11/Singularity_XDR_tall.svg
cf-ray: 6cfcdbfe4e76bfd4-MAN
content-length: 0

GET
H2

200

navigation-arrow-left.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg

566 B
690 B

17ms
16ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def501-236"
age: 551183
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-w2t5g
x-cache: HIT, HIT
x-cloud-trace-context: 9c104fc4ca75495e8612ec1e7f362384/17291060763549370190;o=0
content-length: 326
x-served-by: cache-mdw17336-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:25 GMT
server: nginx
traceparent: 00-9c104fc4ca75495e8612ec1e7f362384-eff63027090e074e-00
x-timer: S1642561715.049577,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3f4a28d-73d1-11ec-a174-06a61b358f55
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OSVo%2Bi3WbmbzWBzdeD740mEhkI0niUHXeicJ0ss8CNB6wulPkG3fx909SptWetQst4xLTGIQpMyVFukdcuQmtmdmBexFTNVdwLz98vYtamo0TDx7QQYI4KuHbpJl5IFupeYH2pM%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-left.svg
cf-ray: 6cfcdbfe9e7cbfd4-MAN
content-length: 0

GET
H2 200 Ursnif-Malware-2.jpg
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 7 MB
7 MB 620ms
547ms Image
image/jpeg 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/Ursnif-Malware-2.jpg?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: be6fd9a631e5209751754ab9483e96c211ad649ca8957d8230ffa4b37b99cf60

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Fri, 21 Jan 2022 16:46:09 GMT", rule-id="expire"
last-modified: Wed, 22 Dec 2021 16:46:09 GMT
server: nginx
etag: "224782186a3c3a35a5965ef4e59fcc3a"
x-cache: MISS
smushed: origFmt=jpg, origSize=7810288, smushRatio=7.13, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/jpeg
content-length: 7253098
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 email-decode.min.js Show response
www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 28ms
28ms Script
application/javascript 172.67.74.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.74.101 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Jan 2022 19:09:30 GMT
server: cloudflare
etag: W/"61df276a-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aRdgEovChi9EtVvOxLnEPaAy8rWvU30Qe0aqWFKnQNJY6%2FsDyZTurMvxqOkfYkmKQlaTZsahIm%2F7vDZJv%2B8BOvqEBevj3NwnxnPjDA9wDMO5RqyB2EDVOCOlxDP9SvgEjRBfd68%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6cfcdbf87dd6bfd4-MAN
vary: Accept-Encoding
expires: Fri, 21 Jan 2022 03:08:33 GMT

GET
H2 200 Blog_CTA_01.jpg
899029.smushcdn.com/2131410/wp-content/uploads/2021/03/ 16 KB
17 KB 84ms
11ms Image
image/jpeg 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2021/03/Blog_CTA_01.jpg?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 02d7c60fa62b7709af4f8e0d74c509f4dad23562007f457654f7ab6299013362

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Fri, 24 Sep 2021 07:43:40 GMT", rule-id="expire"
last-modified: Wed, 25 Aug 2021 07:43:40 GMT
server: nginx
etag: "7e1c3e505cca86edfe76622185ed44b2"
x-cache: HIT
smushed: origFmt=jpg, origSize=17910, smushRatio=6, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/jpeg
content-length: 16836
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 MITRE-Results-Blog-Image-395x263_update.png
899029.smushcdn.com/2131410/wp-content/uploads/2021/04/ 38 KB
39 KB 90ms
18ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2021/04/MITRE-Results-Blog-Image-395x263_update.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 853205496e0c3ef4e3d9bf39b4131f254bc0c7bcb792018ce64399aa7296530e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Fri, 01 Oct 2021 08:26:10 GMT", rule-id="expire"
last-modified: Wed, 01 Sep 2021 08:26:10 GMT
server: nginx
etag: "eae5a1c45c55ccdfb097c2c0603bd9cf"
x-cache: HIT
smushed: origFmt=png, origSize=39211, smushRatio=0, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 39211
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 Blog_CTA_03.jpg
899029.smushcdn.com/2131410/wp-content/uploads/2021/03/ 13 KB
13 KB 86ms
13ms Image
image/jpeg 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2021/03/Blog_CTA_03.jpg?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: e21d2669ef9c2b4358906325d4da70cc33ae5380c1fb7fdfdb9d24d9fbbceeec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Fri, 24 Sep 2021 04:56:29 GMT", rule-id="expire"
last-modified: Wed, 25 Aug 2021 04:56:29 GMT
server: nginx
etag: "56a2f0addc188afdfd292a5a70ec2349"
x-cache: HIT
smushed: origFmt=jpg, origSize=13976, smushRatio=6.65, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/jpeg
content-length: 13046
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2

200

footer-logo.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg

2 KB
1 KB

18ms
17ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

60f4893aeccee80d922be14d7aebb526a19c775ebe54df72282870891ef59b3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462aa-66c"
age: 56531
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-7w5gl
x-cache: HIT, HIT
x-cloud-trace-context: 3b827b37a29d445cbdf5b03fad40e064/11492474855508269847;o=0
content-length: 770
x-served-by: cache-mdw17367-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:38 GMT
server: nginx
traceparent: 00-3b827b37a29d445cbdf5b03fad40e064-9f7d78fdc8addb17-00
x-timer: S1642561715.049787,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Thu, 19 Jan 2023 11:26:23 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 77586b38-7851-11ec-98eb-62d9c1505fbf
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2bzV2vNidfoQjOREJY1UFw1wNvwQkZNh46Cn6wKjbAz5DZ0U7QZDIegOwMTEuXPZv%2FXuMkWdIdNf%2Fe2V%2BNiKeQBTx%2BgafRexSMML14UJ4gKpzRCs7Q35OgWOsIuk1z%2FRQcoHwhs%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/footer-logo.svg
cf-ray: 6cfcdbfe9e7dbfd4-MAN
content-length: 0

GET
H2

200

social-twitter-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg

2 KB
1 KB

23ms
21ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462a9-7e1"
age: 78454
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-d62rx
x-cache: HIT, HIT
x-cloud-trace-context: 6acfe1dcd5db4eb2a583f605eb4d91c0/16544338139832253965;o=0
content-length: 1036
x-served-by: cache-mdw17348-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:37 GMT
server: nginx
traceparent: 00-6acfe1dcd5db4eb2a583f605eb4d91c0-e5994be1eca5fe0d-00
x-timer: S1642561715.357045,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Thu, 19 Jan 2023 05:21:00 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 6cb574fa-781e-11ec-a84a-c24368d0ac0f
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OfUp0Y9uSjg2iQ49ZFqfHQzvm6TXX0vocVyYnmOWicb%2B%2F1sfTT6LwpKzqWfAmDd9seWSLfQnPbFpAFGvXJ8QK5RslPb5J%2BCaISAN1sV6p0osEJO1GLCbttCL9kowda%2FUhhoErSg%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-twitter-white.svg
cf-ray: 6cfcdbfe9e7ebfd4-MAN
content-length: 0

GET
H2

200

social-facebook-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg

2 KB
1 KB

18ms
17ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3302b8fa7dc8d62e1758af8ae584b8fc91d489e44d3e32485d41c0fc93f439f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def501-6ba"
age: 550976
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-47klm
x-cache: HIT, HIT
x-cloud-trace-context: c581227ca7f44358983ed450daa266c4/664156333273924266;o=0
content-length: 854
x-served-by: cache-mdw17376-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:25 GMT
server: nginx
traceparent: 00-c581227ca7f44358983ed450daa266c4-09378eaa901e42aa-00
x-timer: S1642561715.049850,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:05:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 3f89e1dd-73d2-11ec-955f-e6f7556ce357
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mox%2B4YMiai8%2FR69%2BZ4dNjh%2Fn1I3Hm0HdeygDM9pvBrWl%2BUTc4nMqS2Ht9hywHPdBcQ642ykdxzVU9ARSvyBzCZY6ze0FzzeFyqMv9flDtS2mv4kWEivFJIGu4zPMWGvZSMQ9o%2BY%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-facebook-white.svg
cf-ray: 6cfcdbfe9e7fbfd4-MAN
content-length: 0

GET
H2

200

social-linkedin-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg

2 KB
1 KB

19ms
18ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462a9-90f"
age: 148463
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: d8754684302147918ac63f9ab4226811/6711923373185766212;o=0
content-length: 993
x-served-by: cache-mdw17323-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:37 GMT
server: nginx
traceparent: 00-d8754684302147918ac63f9ab4226811-5d258abf22611344-00
x-timer: S1642561715.049943,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 09:54:12 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 6c7374dd-777b-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zpr6x86f%2FS2cALvgZrWWCfVGoXvwJ8OfsI2PY%2F4H9N%2F1P%2Bcaa3Ju%2F%2Fv39CfuMYi1pMK5w1d8%2FE%2BeQntxutAk574LdZOYIMFq8qYm7m%2F97XQbKhzfu7IdNS7Dle4M4GgZk6sR8vk%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-linkedin-white.svg
cf-ray: 6cfcdbfe9e80bfd4-MAN
content-length: 0

GET
H2

200

social-youtube-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg

1 KB
967 B

18ms
18ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1ee6321fadd1f1471732c38d5965e5bc125d5da86d1a769f506d4bbc752d1331

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df3fbb-492"
age: 423408
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-wmx8t
x-cache: HIT, HIT
x-cloud-trace-context: eee8f929a58649b9b65d478e06777aaa/5548838791687143171;o=0
content-length: 601
x-served-by: cache-mdw17361-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 20:53:15 GMT
server: nginx
traceparent: 00-eee8f929a58649b9b65d478e06777aaa-4d016f7b666b7f03-00
x-timer: S1642561715.049899,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Sun, 15 Jan 2023 05:31:47 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 44530ae0-74fb-11ec-a0f1-a6bcc005142a
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NwjCylO30khruYJZGMB2OAjs64V6Ngk37i0ciuJqgwEG3Qfv38NJzN%2BrSo0Ke27C0DtsWkZIz2KehX5%2F9Me8iDJ%2FXNSo4aHJ88hP0WNmF8yxRjDuDSjKWPC9PRTpgNE%2FvJtxypM%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/social-youtube-white.svg
cf-ray: 6cfcdbfe9e81bfd4-MAN
content-length: 0

GET
H2

200

testimonial_icon_close.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg

658 B
714 B

126ms
125ms

Image
image/svg+xml

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c66c8be72f0f2c0a85d3693ebd2e5a480c5b1d4e705c065cd7117dddfe3f6957

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def502-292"
age: 551184
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-fs7rw
x-cache: HIT, MISS
x-cloud-trace-context: 1d3b81d6f1514f4d900ceb24f62b67e4/499218289802661147;o=0
content-length: 334
x-served-by: cache-mdw17373-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:26 GMT
server: nginx
traceparent: 00-1d3b81d6f1514f4d900ceb24f62b67e4-06ed9463bd10cd1b-00
x-timer: S1642561715.049738,VS0,VE110
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3f34be1-73d1-11ec-b339-c2d75d2bcff5
x-cache-hits: 1, 0

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjSr8BGSB%2BXvhvVxBPeDbpfB1LsS3nWiEez%2BFaFLNPtvQj9Kv%2BqRDyCQsEbJloQjCW4FF91lT7QZIRtZrOxhkguA2C6%2FZ0a222crdTLrVeGfmW8gzddZypOZllVVeqRr0s0HhTw%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/testimonial_icon_close.svg
cf-ray: 6cfcdbfe9e83bfd4-MAN
content-length: 0

GET
H2 200 api.min.js Show response
a.omappapi.com/app/js/ 202 KB
56 KB 45ms
8ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/api.min.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: ac3774c809f279d74ee1c089012274410b5715f3d0729a47100c0776a7952943

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
cdn-edgestorageid: 756
perma-cache: HIT
cdn-storageserver: DE-51
cdn-cachedat: 01/18/2022 22:57:58
cdn-pullzone: 293267
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
server: BunnyCDN-DE1-756
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 18:46:39 GMT
cdn-proxyver: 1.02
cdn-fileserver: 54
etag: W/"61e70b0f-329a3"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: ebcd5ee0b42ea33cfdd699853ce101c5
cdn-requestcountrycode: SE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2

200

clipboard.min.js Show response
de.sentinelone.com/wp-includes/js/
Redirect Chain

https://www.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b
https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b

10 KB
4 KB

17ms
16ms

Script
application/x-javascript

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5a4934fe889bc2f975cd69f0c35adc72107079ef0d36a139fa141b5219e0e6b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462bd-296f"
age: 93729
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-4557j
x-cache: HIT, HIT
x-cloud-trace-context: 1fd4466c8aa14ef5929a94fd8a128dce/9783565860974045655;o=0
content-length: 3735
x-served-by: cache-mdw17336-MDW, cache-mxp6922-MXP
last-modified: Sun, 16 Jan 2022 18:23:57 GMT
server: nginx
traceparent: 00-1fd4466c8aa14ef5929a94fd8a128dce-87c63550a3ff29d7-00
x-timer: S1642561714.076405,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Thu, 19 Jan 2023 01:06:25 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: dbb7ce75-77fa-11ec-9a50-aeb17b54446d
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SXmsABJ5ce3GyPgQwbyt%2FOXtFAN3ZdWraTqolgybFE37Fmof17QcvX20Wf8%2Fh8GY2uY33wpSMcWC8X4ohqiKVNBNCGeTttz9eyQaSK4EozgPY3AybZ49dYDz8B%2B%2Bm2doQIhHnQo%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-includes/js/clipboard.min.js?ver=5cd7f442ce254b26aa186e1c33abd83b
cf-ray: 6cfcdbf8addabfd4-MAN
content-length: 0

GET
H2

200

footer.min.js Show response
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/
Redirect Chain

https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339
https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339

111 KB
45 KB

18ms
18ms

Script
application/x-javascript

2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4e795936b182c89a5cf3b7e59c0b19e64d00cee4d099053580215837a9cfd009

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462bd-1bd19"
age: 156082
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-s6pld
x-cache: HIT, HIT
x-cloud-trace-context: dfbaeb0a91644426b40a0fa9c94acc7d/2165062522595732621;o=0
content-length: 45193
x-served-by: cache-mdw17339-MDW, cache-mxp6922-MXP
last-modified: Sun, 16 Jan 2022 18:23:57 GMT
server: nginx
traceparent: 00-dfbaeb0a91644426b40a0fa9c94acc7d-1e0bd8e4afd46c8d-00
x-timer: S1642561714.245518,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 07:47:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: ae061b4a-7769-11ec-bb51-4afd07c6b579
x-cache-hits: 1, 1

Redirect headers

date: Wed, 19 Jan 2022 03:08:34 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Mmetr3kHiMceWEe8axRqaxa9G%2FheyVqM8%2BZ1MuKG8xI0jw2fxcAqStc2WHds9IJWoAIIphTgtzQ%2BPNqHDHkjxmvHhaiAUJ3oRNK5zA%2Bv9QufZsh9V2mRbRl41fqfP9XSmtsqtOk%3D"}],"group":"cf-nel","max_age":604800}
location: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/footer.min.js?ver=1642357339
cf-ray: 6cfcdbf91defbfd4-MAN
content-length: 0

GET OneSignalSDK.js
cdn.onesignal.com/sdks/ 0
0

GET
H2 200 02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json Show response
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/ 4 KB
2 KB 193ms
154ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/02ad5672-6494-4b20-a5ae-7d131a0f4f9c.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-md5: CqPSDQgRayZT5/dw1EENjQ==
vary: Accept-Encoding
content-length: 1450
x-ms-lease-status: unlocked
last-modified: Fri, 10 Sep 2021 19:25:19 GMT
server: cloudflare
etag: 0x8D97490BA2F1567
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 0f70f7a2-601e-008a-0d0a-e862c5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdbf74eb0375c-MXP
expires: Wed, 19 Jan 2022 07:08:33 GMT

GET
H/1.1 200
OK tv2track.js Show response
collector-5527.tvsquared.com/ 20 KB
9 KB 138ms
29ms Script
application/javascript 54.216.103.176
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-5527.tvsquared.com/tv2track.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.103.176 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-103-176.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 18 Nov 2021 16:14:25 GMT
Server: nginx
ETag: "61967be1-2133"
Content-Type: application/javascript
Cache-Control: max-age=600
Connection: keep-alive
X-Robots-Tag: noindex
Content-Length: 8499
Expires: Wed, 19 Jan 2022 03:18:35 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 27 KB
9 KB 74ms
22ms Script
application/javascript 104.82.195.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.82.195.159 London, United Kingdom, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-82-195-159.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8575
Pragma: no-cache
Last-Modified: Thu, 07 Oct 2021 17:17:43 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615f2bb7-6a5f"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Jan 2022 03:08:35 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 182 B
458 B 67ms
26ms XHR
application/json 2606:4700:10::6814:b844
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:34 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6cfcdbf87944375d-MXP
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.23.0/ 312 KB
75 KB 27ms
23ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: joMckLq8BtEunD8NH/4XVA==
age: 1300
vary: Accept-Encoding
content-length: 76366
x-ms-lease-status: unlocked
last-modified: Thu, 02 Sep 2021 03:11:58 GMT
server: cloudflare
etag: 0x8D96DBF6CBEE741
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f61b970a-c01e-016d-5435-0c349d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdbfe9fda3761-MXP

POST
H2 500 popular-posts Show response
www.sentinelone.com/wp-json/wordpress-popular-posts/v1/ 4 KB
4 KB 790ms
790ms XHR
text/html 172.67.74.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.sentinelone.com/wp-json/wordpress-popular-posts/v1/popular-posts

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.74.101 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d4c6544e66a3453f790183e5468b7f2b09304b0779543143fc68284fe536849

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
referrer-policy: same-origin
server: cloudflare
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 6cfcdbfe4e77bfd4-MAN
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2
fonts.gstatic.com/s/ibmplexsans/v9/ 18 KB
18 KB 29ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v9/zYXgKVElMYYaJe8bpLHnCwDKhdHeFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

392f196c197758bafbfb4a917625b5a20a84cd7977433a134140f9c6f745058f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 23:12:57 GMT
x-content-type-options: nosniff
age: 14137
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18096
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 16:52:22 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 23:12:57 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 342 KB
89 KB 56ms
30ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bbbf54133750e80c88ffa99b7dfcf4ff670e878d0f1959f55ecd1f678dff6e37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90811
x-xss-protection: 0
expires: Wed, 19 Jan 2022 03:08:35 GMT

GET
H2 200 navigation-arrow-right-purple.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 611 B
718 B 125ms
123ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-right-purple.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

696991cbecd2aad100d6531183525c326add046c882d4954e3d8fe5a6a0babab

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462bd-263"
age: 99730
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-w2t5g
x-cache: HIT, MISS
x-cloud-trace-context: 644ca0076f124e6ebaab7800903b9568/10119878919352159489;o=0
content-length: 337
x-served-by: cache-mdw17352-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:57 GMT
server: nginx
traceparent: 00-644ca0076f124e6ebaab7800903b9568-8c7108427df30d01-00
x-timer: S1642561715.974515,VS0,VE108
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 23:26:24 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: e310825a-77ec-11ec-a174-06a61b358f55
x-cache-hits: 1, 0

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 globe-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 729 B
578 B 18ms
17ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/globe-light.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-2d9"
age: 550976
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: 45aaa40735e144e5ab6b37cad703e14b/6519190019994036501;o=0
content-length: 295
x-served-by: cache-mdw17340-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-45aaa40735e144e5ab6b37cad703e14b-5a78d0c875042915-00
x-timer: S1642561715.976374,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:05:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 3f702ab7-73d2-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

GET
H2 200 navigation-arrow-down-light.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 663 B
673 B 18ms
17ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-down-light.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462a9-297"
age: 139197
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-7w5gl
x-cache: HIT, HIT
x-cloud-trace-context: a11034215ee3462ba9b94f831c9ba25a/14973602413570028042;o=0
content-length: 347
x-served-by: cache-mdw17356-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:37 GMT
server: nginx
traceparent: 00-a11034215ee3462ba9b94f831c9ba25a-cfccec0fc4c5f20a-00
x-timer: S1642561715.976780,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 12:28:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: ff577236-7790-11ec-98eb-62d9c1505fbf
x-cache-hits: 1, 1

GET
H2 200 navigation-arrow-right-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 611 B
662 B 17ms
17ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-right-white.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e04cd604df1afd7f5e3eedcc1ee997955f575f74443b575d6355f4142aae092d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61def502-263"
age: 550976
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-wmx8t
x-cache: HIT, HIT
x-cloud-trace-context: d420f47d2d7b46098d434f85ce2ac69c/15838820817897287188;o=0
content-length: 333
x-served-by: cache-mdw17381-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 15:34:26 GMT
server: nginx
traceparent: 00-d420f47d2d7b46098d434f85ce2ac69c-dbcecb9dbfd46e14-00
x-timer: S1642561715.978066,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:05:38 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 3f8cbbb0-73d2-11ec-a0f1-a6bcc005142a
x-cache-hits: 1, 1

GET
H2 200 nav-caret-smoke.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 717 B
800 B 17ms
16ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/nav-caret-smoke.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f196a7c963a7423a617c88b9aa25ed9bb1b500fb9b9cc788f1070127b6a8e68a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-2cd"
age: 550259
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: 39e314d8a0d246eba72dfeeb99373e71/10578326377427794345;o=0
content-length: 479
x-served-by: cache-mdw17330-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-39e314d8a0d246eba72dfeeb99373e71-92cdc3cb3cba79a9-00
x-timer: S1642561715.978126,VS0,VE1
date: Wed, 19 Jan 2022 03:08:34 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:17:35 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: eae077d2-73d3-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 1

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6435ed7ffc6e90262f5b72fbeeb5f2eba5322d735c016d6fb60243d169434a2c

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 11 KB
11 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 Socicon.woff2
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/ 63 KB
63 KB 56ms
18ms Font
font/woff2 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/fonts/Socicon.woff2?87visu

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
via: 1.1 varnish, 1.1 varnish
etag: "61def4fb-fc00"
age: 551184
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-4557j
x-cache: HIT, HIT
x-cloud-trace-context: cb9f3ecae9de46509377ed8248071de9/14070154131739566362;o=0
content-length: 64512
x-served-by: cache-mdw17341-MDW, cache-mxp6932-MXP
last-modified: Wed, 12 Jan 2022 15:34:19 GMT
server: nginx
traceparent: 00-cb9f3ecae9de46509377ed8248071de9-c3433aa2cd54e11a-00
x-timer: S1642561715.029977,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 13 Jan 2023 18:02:11 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3e96e8b-73d1-11ec-9a50-aeb17b54446d
x-cache-hits: 1, 1

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4f7b89695827926507fa8e0b19001e189f3bf7759e9c2b1e24eb06bdbcf98c62

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
DATA 200
OK truncated
/ 4 KB
4 KB Font
application/x-font-woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda

Request headers

Referer
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: application/x-font-woff2

GET
H2 200 amazon_polly_icon.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/amazon_polly_icon.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

181fa10be49f875d78816391e202c05f90be6b0d5597edc25f524b1183e434e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-757"
age: 550259
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-s6pld
x-cache: HIT, HIT
x-cloud-trace-context: 07da4d757bcd4c8798065b28718228e8/4682188796657834825;o=0
content-length: 884
x-served-by: cache-mdw17363-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-07da4d757bcd4c8798065b28718228e8-40fa79e73c1a9b49-00
x-timer: S1642561715.051836,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:17:35 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: eae07432-73d3-11ec-bb51-4afd07c6b579
x-cache-hits: 1, 1

GET
DATA 200
OK truncated
/ 382 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4f80028ddc6dc380c89927fb2d2d3dd9c580a24f99db9b93e32ce0b607d5c88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2
fonts.gstatic.com/s/ibmplexsans/v9/ 19 KB
19 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v9/zYX-KVElMYYaJe8bpLHnCwDKhdTuF6ZJ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc380695af9f92a38f1570106049fb6d12f0a0aa3a2fe0ac1fb04801eeabfa0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 19:54:47 GMT
x-content-type-options: nosniff
age: 26028
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19660
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 16:52:47 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 19:54:47 GMT

GET
H2 200 zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v9/ 18 KB
18 KB 10ms
10ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v9/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d11abf7d6f4725555bfd3493838bae4afe645ac11b8a4a62ef92daf760b03b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 06:46:17 GMT
x-content-type-options: nosniff
age: 418938
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18348
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 16:53:07 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 06:46:17 GMT

GET
H2 200 1-S1-Detection-1024x392.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 77 KB
78 KB 531ms
528ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/1-S1-Detection-1024x392.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 357ab13888827f74dcdaacae0e9f438025b194bd916f08ea9f8740a71253bd88

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Fri, 21 Jan 2022 04:13:35 GMT", rule-id="expire"
last-modified: Wed, 22 Dec 2021 04:13:35 GMT
server: nginx
etag: "7a2b13ea2e872074c3622cdc60766bc1"
x-cache: MISS
smushed: origFmt=png, origSize=79029, smushRatio=0, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 79029
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 2-S1-Detection-1024x158.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 43 KB
43 KB 546ms
542ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/2-S1-Detection-1024x158.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 9e0e5afa64a4e4bea31acef5b5a5a6022c3530edf576c8789c89327b1502338a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Wed, 26 Jan 2022 23:21:37 GMT", rule-id="expire"
last-modified: Mon, 27 Dec 2021 23:21:37 GMT
server: nginx
etag: "295e59f129d117205d5047764d1f22d0"
x-cache: MISS
smushed: origFmt=png, origSize=43818, smushRatio=0, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 43818
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 3-ursnif-vba-macro.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 142 KB
142 KB 561ms
558ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/3-ursnif-vba-macro.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 1189e3c5878312d863ea2225d00a89f8a35153e4542270bac42baabb8c937a64

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Sun, 23 Jan 2022 21:30:11 GMT", rule-id="expire"
last-modified: Fri, 24 Dec 2021 21:30:11 GMT
server: nginx
etag: "850cfce0d6fe626708e4298ff7d53844"
x-cache: MISS
smushed: origFmt=png, origSize=185513, smushRatio=21.71, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 145247
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 4-PowerShell-command.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 10 KB
11 KB 364ms
361ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/4-PowerShell-command.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: ab68a1d182c709631556c042e544af8ec88ee85cdf2b61b2acc5a21651b256f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Sun, 23 Jan 2022 21:30:12 GMT", rule-id="expire"
last-modified: Fri, 24 Dec 2021 21:30:12 GMT
server: nginx
etag: "b8928533d088763bf562d2ae17755fa6"
x-cache: MISS
smushed: origFmt=png, origSize=22029, smushRatio=51.95, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 10584
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 5-PowerShell-script-1024x497.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 193 KB
193 KB 551ms
549ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/5-PowerShell-script-1024x497.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 12f63d55e2bfac64d9d4ca717460906bb1adec9679bd80dad76b2aa844118522

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Thu, 27 Jan 2022 06:11:29 GMT", rule-id="expire"
last-modified: Tue, 28 Dec 2021 06:11:29 GMT
server: nginx
etag: "fc658523879d50056e60cbdccd758d2a"
x-cache: MISS
smushed: origFmt=png, origSize=197161, smushRatio=0, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 197161
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 6-Using-dig-to-check-domain.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 264 KB
265 KB 524ms
521ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/6-Using-dig-to-check-domain.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 91297de4b37cc5b3ef84aa37b43667637e121cdcf7c421b6253093fe8ed25a03

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Wed, 26 Jan 2022 23:21:38 GMT", rule-id="expire"
last-modified: Mon, 27 Dec 2021 23:21:38 GMT
server: nginx
etag: "eda028dd2f11494316888b37f93536b2"
x-cache: MISS
smushed: origFmt=png, origSize=377960, smushRatio=28.39, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 270643
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 7-Using-RiskIQ-to-check-DNS.png
899029.smushcdn.com/2131410/wp-content/uploads/2019/04/ 20 KB
20 KB 444ms
442ms Image
image/png 151.139.242.10
HIGHWINDS2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://899029.smushcdn.com/2131410/wp-content/uploads/2019/04/7-Using-RiskIQ-to-check-DNS.png?lossy=0&strip=1&webp=0
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.139.242.10 , United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: nginx /
Resource Hash: 23bc191756969f062a5620a800396e7496e5b2a5fe00d486e2c041adc5d45927

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-amz-expiration: expiry-date="Mon, 24 Jan 2022 06:01:15 GMT", rule-id="expire"
last-modified: Sat, 25 Dec 2021 06:01:15 GMT
server: nginx
etag: "1d2bec37d232513c616a6d5ebb58baf8"
x-cache: MISS
smushed: origFmt=png, origSize=46544, smushRatio=55.85, originCache=HIT
cache-control: max-age=31104000
accept-ranges: bytes
content-type: image/png
content-length: 20550
expires: Sat, 14 Jan 2023 03:08:35 GMT

GET
H2 200 getForm Show response
go.sentinelone.com/index.php/form/ 6 KB
2 KB 417ms
417ms Script
application/javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=1985&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&callback=jQuery1124028681067838923147_1642561714932&_=1642561714933

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41fce12706bd67f9c0d5d7a6e1394bd88684efee9a10cd3403b527181374e1b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cf-ray: 6cfcdbff7b37361c-MAN
cached: false

GET
DATA 200
OK truncated
/ 180 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6cf4ddc728ae2116b65b72832d21cdf33961c094ce95ea8a5b676b7d71212f82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 354 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 77fc7e2cee3f1b71326ab2d9e121017b176205d0c8bbb013dfe7ebfccb2c5cab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 search-icon-white.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 681 B
735 B 16ms
15ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61df045d-2a9"
age: 551185
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-nk8pt
x-cache: HIT, HIT
x-cloud-trace-context: 1fd198e9405749c3ac81c794c5915c82/15021013651606646848;o=0
content-length: 385
x-served-by: cache-mdw17345-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 16:39:57 GMT
server: nginx
traceparent: 00-1fd198e9405749c3ac81c794c5915c82-d0755c54d64eb040-00
x-timer: S1642561715.136779,VS0,VE0
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Fri, 13 Jan 2023 18:02:10 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: c3662d7d-73d1-11ec-a79f-96b57c170b8b
x-cache-hits: 1, 2

GET
H2 200 getForm Show response
go.sentinelone.com/index.php/form/ 2 KB
1 KB 72ms
72ms Script
application/javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.sentinelone.com/index.php/form/getForm?munchkinId=327-MNM-087&form=2816&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&callback=jQuery1124028681067838923147_1642561714934&_=1642561714935
Requested by: Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8cde893252a0ab0ce56429b052ed6ae7df55848794b32d459076e12706330fc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cf-ray: 6cfcdbffcb86361c-MAN
cached: true

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/ 54 KB
11 KB 164ms
163ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/02ad5672-6494-4b20-a5ae-7d131a0f4f9c/8559fb5f-d020-41f3-b4af-073a54697ce8/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-md5: g3u/cB4L4tfTQx7Hp+ONEQ==
vary: Accept-Encoding
content-length: 11065
x-ms-lease-status: unlocked
last-modified: Fri, 10 Sep 2021 19:25:24 GMT
server: cloudflare
etag: 0x8D97490BD2F4CA7
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 4769d0dd-c01e-0166-653e-0c2ce9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdbffed41375c-MXP
expires: Wed, 19 Jan 2022 07:08:35 GMT

GET
H2 200 globe.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 729 B
642 B 17ms
17ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/globe.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

04016017106740a0c449a2dc33655f441bbc2b48e1bfd633be8cec5ee15b8984

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462aa-2d9"
age: 115114
x-pantheon-styx-hostname: styx-fe2-a-54cb89b9bf-2mvv2
x-cache: HIT, HIT
x-cloud-trace-context: 6e09b88fc13d48fcba3b6515ba2eebd4/3309270460373728065;o=0
content-length: 294
x-served-by: cache-mdw17345-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:38 GMT
server: nginx
traceparent: 00-6e09b88fc13d48fcba3b6515ba2eebd4-2dece3f35044fb41-00
x-timer: S1642561715.202867,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 19:10:00 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 1181e664-77c9-11ec-a118-a6533d875259
x-cache-hits: 1, 1

GET
H2 200 navigation-arrow-down.svg
de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/ 666 B
678 B 17ms
17ms Image
image/svg+xml 2620:12a:8001::2
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-arrow-down.svg

Requested by

Host: de.sentinelone.com
URL: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:12a:8001::2 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3229ca2228578c18cb365b9d7d9d5bb84d9070ac42ddfc14570943546c3afaf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://de.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/css/style.min.css?ver=1642357422
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
etag: W/"61e462a9-29a"
age: 149426
x-pantheon-styx-hostname: styx-fe2-b-84558bcd68-pwpvb
x-cache: HIT, HIT
x-cloud-trace-context: 82a4e351b2264061a0830230fc9b7a6a/16522883357957573592;o=0
content-length: 348
x-served-by: cache-mdw17352-MDW, cache-mxp6922-MXP
access-control-allow-origin: *
last-modified: Sun, 16 Jan 2022 18:23:37 GMT
server: nginx
traceparent: 00-82a4e351b2264061a0830230fc9b7a6a-e54d12df40464bd8-00
x-timer: S1642561715.203076,VS0,VE1
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
content-type: image/svg+xml
via: 1.1 varnish, 1.1 varnish
expires: Wed, 18 Jan 2023 09:38:09 GMT
cache-control: max-age=31622400
accept-ranges: bytes
x-styx-req-id: 2e4c0f0d-7779-11ec-95a2-626a7cdce46c
x-cache-hits: 1, 1

OPTIONS
H2 200 links
api.rebrandly.com/v1/ Frame 0
0 319ms
98ms Preflight 3.215.119.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rebrandly.com/v1/links
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.119.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-119-159.compute-1.amazonaws.com
Software: / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: apikey,content-type
Origin: https://www.sentinelone.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-powered-by: Express
access-control-allow-origin: *
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
access-control-allow-headers: Content-Type,Accept,X-Access-Token,X-Key,apikey,Authorization,Workspace,x-http-verb,x-rebrandly-internal
access-control-max-age: 3600

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 58ms
15ms Script
application/x-javascript 2a02:26f0:f7::5c7b:e053
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:f7::5c7b:e053 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=34362
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H2 403 links Show response
api.rebrandly.com/v1/ 152 B
629 B 230ms
229ms XHR
application/json 3.215.119.159
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rebrandly.com/v1/links
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/jquery-3.5.1.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.215.119.159 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-119-159.compute-1.amazonaws.com
Software: / Express
Resource Hash: 03f94ea8844e57c376e7fa137ca45fedfd4282be27aaa3d3ce25afe79dd7e375

Request headers

Accept: */*
Referer: https://www.sentinelone.com/
apikey: 499c8e7548a643f090e8263994728de3
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-rate-limit-reset-peak: 1642561716659
x-rate-limit-reset-peak-ip: 1642561716605
x-powered-by: Express
x-rate-limit-first-expire-peak: 1642561716659
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: *
x-rate-limit-remaining-peak: 24
content-length: 152
access-control-allow-headers: Content-Type,Accept,X-Access-Token,X-Key,apikey,Authorization,Workspace,x-http-verb,x-rebrandly-internal
x-rate-limit-first-expire-peak-ip: 1642561716605
x-rate-limit-remaining-peak-ip: 99

GET
H/1.1 200
OK tv2track.php
collector-5527.tvsquared.com/ 42 B
276 B 29ms
28ms Image
image/gif 54.216.103.176
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://collector-5527.tvsquared.com/tv2track.php?action_name=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&idsite=TV-45457227-1&rec=1&r=963110&h=3&m=8&s=35&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&_id=652d958ac41a0642&_idts=1642561715&_idvc=0&_idn=1&_viewts=&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=504
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.103.176 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-103-176.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Server: nginx
Connection: keep-alive
Request-Id: 8c6bcdc3-a321-4246-a3ec-cada1cfc99d8
P3p: CP='OTI DSP COR NID STP UNI OTPa OUR'
Content-Length: 42
Content-Type: image/gif

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 449
date: Wed, 19 Jan 2022 03:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 19 Jan 2022 05:01:06 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 38 KB
15 KB 46ms
23ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f2.1e100.net

Software

cafe /

Resource Hash

1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14835
x-xss-protection: 0
server: cafe
etag: 2630088915750441828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 19 Jan 2022 03:08:35 GMT

GET
H2 200 hotjar-2714452.js Show response
static.hotjar.com/c/ 4 KB
2 KB 84ms
41ms Script
application/javascript 18.66.97.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://static.hotjar.com/c/hotjar-2714452.js?sv=7

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.53 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-53.fra56.r.cloudfront.net

Software

Resource Hash

a8d4f6b8f6a42784c365f6a0fa15cd246b349625afcc66d7d339b0afb2821735

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
x-content-type-options: nosniff
cache-control: max-age=60
x-amz-cf-pop: FRA56-P2
etag: W/2d0214f95f45d8d835f492a014754742
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
x-cache-hit: 1
cross-origin-resource-policy: cross-origin
content-length: 2026
via: 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront)
x-amz-cf-id: juFRSdcoLcrHRdjCi3lSY8bDkhHDTlndYaPomcsaAsazQsJrgiKBhQ==

GET
H3

200

activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymor... Show response
10466992.fls.doubleclick.net/ Frame 0D01
Redirect Chain

https://10466992.fls.doubleclick.net/activityi;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-poly...
https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.se...

643 B
456 B

34ms
18ms

Document
text/html

142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

9047a3143fafa376962d7ba8768c3ebdeeb4d40ce467adb9120a39ad865c7119

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: about:blank

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 19 Jan 2022 03:08:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 431
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 19 Jan 2022 03:08:35 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bat.js Show response
bat.bing.com/ 36 KB
11 KB 56ms
34ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:34 GMT
content-encoding: gzip
last-modified: Fri, 03 Dec 2021 01:53:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58D149AED2874F338160EDA8ACA767F4 Ref B: FRAEDGE1420 Ref C: 2022-01-19T03:08:35Z
etag: "0cb09ee8e7d71:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 10468

GET
H/1.1 200
OK 56a667965d8d21035d00000d.js Show response
tag.marinsm.com/serve/ 12 KB
4 KB 79ms
16ms Script
text/javascript 151.101.192.65
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.marinsm.com/serve/56a667965d8d21035d00000d.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.192.65 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Cowboy /

Resource Hash

f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Via: 1.1 vegur, 1.1 varnish
X-Content-Type-Options: nosniff
Age: 585
X-Cache: HIT
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 3894
X-Served-By: cache-mxp6981-MXP
Server: Cowboy
X-Timer: S1642561715.371644,VS0,VE0
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=1800
Accept-Ranges: bytes
X-Cache-Hits: 1

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 29ms
10ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

16c13044cedc5c7482ad7db51913c164ffabc787ec5b6b0246acfec84cd6d01b

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 26187
x-xss-protection: 0
pragma: public
x-fb-debug: Qn9xRRn+4AjFWP8IipDJyGTkGGn7t1weXZqUPloDizbaLPnh8YFm7N7/Vbp0y+BkMoHF8kqcY3IsPv6OIO8bLA==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 19 Jan 2022 03:08:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 46ms
7ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H/1.1 200
OK bf-munchkin.min.js Show response
munchkin.brightfunnel.com/js/build/ 20 KB
7 KB 71ms
13ms Script
application/javascript 52.222.236.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.236.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-236-17.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: null
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 16 Jun 2021 18:10:10 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA56-P4
ETag: W/"20317c42053d4a6e5ba388544778b12a"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 eeb2f3ca588ea4437f4b97ed276a6664.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Wed, 19 Jan 2022 03:08:35 GMT
Connection: keep-alive
X-Amz-Cf-Id: xZe4Ey-sEZE9ywSVtjcP8ZiNzO77jjuiKW3LSQCpgjooQIlhCWXN1w==

GET
H2 200 qevents.js Show response
a.quora.com/ 39 KB
14 KB 63ms
17ms Script
text/plain 151.101.129.2
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://a.quora.com/qevents.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.129.2 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: s3LlaOWABX1LUjiLldBNr49lVAylKDRo
content-encoding: gzip
etag: "f32ebb1e93a72c0a57add6d07f688510"
age: 5169
x-cache: HIT, HIT
content-length: 13681
x-amz-id-2: 2/kUtnv9tT6QXEQNIlUeLD2HyqHjendStPa7kc/k53MLSXVsaNvnrWXFtM8bBSYzVTcuMkqLeAQ=
x-served-by: cache-iad-kcgs7200130-IAD, cache-mxp6962-MXP
last-modified: Fri, 25 Oct 2019 19:28:38 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1572031715/ctime:1572031714/gid:1000000/gname:employee/md5:f32ebb1e93a72c0a57add6d07f688510/mode:33188/mtime:1149709104/uid:1000332/uname:tzhou
x-timer: S1642561715.378112,VS0,VE0
date: Wed, 19 Jan 2022 03:08:35 GMT
vary: Accept-Encoding
x-amz-request-id: NC8JFPJSVQN8S1EV
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=7200
accept-ranges: bytes
content-type: text/plain
x-cache-hits: 1, 16

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 31ms
12ms Script
application/javascript 199.232.136.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.136.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kcgs7200096-IAD, cache-hhn11551-HHN

GET
H2 200 pixel.js Show response
www.redditstatic.com/ads/ 23 KB
8 KB 66ms
17ms Script
application/javascript 2a04:4e42::396
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash: 04686da390f8eec3ccd75869fa71e22cad452cfcff6ffa31c979f599d64831d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
via: 1.1 varnish, 1.1 varnish
last-modified: Wed, 03 Nov 2021 15:08:58 GMT
server: snooserv
etag: "3fbf36d562f1d2a543a89683060265ed"
vary: Accept-Encoding,Origin
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-encoding: gzip
content-length: 7632

GET
H2 200 client.js Show response
cdn.abrankings.com/js/ 35 KB
8 KB 72ms
7ms Script
application/javascript 2600:9000:2057:1400:11:8a36:7200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.abrankings.com/js/client.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:1400:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 5b86af60d9f8678ab66ac440e146e40656a7baa94b846811ed99b7cf8fb80f44

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: public
date: Mon, 04 Oct 2021 04:20:45 GMT
content-encoding: gzip
last-modified: Mon, 19 Jul 2021 16:31:33 GMT
server: nginx/1.18.0
age: 9240470
etag: W/"60f5a8e5-8d26"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 21da0a66bafe2c8de8be4a4d8039346a.cloudfront.net (CloudFront)
cache-control: max-age=15552000, public
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 1S2A3waMDt4yOvXP6sv6OfVKDOluHJvd88IocNaWy54IyLte20Xd1w==
expires: Sat, 02 Apr 2022 04:20:45 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 35ms
20ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-10604934

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7885decee353da0127b3651560230d127d45b10fcc38e757a9acc453198c4017

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36244
x-xss-protection: 0
expires: Wed, 19 Jan 2022 03:08:35 GMT

GET
H2 200 activityi;register_conversion=1;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-deliver...
10466992.fls.doubleclick.net/ 0
0 112ms
52ms Image
text/html 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://10466992.fls.doubleclick.net/activityi;register_conversion=1;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F?
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.70 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f6.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 200 78190 Show response
api.omappapi.com/v2/embed/ 4 KB
2 KB 144ms
94ms XHR
application/json 99.86.3.92
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.omappapi.com/v2/embed/78190?d=sentinelone.com
Requested by: Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.3.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-3-92.fra6.r.cloudfront.net
Software: Pagely Gateway/1.5.1 /
Resource Hash: 4b6b4ee9a261fdc0b35ed7b55e8f9b9226456b5429f499156bab1ae3e877f728

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-cache-config: 0 0
x-amz-cf-pop: FRA6-C1
x-cache-status: HIT
x-cache: Miss from cloudfront
access-control-allow-headers: X-CSRF-Token
x-optinmonster-account: 87916
x-user-agent: standard--
last-modified: Fri, 07 Jan 2022 23:20:25 GMT
server: Pagely Gateway/1.5.1
etag: W/"ea041f68e324d15285780ac4507834b6"
vary: Accept-Encoding, User-Agent
content-type: application/json
via: 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront)
access-control-expose-headers: X-OptinMonster-Account, X-User-Agent
cache-control: public, max-age=30, stale-while-revalidate=1800
access-control-allow-origin: *
x-amz-cf-id: 0t9BXz_Vj4Sbr9XCscljkDw5hFD9y2d-DBxV1qh_RJYJHGiK1Tck1g==
expires: Wed, 19 Jan 2022 03:01:06 GMT

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 351 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
693 B 55ms
15ms XHR
application/json 185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 03:08:35 GMT
X-Proxy-Origin: 217.64.151.29; 217.64.151.29; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 8ef1e938-a7cf-45c4-816a-86a150344981
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.sentinelone.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
375 B 72ms
25ms XHR
text/plain 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-233-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f2701b5a824dd7e7fe3ef2cc67fcdc93b9ae49f41e70f82e16de52057fd5f15e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://www.sentinelone.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 forms2.css
go.sentinelone.com/js/forms2/css/ 13 KB
3 KB 133ms
133ms Stylesheet
text/css 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/css/forms2.css

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
last-modified: Tue, 12 Oct 2021 18:01:53 GMT
server: cloudflare
etag: "5e031d-3437-5ce2ba3f1c640"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6cfcdc011cf9361c-MAN
content-length: 2623
expires: Wed, 19 Jan 2022 07:08:35 GMT

GET
H2 200 forms2-theme-plain.css
go.sentinelone.com/js/forms2/css/ 828 B
370 B 38ms
38ms Stylesheet
text/css 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 653
content-length: 246
last-modified: Tue, 12 Oct 2021 18:01:53 GMT
server: cloudflare
etag: "5e031f-33c-5ce2ba3f1c640"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 6cfcdc011cfa361c-MAN
expires: Wed, 19 Jan 2022 07:08:35 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.23.0/assets/ 13 KB
3 KB 27ms
27ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: r7t3xbAZ3QK/7lQuu5X7ww==
age: 7966558
vary: Accept-Encoding
content-length: 2950
x-ms-lease-status: unlocked
last-modified: Thu, 02 Sep 2021 03:11:51 GMT
server: cloudflare
etag: 0x8D96DBF68EC8D5B
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 7033fa14-101e-0042-586d-c4f3f2000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdc013e30375c-MXP

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/ 47 KB
11 KB 27ms
27ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 57AUyP21eMxOiwzpGGh99A==
age: 7966559
vary: Accept-Encoding
content-length: 11457
x-ms-lease-status: unlocked
last-modified: Thu, 02 Sep 2021 03:11:53 GMT
server: cloudflare
etag: 0x8D96DBF6A0C163B
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 78761e8b-501e-006c-596d-c47335000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6cfcdc013e31375c-MXP

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/6.23.0/assets/ 20 KB
4 KB 30ms
29ms Fetch
text/css 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.23.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.23.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Ye6OeZcNyuFoWog7CYs00A==
age: 12562
vary: Accept-Encoding
x-ms-lease-status: unlocked
last-modified: Thu, 02 Sep 2021 03:12:05 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 67adccd4-f01e-0048-3612-e8ea7b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 6cfcdc013e32375c-MXP

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/ 2 KB
2 KB 47ms
20ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/970186784/?random=1642561715388&cv=9&fst=1642561715388&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1c0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tiba=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aec3b020f5db302d0b10d2451c4a6d4f7916f4c4c976fc70d214d99652db517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 300800713594069 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 62ms
52ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/300800713594069?v=2.9.49&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d407f76c95cd40603bcfb779b9078aa78a88c65056c13adfd2c7eb5e1a188890

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: 67VGk/osL6Kg364Phf/3MRmqnPCXpk1c7iK0XQr5f90hSc4Hngm0CJO89cB+AzsiaQfl4MoMR8EGhXzKTWqJEA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 19 Jan 2022 03:08:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 9ms
9ms Script
application/x-javascript 104.117.217.134
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.117.217.134 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-117-217-134.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Fri, 29 Apr 2022 03:08:35 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2225260%252C432890%26time%3D1642561715401%26url%3Dhttps%253A%252F%252Fwww.sentine...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true...

0
155 B

310ms
111ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true&e_ipv6=AQKVOTU6_VewhgAAAX5wTr9ZXv557ioQ_iqcOcP17uXvqw9uHxyc-Btje_0FmwfyfUe4nDvRKxsY5dSivngF1bYjsmpgaw
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-lva1
content-type: application/javascript
content-length: 0
x-li-uuid: lG17qy2NyxbQDIVg3CoAAA==

Redirect headers

date: Wed, 19 Jan 2022 03:08:35 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 5112DCF29C7042A18C119C233FF09A84 Ref B: FRAEDGE0722 Ref C: 2022-01-19T03:08:36Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2225260%2C432890&time=1642561715401&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&liSync=true&e_ipv6=AQKVOTU6_VewhgAAAX5wTr9ZXv557ioQ_iqcOcP17uXvqw9uHxyc-Btje_0FmwfyfUe4nDvRKxsY5dSivngF1bYjsmpgaw
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXV5rObSUr3MWY/ZeSifA==

GET
H3 200 js Show response
www.google-analytics.com/gtm/ 94 KB
37 KB 37ms
18ms Script
application/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-K9ZDGR4&t=gtm7&cid=1250228294.1642561715

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

668555d4b5bc0bf0bfcd1b86f5666737729f19ed09eff468ceeb549d6c501e3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37554
x-xss-protection: 0
expires: Wed, 19 Jan 2022 03:08:35 GMT

GET
H2 403 adsct
analytics.twitter.com/i/ 0
0 136ms
112ms Script
text/plain 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nv1yw&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=33cf60e2-5183-4c09-9c12-c7d6592ba50f&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 106
date: Wed, 19 Jan 2022 03:08:35 UTC
cache-control: no-cache, no-store, max-age=0
server: tsa_o
x-connection-hash: 73aec555b5d8e4867b1d1b1ae4a6bcf51c6c1dce81bd3ee088ff526ce7ce548d
content-length: 0
strict-transport-security: max-age=631138519

GET
H2 200 adsct
t.co/i/ 43 B
227 B 145ms
121ms Image
image/gif 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nv1yw&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=33cf60e2-5183-4c09-9c12-c7d6592ba50f&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 115
date: Wed, 19 Jan 2022 03:08:34 GMT
server: tsa_o
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: ef149be9209107541c05d5d73c71338563bc4b79e4ab7f091ece05c1de9d3181
content-length: 43

GET
H2 200 modules.c89f04abde364444f21e.js Show response
script.hotjar.com/ 229 KB
61 KB 35ms
8ms Script
application/javascript 143.204.98.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://script.hotjar.com/modules.c89f04abde364444f21e.js

Requested by

Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2714452.js?sv=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.98.104 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-98-104.fra50.r.cloudfront.net

Software

Resource Hash

fddda23f711f28038cc34b216d5278692a4a93631433d3b90540981d1422e1b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 17 Jan 2022 17:41:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 120449
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 61580
access-control-allow-origin: *
last-modified: Mon, 17 Jan 2022 17:40:09 GMT
etag: "aaca953bf181ec7c714da08b16c0fdbb"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 45de888accabe1a1cb5a389e8c9c1e06.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-robots-tag: none
x-amz-cf-id: vYURu6yTlHm9TYR4hBXwrsQGhTOmDjHhNrhrAHz_qguZGE1f89PEnA==

GET
H/1.1 200
OK pixel
q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/ 43 B
422 B 401ms
99ms Image
image/gif 3.224.194.150
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q.quora.com/_/ad/ea333f827b114f8cb49ce787666ea90b/pixel?j=1&u=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tag=ViewContent&ts=1642561715442

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.194.150 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-194-150.compute-1.amazonaws.com

Software

nginx /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:35 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Q-Stat: ,4bcfe1324707d4435016da01009f2b6a,10.0.0.64,51228,217.64.151.29,,141418803013,1,1642561715.796,0.002,,.,0,0,0.000,0.004,-,0,0,197,277,138,10,26847,,,,,,-,
Content-Type: image/gif

POST
H/1.1 200
OK sd Show response
api.brightfunnel.com/v1/ 4 B
523 B 802ms
732ms XHR
application/json 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.brightfunnel.com/v1/sd
Requested by: Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept: application/json
Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Wed, 19 Jan 2022 03:08:36 GMT
Via: 1.1 cc77875ec7dfc885cffaa2ec6fa578f6.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
x-amzn-RequestId: d188a590-ada2-4ddc-a6ca-df0ee9c42821
X-Cache: Miss from cloudfront
Content-Type: application/json
Access-Control-Allow-Origin: *
X-Amzn-Trace-Id: Root=1-61e780b3-3d966fba02a3cda43955513f;Sampled=0
Connection: keep-alive
x-amz-apigw-id: MLEMHEOLoAMFW6Q=
Content-Length: 4
X-Amz-Cf-Id: _xT4XJ8lLxnA-_wfD8BU6iuHYs9bhdke9adC2pP_sRBhav7iA06Viw==

POST
H/1.1 200
OK sd Show response
api.brightfunnel.com/v1/ 4 B
523 B 1227ms
1161ms XHR
application/json 143.204.215.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.brightfunnel.com/v1/sd
Requested by: Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.33 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-33.fra53.r.cloudfront.net
Software: /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

accept: application/json
Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
content-type: application/x-www-form-urlencoded

Response headers

Date: Wed, 19 Jan 2022 03:08:36 GMT
Via: 1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA53-C1
x-amzn-RequestId: 0ef8ff5b-56ab-4191-a797-3a336324dfc7
X-Cache: Miss from cloudfront
Content-Type: application/json
Access-Control-Allow-Origin: *
X-Amzn-Trace-Id: Root=1-61e780b3-2d5d78940fb507002c3bd6c7;Sampled=0
Connection: keep-alive
x-amz-apigw-id: MLEMJFlSIAMFprg=
Content-Length: 4
X-Amz-Cf-Id: LI_lASjzg6nz0pTZZjbk-DDciO9chVre_BwcbsBxn9KW9-Xezikmdg==

GET
H/1.1

200
OK

tagjs Show response
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/tagjs?a_id=56252&source=js_tag
https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag

125 B
454 B

31ms
30ms

Script
text/javascript

3.248.4.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Server: 3.248.4.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-4-87.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 64a23f8f8c73218f7f6dea6783caa6a186d8f98bd96c50dc9d7eb2d099a644b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 125
Content-Type: text/javascript

Redirect headers

Location: https://pixel-geo.prfct.co/tagjs?check_cookie=1&a_id=56252&source=js_tag
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 204 134618848.js Show response
bat.bing.com/p/action/ 0
93 B 176ms
176ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/p/action/134618848.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 19 Jan 2022 03:08:35 GMT
cache-control: private,max-age=1800
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 728450DFDADA44C48B59A5C1BF83E714 Ref B: FRAEDGE1420 Ref C: 2022-01-19T03:08:35Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
173 B 34ms
33ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=134618848&tm=gtm002&Ver=2&mid=9a1e26b9-3375-469f-b4e9-a6697442276c&sid=1738fd7078d511ecb7711ba0dfb1f062&vid=1739386078d511ec99af35b7706a0796&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&p=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&r=&lt=2161&evt=pageLoad&msclkid=N&sv=1&rn=160182
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:35 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 54D333DCAAE745D7B315B901F20527DE Ref B: FRAEDGE1420 Ref C: 2022-01-19T03:08:35Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
125 B 219ms
165ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1642561715466&id=t2_49y2da7g&event=PageVisit&m.itemCount=&m.value=&m.currency=&m.transactionId=&m.customEventName=&uuid=ffe7bd47-db6e-4eea-b7f2-ace0742b99b4&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_5b7866e3
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
via: 1.1 varnish
server: Varnish
accept-ranges: bytes
content-length: 42
retry-after: 0
content-type: image/gif

GET
H2 200 webfont.js Show response
a.omappapi.com/app/js/webfont/1.5.18/ 16 KB
7 KB 10ms
10ms Script
application/javascript 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Requested by: Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/api.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-encoding: br
cdn-edgestorageid: 756
perma-cache: HIT
cdn-storageserver: DE-199
cdn-cachedat: 01/18/2022 22:57:32
cdn-pullzone: 293267
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
server: BunnyCDN-DE1-756
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 21:27:42 GMT
cdn-proxyver: 1.02
cdn-fileserver: 278
etag: W/"61df47ce-40cb"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
cdn-cache: HIT
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: c727fabdb1d73d25b04c56842839532d
cdn-requestcountrycode: SE
cdn-status: 200
cdn-requestpullsuccess: True

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

POST
H/1.1 200
OK visitWebPage
327-mnm-087.mktoresp.com/webevents/ 2 B
311 B 869ms
97ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://327-mnm-087.mktoresp.com/webevents/visitWebPage?_mchNc=1642561715545&_mchCn=&_mchId=327-MNM-087&_mchTk=_mch-sentinelone.com-1642561715544-55071&_mchHo=www.sentinelone.com&_mchPo=&_mchRu=%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Wed, 19 Jan 2022 03:08:36 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 39f54e71-08b1-4ad5-b7a8-62315e7c05bd

GET
H2 200 box-21ccaa45726c0f3c8c458f7a87eb2298.html Show response
vars.hotjar.com/ Frame 7A4E 2 KB
1 KB 30ms
7ms Document
text/html 143.204.215.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vars.hotjar.com/box-21ccaa45726c0f3c8c458f7a87eb2298.html
Requested by: Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2714452.js?sv=7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-118.fra53.r.cloudfront.net
Software: /
Resource Hash: c5da2e1eefbe4efd64ec18b775495cf3011d9ae03842917bfe1b0a50e03a7a44

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

content-type: text/html
content-length: 1044
date: Mon, 08 Nov 2021 14:05:19 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "6a4e2ae376c29011d2e53de65a08d0b7"
last-modified: Tue, 01 Jun 2021 09:17:15 GMT
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 b16802a1e349d80b7688070778305ae2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: UseevaEeSm59Fbe8ROV-WbNRjjbgDQwrY47KfgWMMgCONocHSDGWXw==
age: 6181396

GET
H2 200 /
www.google.com/pagead/1p-user-list/970186784/ 42 B
548 B 42ms
19ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/970186784/?random=1642561715388&cv=9&fst=1642561200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1c0&sendb=1&frm=0&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tiba=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&async=1&fmt=3&is_vtc=1&random=3619179193&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/970186784/ 42 B
548 B 43ms
21ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/970186784/?random=1642561715388&cv=9&fst=1642561200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg1c0&sendb=1&frm=0&url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tiba=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&async=1&fmt=3&is_vtc=1&random=3619179193&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 307303873637462 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 105ms
105ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/307303873637462?v=2.9.49&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

65b7a96db299dbbd6fd4a553960c668fd4e29a15e807940681921101b44bcccf

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: TIP79Q9XL8jLAsD5DKkurq0K/93MWPVzzGDF9lrplezJhB8bYXFfFR+hwWlTsv7H0HJlfvOkm5Di45f6cQc28g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 19 Jan 2022 03:08:35 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-deliv... Show response
adservice.google.com/ddm/fls/i/ Frame 0758 642 B
900 B 69ms
48ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F

Requested by

Host: 10466992.fls.doubleclick.net
URL: https://10466992.fls.doubleclick.net/activityi;dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d068b3d14b7ae9b85523042a3de08ac3510eddfd234305174b635fb218bbb1cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://10466992.fls.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 19 Jan 2022 03:08:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 431
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 15ms
14ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1667431181&t=pageview&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&ul=en-us&de=UTF-8&dt=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEADQAAAAC~&jid=488632184&gjid=1303514726&cid=1250228294.1642561715&tid=UA-38175129-1&_gid=794220371.1642561715&_r=1&gtm=2wg1c0KGGXSJ&z=2005606465

Requested by

Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.sentinelone.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v9/ 19 KB
19 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v9/zYX9KVElMYYaJe8bpLHnCwDKjXr8AIFsdA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:300,300i,400,400i,700,700i

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6e8266cf94edf161680868e39d5dd0be966424c35ee493d0a57f8288f2d6ba7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 23:23:58 GMT
x-content-type-options: nosniff
age: 13477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19328
x-xss-protection: 0
last-modified: Wed, 18 Aug 2021 16:52:00 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 23:23:58 GMT

GET
H2 200 XDFrame Show response
go.sentinelone.com/index.php/form/ Frame 705C 2 KB
735 B 132ms
132ms Document
text/html 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/index.php/form/XDFrame

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

date: Wed, 19 Jan 2022 03:08:35 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=3600
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6cfcdc02cede361c-MAN
content-encoding: gzip

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
445 B 59ms
18ms XHR
text/plain 2a00:1450:400c:c07::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-38175129-1&cid=1250228294.1642561715&jid=488632184&gjid=1303514726&_gid=794220371.1642561715&_u=aGDAAEACQAAAAC~&z=2118691165

Requested by

Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 19 Jan 2022 03:08:35 GMT
content-type: text/plain
access-control-allow-origin: https://www.sentinelone.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 40ms
17ms Image
image/gif 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-38175129-1&cid=1250228294.1642561715&jid=488632184&_u=aGDAAEACQAAAAC~&z=1594592729

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 36ms
17ms Image
image/gif 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-38175129-1&cid=1250228294.1642561715&jid=488632184&_u=aGDAAEACQAAAAC~&z=1594592729

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ 3 KB
497 B 44ms
23ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins:400,600,300

Requested by

Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bd2da6f7f9edd096289d54aeb4231d7eeb0c95a84fba5985b5745195fcd6acd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 19 Jan 2022 03:08:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 19 Jan 2022 03:08:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 19 Jan 2022 03:08:36 GMT

GET
H2 200 font-awesome.css
a.omappapi.com/app/js/font-awesome/4.7.0/css/ 37 KB
8 KB 7ms
7ms Stylesheet
text/css 89.187.169.47
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://a.omappapi.com/app/js/font-awesome/4.7.0/css/font-awesome.css
Requested by: Host: a.omappapi.com
URL: https://a.omappapi.com/app/js/webfont/1.5.18/webfont.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.187.169.47 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: unn-89-187-169-47.cdn77.com
Software: BunnyCDN-DE1-756 /
Resource Hash: 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
content-encoding: br
cdn-edgestorageid: 756
perma-cache: HIT
cdn-storageserver: DE-51
cdn-cachedat: 01/18/2022 22:57:33
cdn-pullzone: 293267
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cdn-requestpullcode: 200
server: BunnyCDN-DE1-756
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 20:58:49 GMT
cdn-proxyver: 1.02
cdn-fileserver: 236
etag: W/"61df4109-9226"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
cdn-cache: HIT
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: public, max-age=31919000
cdn-uid: efcab737-66db-4b75-ab55-ed485d5a01dd
cdn-requestid: f543da0dfabf32dd9f042503d33565b1
cdn-requestcountrycode: SE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2

403

adsct
analytics.twitter.com/i/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=twtr
https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_j2atkZMYVHC1wo8L2

0
47 B

138ms
137ms

Image
text/plain

104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_j2atkZMYVHC1wo8L2

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-response-time: 120
date: Wed, 19 Jan 2022 03:08:36 UTC
cache-control: no-cache, no-store, max-age=0
server: tsa_o
x-connection-hash: 73aec555b5d8e4867b1d1b1ae4a6bcf51c6c1dce81bd3ee088ff526ce7ce548d
content-length: 0
strict-transport-security: max-age=631138519

Redirect headers

Location: https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_j2atkZMYVHC1wo8L2
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2

204

sync
ups.analytics.yahoo.com/ups/58288/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=yah
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1
https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1&verify=true

0
122 B

17ms
16ms

Image
text/plain

18.156.0.31
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1&verify=true

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Server

18.156.0.31 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-156-0-31.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.0.33 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
server: ATS/9.1.0.33
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://ups.analytics.yahoo.com/ups/58288/sync?uid=pa_j2atkZMYVHC1wo8L2&_origin=1&verify=true
date: Wed, 19 Jan 2022 03:08:36 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=opx
https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_j2atkZMYVHC1wo8L2

43 B
274 B

84ms
18ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_j2atkZMYVHC1wo8L2
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:36 GMT
via: 1.1 google
server: OXGW/17.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Location: https://us-u.openx.net/w/1.0/sd?id=537114372&val=pa_j2atkZMYVHC1wo8L2
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=rbcn
https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_j2atkZMYVHC1wo8L2

0
239 B

80ms
9ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_j2atkZMYVHC1wo8L2
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

Redirect headers

Location: https://pixel.rubiconproject.com/tap.php?v=189868&nid=4106&expires=30&put=pa_j2atkZMYVHC1wo8L2
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H/1.1

200
OK

cb
pixel-geo.prfct.co/
Redirect Chain

https://pixel-geo.prfct.co/cs/?partnerId=goo
https://cm.g.doubleclick.net/pixel?google_nid=nowspots_bidder&google_hm=cGFfajJhdGtaTVlWSEMxd284TDI
https://pixel-geo.prfct.co/cb?partnerId=goo

43 B
365 B

32ms
30ms

Image
image/gif

3.248.4.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/cb?partnerId=goo
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Server: 3.248.4.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-4-87.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 19 Jan 2022 03:08:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel-geo.prfct.co/cb?partnerId=goo
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 240
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK /
pixel-geo.prfct.co/seg/ 43 B
365 B 186ms
115ms Image
image/gif 3.248.4.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-geo.prfct.co/seg/?add=4530935&source=js_tag&a_id=56252
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.248.4.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-248-4-87.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Cache-Control: no-store, no-cache, private
Connection: keep-alive
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Content-Length: 43
Content-Type: image/gif

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?t=2&add=4530935
https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935

43 B
1021 B

14ms
13ms

Image
image/gif

185.33.221.11
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

HTTP/1.1

Server

185.33.221.11 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

733.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 03:08:36 GMT
X-Proxy-Origin: 217.64.151.29; 217.64.151.29; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2191dd13-721d-44b7-9475-d79a9ee81441
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 19 Jan 2022 03:08:36 GMT
X-Proxy-Origin: 217.64.151.29; 217.64.151.29; 733.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 994039b5-b297-475c-bc17-bf1a79158340
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fseg%3Ft%3D2%26add%3D4530935
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 forms2.min.js Show response
go.sentinelone.com/js/forms2/js/ Frame 705C 205 KB
68 KB 34ms
34ms Script
application/x-javascript 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://go.sentinelone.com/js/forms2/js/forms2.min.js

Requested by

Host: go.sentinelone.com
URL: https://go.sentinelone.com/index.php/form/XDFrame

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://go.sentinelone.com/index.php/form/XDFrame
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
last-modified: Tue, 12 Oct 2021 18:01:53 GMT
server: cloudflare
age: 3
etag: "5e0326-33210-5ce2ba3f1c640"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=14400
cf-ray: 6cfcdc05aa46361c-MAN
vary: Accept-Encoding
expires: Wed, 19 Jan 2022 07:08:36 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
407 B 137ms
17ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=300800713594069&ev=PageView&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&rl=&if=false&ts=1642561716101&sw=1600&sh=1200&v=2.9.49&r=stable&ec=0&o=30&fbp=fb.1.1642561716100.681417235&it=1642561715398&coo=false&rqm=GET

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 19 Jan 2022 03:08:36 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 117ms
18ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=307303873637462&ev=PageView&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&rl=&if=false&ts=1642561716104&sw=1600&sh=1200&v=2.9.49&r=stable&ec=0&o=30&fbp=fb.1.1642561716100.681417235&it=1642561715398&coo=false&rqm=GET

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Wed, 19 Jan 2022 03:08:36 GMT

GET
H2 200 dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-deliv... Show response
adservice.google.de/ddm/fls/i/ Frame EFB5 194 B
870 B 102ms
47ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CLr9xZzrvPUCFcdU4AodIeQCpA;src=10466992;type=sitew0;cat=sitew0;ord=4656823047018;gtm=2wg1c0;auiddc=938202607.1642561715;u1=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F;ps=1;~oref=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://adservice.google.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Wed, 19 Jan 2022 03:08:36 GMT
expires: Wed, 19 Jan 2022 03:08:36 GMT
cache-control: private, max-age=0
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 177
x-xss-protection: 0
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:400,600,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 20:12:20 GMT
x-content-type-options: nosniff
age: 24976
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:02:01 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 18 Jan 2023 20:12:20 GMT

GET
H3 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:400,600,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 06:26:40 GMT
x-content-type-options: nosniff
age: 420116
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7988
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:02:10 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 06:26:40 GMT

GET
H3 200 pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins:400,600,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3834f0a520d623453cdb6b03b88331bc0394367eb18809f1037ea18c699ebded

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.sentinelone.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 06:52:09 GMT
x-content-type-options: nosniff
age: 418587
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7848
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:01:23 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 14 Jan 2023 06:52:09 GMT

GET
H2 200 ga.js Show response
ga.clearbit.com/v1/ 6 KB
2 KB 426ms
321ms Script
application/javascript 18.135.20.243
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ga.clearbit.com/v1/ga.js?authorization=pk_ed7b4bbadb390cf24ef37a1223019246
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KGGXSJ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.135.20.243 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-20-243.eu-west-2.compute.amazonaws.com
Software: envoy /
Resource Hash: da55c932f701632b195de449eeb5aca58252a8f8a0fe949231556ee4d6dc9696

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 19 Jan 2022 03:08:36 GMT
content-encoding: gzip
server: envoy
x-api-version: 2018-03-28
x-account-id: 330680ff-f4de-4d19-81d4-375af65453c9
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8

POST
H3 200 / Show response
www.facebook.com/tr/ Frame A763 0
18 B 34ms
20ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.sentinelone.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.sentinelone.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Wed, 19 Jan 2022 03:08:36 GMT

POST
H3 200 / Show response
www.facebook.com/tr/ Frame DA2A 0
15 B 18ms
13ms Document
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
Origin: https://www.sentinelone.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

content-type: text/plain
access-control-allow-origin: https://www.sentinelone.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-length: 0
server: proxygen-bolt
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
date: Wed, 19 Jan 2022 03:08:36 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 10ms
10ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1667431181&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&ul=en-us&de=UTF-8&dt=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Clearbit&ea=Enriched&el=Clearbit%20Enriched&_u=aHDAAEADQAAAAC~&jid=&gjid=&cid=1250228294.1642561715&tid=UA-38175129-1&_gid=794220371.1642561715&gtm=2wg1c0KGGXSJ&cd17=OVPN.com&cd18=ovpn.com&cd19=Technology%2CInformation%20Technology%20%26%20Services%2CSecurity%2CB2B&cd20=Information%20Technology&z=1870123197

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Jan 2022 17:40:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34064
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 228ms
189ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=9d8e7b5c66480000b380e76117000000a9431d00&session=bea90c86-5290-4226-87e8-324ea6aab8f7&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Wed%2C%2019%20Jan%202022%2003%3A08%3A35%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20can%20malware%20rapidly%20change%20itself%20within%20seconds%20from%20one%20download%20to%20another%3F%20Read%20on%20to%20discover%20how%20Ursnif%20delivers%20custom%20malicious%20payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&pageViewId=ac62bdc5-c6e0-4e41-8474-1eab56a335a4&an_uid=0

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:40 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 nr-1212.min.js Show response
js-agent.newrelic.com/ 34 KB
13 KB 53ms
17ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://js-agent.newrelic.com/nr-1212.min.js
Requested by: Host: www.sentinelone.com
URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: S6r4yaeB6jo_ZylmZ_5cM21n7ZH1t6gc
content-encoding: gzip
etag: "9dfe540eb31e6fc0e0dddd91e3511f68"
x-amz-request-id: DBVX5KZY1JVAQPWM
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 12828
x-amz-id-2: vDPcS9Vi7jZtqHxelHoKWcC/ol0mSEilCe+TD03KXZIEG8Eoyv1fUV1E2lpVhpr09W8H8xJXkUc=
x-served-by: cache-mxp6963-MXP
last-modified: Thu, 04 Nov 2021 21:16:16 GMT
server: AmazonS3
x-timer: S1642561720.930822,VS0,VE0
date: Wed, 19 Jan 2022 03:08:39 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=7200, stale-if-error=604800
accept-ranges: bytes
x-cache-hits: 636

GET
H/1.1 200
OK NRJS-7f7a0b93139dcf56f90 Show response
bam.nr-data.net/1/ 57 B
322 B 507ms
108ms Script
text/javascript 162.247.242.18

General

Check archive.org

Show headers Download Go to

Full URL: https://bam.nr-data.net/1/NRJS-7f7a0b93139dcf56f90?a=773889139&v=1212.e95d35c&to=ZlwDMkMCWxJQUkdYXF8WIAVFCloPHkJaX1RdXA%3D%3D&rst=7406&ck=1&ref=https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/&ap=817&be=593&fe=6791&dc=2160&perf=%7B%22timing%22:%7B%22of%22:1642561713095,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:2,%22c%22:2,%22s%22:26,%22ce%22:65,%22rq%22:65,%22rp%22:565,%22rpe%22:569,%22dl%22:569,%22di%22:2160,%22ds%22:2160,%22de%22:2161,%22dc%22:6788,%22l%22:6791,%22le%22:6792%7D,%22navigation%22:%7B%7D%7D&fp=1937&fcp=1937&at=ShsARAsYSBw%3D&jsonp=NREUM.setToken
Requested by: Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1212.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 162.247.242.18 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Cross-Origin-Resource-Policy: cross-origin
Content-Type: text/javascript;charset=iso-8859-1
Content-Length: 57
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 423 B
409 B 113ms
36ms XHR
application/json 35.157.40.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.40.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-40-192.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e99a52151c294c42df9ab0df1048d2403af8d1cf94817c26c706c8d75d002743

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Referer: https://www.sentinelone.com/
Accept-Language: de-DE,de;q=0.9
Authorization: Token 8ba4c5a3fa178cfadac2b61291295db2874be830
EpsilonCookie: 9d8e7b5c66480000b380e76117000000a9431d00

Response headers

date: Wed, 19 Jan 2022 03:08:40 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.sentinelone.com
access-control-allow-credentials: true
content-length: 221

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 78ms
24ms Preflight 35.157.40.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.40.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-40-192.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,epsiloncookie
Origin: https://www.sentinelone.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Wed, 19 Jan 2022 03:08:40 GMT
server: nginx
access-control-allow-origin: https://www.sentinelone.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization,epsiloncookie

GET
H2 200 test Show response
cdn.abrankings.com/ 2 B
417 B 136ms
82ms XHR
application/json 2600:9000:2057:1400:11:8a36:7200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.abrankings.com/test?url=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&abr_id=1280
Requested by: Host: munchkin.brightfunnel.com
URL: https://munchkin.brightfunnel.com/js/build/bf-munchkin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:1400:11:8a36:7200:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-my-header: my-header-content
date: Wed, 19 Jan 2022 03:08:40 GMT
content-encoding: gzip
server: nginx/1.20.1
x-amz-cf-pop: FRA6-C1
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=60, public
x-cache: Miss from cloudfront
x-amz-cf-id: ipW8_gFYG5MQWfVmKDlVz8QYvD8RbpuFL-anUugFhemTiTtIjaLq4w==
via: 1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 26ms
26ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1667431181&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&ul=en-us&de=UTF-8&dt=Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aHDAAEADQAAAAC~&jid=&gjid=&cid=1250228294.1642561715&tid=UA-38175129-1&_gid=794220371.1642561715&gtm=2wg1c0KGGXSJ&cd1=&cd2=&cd3=&cd4=&cd5=&z=2040366737

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 18 Jan 2022 17:40:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 34068
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 191ms
190ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=9d8e7b5c66480000b380e76117000000a9431d00&session=bea90c86-5290-4226-87e8-324ea6aab8f7&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2019%20Jan%202022%2003%3A08%3A40%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2019%20Jan%202022%2003%3A08%3A35%20GMT%22%2C%22timeSpent%22%3A%225730%22%2C%22totalTimeSpent%22%3A%225730%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20can%20malware%20rapidly%20change%20itself%20within%20seconds%20from%20one%20download%20to%20another%3F%20Read%20on%20to%20discover%20how%20Ursnif%20delivers%20custom%20malicious%20payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&pageViewId=ac62bdc5-c6e0-4e41-8474-1eab56a335a4&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:41 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 hxkfn4ir6d6t.js Show response
js.driftt.com/include/1642561800000/ 226 KB
65 KB 585ms
136ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1642561800000/hxkfn4ir6d6t.js

Requested by

Host: www.sentinelone.com
URL: https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/js/header.min.js?ver=1642357339

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f2fcd7287f4c5a41131831882a8227fd5d21311715f1812dd2b4cf7398ec0569

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: 4jqry9Q1lhWIU9dtVC9LOGx_V.PK24jr
content-encoding: gzip
etag: W/"9fb3f7cb59fe997ea7cf11bcac992c3e"
x-amz-cf-pop: FRA56-P5
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 21:08:13 GMT
server: nginx
date: Wed, 19 Jan 2022 03:08:41 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3m2_Ma2ep1I1VUmlUkDEW0gMN197IbPfEsuOi_pfU8b084u74RiIqQ==

GET
H2 200 core Show response
js.driftt.com/ Frame C8A7 2 KB
1 KB 113ms
113ms Document
text/html 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1642561800000/hxkfn4ir6d6t.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b06a32f937f86decd9c7dfa491fa6c81439f25f8eb81bc4e4554b528a7628458

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 18 Jan 2022 21:08:02 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: cuDklam2Kfqo40hpuirCYs_j.looQuiU
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 19 Jan 2022 03:08:41 GMT
cache-control: no-cache
etag: W/"a8a0f1cd9e21b84606f2d9652e5dcff0"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: WwqHXvVxqYwse0ZVybs9Z_svFBDNe4rwovaun_VFpdA0D2R0gtn0pw==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 4BC2 2 KB
1 KB 120ms
120ms Document
text/html 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1642561800000/hxkfn4ir6d6t.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b06a32f937f86decd9c7dfa491fa6c81439f25f8eb81bc4e4554b528a7628458

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Tue, 18 Jan 2022 21:08:02 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: cuDklam2Kfqo40hpuirCYs_j.looQuiU
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 19 Jan 2022 03:08:41 GMT
cache-control: no-cache
etag: W/"a8a0f1cd9e21b84606f2d9652e5dcff0"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: 628w3vIb_BiYP0e6OXY06lhcrfhqJPHSjDLBjo744fgpkFB-eSbnKg==

GET
H2 200 runtime~main.f42802d1.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 6 KB
3 KB 9ms
8ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c4317447371075eb3ca50437e1900816b3f13ce19d265f1d895ccb7171453a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:01 GMT
content-encoding: gzip
age: 21640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:36 GMT
server: nginx
etag: W/"059da84610e70105208536c6b146279b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Vq.oIILI0dSMC9pujOd2GI67zHkqP1yJ
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: y0tWiitDs608W3zzzImnM9k5ICPgHVmLEcJxF02Tct6mPQecYA5aUQ==

GET
H2 200 5.b4ccdd57.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 58 KB
20 KB 10ms
10ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:18 GMT
server: nginx
etag: W/"bf2b7dc96b40587d388df8918a276f1d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rlqnQvHWjB4kDZlydkAKa7LRajgzy9Gl
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: huwDc5S0naA0NP32j8jHc0wQGPh8TBGygMZJoiY6dhu2LAbaeuunDw==

GET
H2 200 main~493df0b3.91d188cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 6 KB
3 KB 11ms
11ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.91d188cd.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"364091b90499473799e7470f551ae597"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1JY.0LVfNng8iNIWI44BrilEq.Gn8MTC
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: -eAT24NI-N-FTgRQJPdEGwGTiwV1_vXs5RKfVbPPg7SC2bTibfHaMg==

GET
H2 200 runtime~main.f42802d1.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 6 KB
3 KB 8ms
8ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c4317447371075eb3ca50437e1900816b3f13ce19d265f1d895ccb7171453a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:01 GMT
content-encoding: gzip
age: 21640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:36 GMT
server: nginx
etag: W/"059da84610e70105208536c6b146279b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Vq.oIILI0dSMC9pujOd2GI67zHkqP1yJ
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zVA0m1KCGOaLOv1XAJxUGp7MPW8kS5FKXq9pjVhKf-fpOV_zyhQEYQ==

GET
H2 200 5.b4ccdd57.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 58 KB
20 KB 10ms
9ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/5.b4ccdd57.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:18 GMT
server: nginx
etag: W/"bf2b7dc96b40587d388df8918a276f1d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rlqnQvHWjB4kDZlydkAKa7LRajgzy9Gl
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CjmFv8xk9qzNnSZMwUvxfw4k2x0NJWwEyvrkBU9aZV1aNzDvLNkQ2A==

GET
H2 200 main~493df0b3.91d188cd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 6 KB
3 KB 10ms
10ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.91d188cd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:19 GMT
server: nginx
etag: W/"364091b90499473799e7470f551ae597"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1JY.0LVfNng8iNIWI44BrilEq.Gn8MTC
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AUUMO6TMT_2EMtGiP7VXrOMKxz0R3rmWCVRnDt9dSAPKmd3QcxHATQ==

GET
H2 200 43.bf52ab96.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 47 KB
14 KB 11ms
9ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4ab965f0d26a973cf1be72a39d537999"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SIJLtOk7PXIgJIf54NBJQngGjZ1AQW3g
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Tjd8sXwQW9z-M-Z-dvcvHOswzrsn1c096R9h-z4jjidTDDcvPHBdWg==

GET
H2 200 18.8ef42267.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 44 KB
13 KB 17ms
14ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.8ef42267.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"0c6f51f22b2a4bddd966a92b56c18e29"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zug6jTznDFRyogFlBOnxjireRPUkSHKT
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: uAmAK-9YfbwPQ9YcG5vZy7VNi9LLd7hMzRgc4k4UkemKQNQEKTeXYg==

GET
H2 200 37.dc112dfd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 25 KB
8 KB 17ms
15ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"391f6f28819c5b154653979d5154c888"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: A01_.TOyslfHN6C7mHM2iYp5F_NuODuW
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VrZcVDwV2Mh24gGOnBAKiuXq6GsPq5TpeGjl0l779I_pbHvZQytM6Q==

GET
H2 200 16.10d76686.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 16 KB
5 KB 18ms
16ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.10d76686.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mzB2ul0u_48ftIGEd6phwcoTfextzATL
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4YlctIMqRfibblo1cuPfBRdcBCgJta10TEwBBC0Q9Muuk-5a1Ko8LA==

GET
H2 200 21.8ac5d777.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 72 KB
22 KB 18ms
16ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmO9yEa8J.DEQa9FEB2tMN_1Ccd5vo_f
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CKOw4R-DWeaWQsWXM8_a4oMjwl8puwcLzK5XgmM4-QIs37O4pX-sgw==

GET
H2 200 34.801d3c89.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 16 KB
6 KB 19ms
17ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"fa218b0849860dbc5ceda153316c9c38"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VLd3KMbDPd6s2pCiJkiLNxZPlKywvnnH
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wwc9B_Y91UdlqKwP1jGXJEAVfYnDHvGJHe-DQVUAb6a48mhW0fXQCA==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 59 KB
19 KB 19ms
17ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 01:13:03 GMT
content-encoding: gzip
age: 1907738
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 23 Dec 2021 18:12:25 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a7WvmR.vwHMPBFEqQ8riDzB0H8J4vers
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mIeSirepBPfQSP_4RtIkzR4jmgivFgYxZym0rIJFWrana23KCS203g==

GET
H2 200 11.8d62d6c4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 91 KB
28 KB 23ms
21ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"8199a8634768214fc6204b18351f842d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: p_YagIEBvf.Qgp7hIJy74.J4YIszefj5
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: V-b5uRiP7tKhMx1iTRYSO6UVAVoMSRQrh2bOmjjeWGJHguANTccOxw==

GET
H2 200 10.937b0755.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 24 KB
7 KB 23ms
22ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.937b0755.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"e9243456e8ca8af97d77d525d5367d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1OI8MdaO_2Zet9LQGrgpik7z8k_2AhIl
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 13hWE_9Ux2XGj7v9gr46gHHs2J_apU4NfJPKfR_b90rjaefr8Q_rgw==

GET
H2 200 14.2a01ddd6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 62 KB
20 KB 24ms
22ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"6f457384188c98017d8d27281f3df6ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zE_bB0qnz1RnG2gJhrDf_G_kD4DCqLG4c3NyN-XJQZTjDyXhZhILbw==

GET
H2 200 41.ef07ba02.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 105 KB
34 KB 29ms
28ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.ef07ba02.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"da03c1012cb0aaeb2041fa677a272d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6OpxVYvZjRVHdu0KjdhZlusmExqFlB4E
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FRscmDhx1i-ZSYn5o4hR4OFRUSLm3rAraYi_eI1vvRdHpdE47MkZxA==

GET
H2 200 35.0810b4b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 12 KB
4 KB 30ms
28ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4a61646db5420cc31cb60b9287d9f544"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wDOiuCZSfZ.KHqNETPwI3S2a9GU0lEIR
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8c-IFZRhb41ejmcPh_pIqDhUHEWCJH7Cz0tFAQmvWqr1eAEENnBLXw==

GET
H2 200 26.d9eb886e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 12 KB
5 KB 30ms
29ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.d9eb886e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"44c7301d8127e805fcdfcc1b00ddf2ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EjkJtX0HE9ajSK4icA5a46UNajNAQcku
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RUcbAUnH0Mxh8hUVks0eABq2nxLmOvQ22mYqLr8MRmIJmvXktubjnA==

GET
H2 200 17.6c3c965c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 17 KB
7 KB 31ms
29ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.6c3c965c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"b0b166b8ed88c90ea3dc07661d0dcff4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: HHiN6wsTfDikx0BfRvhzq1f1VEBLDIa4
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Zul6x_Bwa4u3oLaxcQAXujFGWXCIjP_omw0oslxlchAPnn-fKTC3ZA==

GET
H2 200 8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame C8A7 11 KB
3 KB 31ms
30ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"a123c5b36f16fe6d3a3129e24df81443"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _wlNEHOawmowSdlpT1GApwIIwlk.3B3i
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AmbKhV3YEuvc1JCBKVU4YuhOJzGvEQQqF2mmFkYo-ZP_vlCPp_XN-Q==

GET
H2 200 8.c261aa49.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 69 KB
22 KB 32ms
30ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.c261aa49.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d46000a68446c0f0d39593395be6e2ceaea9184cce92cf0ff80cdb5312d45458

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:20:08 GMT
server: nginx
etag: W/"9a09e985e1a12bd0957027689116cdf0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y.ogFDB.VeQFKsrCgWJl1cyPFvX3.oAU
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: MxPrImvCJ6lEXQKqcAhIWkPnlkGEd1gRjCAz3-ZCmT548yhe4DKIZg==

GET
H2 200 15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame C8A7 24 B
667 B 31ms
30ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: NTyawK_L9tGaXtir9HUwqLjBSX949Nl9_cDBHDFyghXPJTvEFrI-Ig==

GET
H2 200 15.e8d1b02e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 74 KB
19 KB 32ms
31ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.e8d1b02e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

811dff95dee018cf649eb427d5eb74bf9687bbdf09123f501334c13eb983f193

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 20:32:11 GMT
content-encoding: gzip
age: 542190
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 19:40:59 GMT
server: nginx
etag: W/"df5bf47a1064a7fae2c466ea554a2ee7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EQOU6ajHI3jBu3tsySXRnOUpffRLH0u0
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3KyHyQLwTIE6pkjserdobfnAdnlSMBh6fLcnHy5uv_c6xBxQ-dyKIw==

GET
H2 200 22.fa9590a0.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 47 KB
13 KB 33ms
32ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.fa9590a0.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

6522666d0b38e568303ffecca0b5324536aa6abb39a0c7641663d125b61a7dca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:18:41 GMT
server: nginx
etag: W/"097154d3f29b1274c43b78a41cccdece"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eFHnLXku3Otc_WOdOkG2JhIf.35pBstW
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nmk4FiC9NgK4xrfPz_v2OA-M4HL1G6N-pbPgFzYJcx5NiUM6a6QqVw==

GET
H2 200 13.a13b3f0b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 41 KB
13 KB 38ms
38ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.a13b3f0b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f9a3bb5c387dd36fde93f604f7532035c603942c96e008bb1808dd37ec3639e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:01 GMT
content-encoding: gzip
age: 21640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:33 GMT
server: nginx
etag: W/"c7cfc6582d8601a6327a21d994273fcd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Q1eylsBH1co48z8EpB9me53tSVwX0r9f
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nAy33f3l9xnClB6IbVyYKG51Aw6zGb3OLnPwPLaB-XUavuHTR2U08Q==

GET
H2 200 43.bf52ab96.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 47 KB
14 KB 29ms
27ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/43.bf52ab96.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4ab965f0d26a973cf1be72a39d537999"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SIJLtOk7PXIgJIf54NBJQngGjZ1AQW3g
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: gEJvuxrEzHVFxXIP9XRdhJXOcKWzzeR2hOfDcKYSPxQdcCeHwzQCAQ==

GET
H2 200 18.8ef42267.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 44 KB
13 KB 30ms
28ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.8ef42267.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"0c6f51f22b2a4bddd966a92b56c18e29"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Zug6jTznDFRyogFlBOnxjireRPUkSHKT
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: L79-ByRpthvwuK-E9NZgj90wzkFefJC7oIKWNLBNaEcgyoSlMdT8Yw==

GET
H2 200 37.dc112dfd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 25 KB
8 KB 32ms
29ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/37.dc112dfd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"391f6f28819c5b154653979d5154c888"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: A01_.TOyslfHN6C7mHM2iYp5F_NuODuW
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: fZVmlOXUqMNQAlx61qqSSFfrJDFNB_pbOFzMq9zUz1uISe4pMn9rLw==

GET
H2 200 16.10d76686.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 16 KB
5 KB 32ms
30ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.10d76686.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c16e855d0a26bf91ae3cc32cdbfa3ad6"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mzB2ul0u_48ftIGEd6phwcoTfextzATL
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 01wvq8JoFhVGW053QQB7kJow7vamcAa1qFc5ZqRjAi-c_ZcfymxQvg==

GET
H2 200 21.8ac5d777.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 72 KB
22 KB 32ms
30ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/21.8ac5d777.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"c39414a669b98ba4a25856ccdc1c1c1b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: PmO9yEa8J.DEQa9FEB2tMN_1Ccd5vo_f
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: oDCzp754lemnbdu7Cjmr-v_3Fe9yfp7mvd9Zt5a64SxHoGcjM1SJuw==

GET
H2 200 34.801d3c89.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 16 KB
6 KB 34ms
32ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/34.801d3c89.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"fa218b0849860dbc5ceda153316c9c38"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: VLd3KMbDPd6s2pCiJkiLNxZPlKywvnnH
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 4Ov9Yv8XU3Pd8FUWevUgGYB7VwvVg33HsMlDeJwCCztLmIVRLaOkuQ==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 59 KB
19 KB 35ms
33ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 28 Dec 2021 01:13:03 GMT
content-encoding: gzip
age: 1907738
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 23 Dec 2021 18:12:25 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a7WvmR.vwHMPBFEqQ8riDzB0H8J4vers
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 59Iomq9qSqsykObyJC0ILPQXtt6xK9A0ql2C87HSP0fsEMqDpr1S4A==

GET
H2 200 11.8d62d6c4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 91 KB
28 KB 37ms
35ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/11.8d62d6c4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"8199a8634768214fc6204b18351f842d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: p_YagIEBvf.Qgp7hIJy74.J4YIszefj5
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: CJ5wA0UL13c-Mj7ctBJhRpp6Y-KIZkhsCjqLZIKFs7471vGONgB_1g==

GET
H2 200 10.937b0755.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 24 KB
7 KB 39ms
37ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.937b0755.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"e9243456e8ca8af97d77d525d5367d6b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 1OI8MdaO_2Zet9LQGrgpik7z8k_2AhIl
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Ab9cxXWdBnbtYJbbU_3OPt23Xu_GjhlfgHDevf-DSEpECBPaFRDE9g==

GET
H2 200 14.2a01ddd6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 62 KB
20 KB 41ms
39ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.2a01ddd6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"6f457384188c98017d8d27281f3df6ad"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: KpoEpDmO7G9TLWLfSTzA1dytLAyREIfM
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vWRlTQV6Q_mR3q6rQK-m3qXbduWkVtQtIlqrNQLYU299dSHZumgQMg==

GET
H2 200 41.ef07ba02.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 105 KB
34 KB 42ms
40ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/41.ef07ba02.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"da03c1012cb0aaeb2041fa677a272d14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6OpxVYvZjRVHdu0KjdhZlusmExqFlB4E
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: hCX5vXufZZBJ27-u4kW6GYD5rMDqN1yjxn7lB2Acv-LN7qUOQXxLig==

GET
H2 200 35.0810b4b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 12 KB
4 KB 44ms
42ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.0810b4b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4a61646db5420cc31cb60b9287d9f544"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wDOiuCZSfZ.KHqNETPwI3S2a9GU0lEIR
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AnfsS1Zj1RQgYwsXYBj_CLK2E7Lq-C1KtUMV-q0hJtP2CA7eIML8kw==

GET
H2 200 26.d9eb886e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 12 KB
5 KB 44ms
43ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/26.d9eb886e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"44c7301d8127e805fcdfcc1b00ddf2ea"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EjkJtX0HE9ajSK4icA5a46UNajNAQcku
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HN7MOYZ4P6E_1jIBLZ2xI-CpSs61b0WYm6-r7wCFlZCpz6Mf6pZ3ug==

GET
H2 200 17.6c3c965c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 17 KB
7 KB 45ms
43ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.6c3c965c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"b0b166b8ed88c90ea3dc07661d0dcff4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: HHiN6wsTfDikx0BfRvhzq1f1VEBLDIa4
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3UUdpEZY1PGH5r01Cfs75vxk6zOQYNjxVPhprY8atfm5ZM1kXXkCBA==

GET
H2 200 8.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 11 KB
3 KB 28ms
27ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/8.5b0bb1c3.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
content-encoding: gzip
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"a123c5b36f16fe6d3a3129e24df81443"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: _wlNEHOawmowSdlpT1GApwIIwlk.3B3i
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: E_kWmHDUuRaYXYMQBUBcO3GD6vk6TSyXrz9dNPqoPzsHD1BaorUOyA==

GET
H2 200 8.c261aa49.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 69 KB
22 KB 46ms
45ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/8.c261aa49.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d46000a68446c0f0d39593395be6e2ceaea9184cce92cf0ff80cdb5312d45458

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:20:08 GMT
server: nginx
etag: W/"9a09e985e1a12bd0957027689116cdf0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y.ogFDB.VeQFKsrCgWJl1cyPFvX3.oAU
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dJCKOIQuXPtgjYJ-vGPRng1p0MDZSlEjk_OdSy-v2QN0Pz1mGbV9qQ==

GET
H2 200 15.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 24 B
667 B 29ms
27ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/15.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:41 GMT
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
age: 1250100
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bzo2zbrJexGHlTPaLulG8N5yfdXT7FR0
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wFPNJ7RMUDKWif9UczVwZTpDhARnDABGxuLTlup9HgNts1hVRZcepQ==

GET
H2 200 15.e8d1b02e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 74 KB
19 KB 48ms
47ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.e8d1b02e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

811dff95dee018cf649eb427d5eb74bf9687bbdf09123f501334c13eb983f193

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 12 Jan 2022 20:32:11 GMT
content-encoding: gzip
age: 542190
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 12 Jan 2022 19:40:59 GMT
server: nginx
etag: W/"df5bf47a1064a7fae2c466ea554a2ee7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: EQOU6ajHI3jBu3tsySXRnOUpffRLH0u0
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AxSbYfY7zeYC2S_FWy5rB_nQPtadhc2MnZdtYu6xZp5KrULezyPCpQ==

GET
H2 200 22.fa9590a0.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 47 KB
13 KB 50ms
49ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.fa9590a0.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

6522666d0b38e568303ffecca0b5324536aa6abb39a0c7641663d125b61a7dca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:18:41 GMT
server: nginx
etag: W/"097154d3f29b1274c43b78a41cccdece"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eFHnLXku3Otc_WOdOkG2JhIf.35pBstW
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: nBFzmi5Ew6-5IN9rWcdzV6MrAq6fwQjswv_wEDyC5MBhPMaBG3uxjw==

GET
H2 200 13.a13b3f0b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 41 KB
13 KB 52ms
51ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.a13b3f0b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f9a3bb5c387dd36fde93f604f7532035c603942c96e008bb1808dd37ec3639e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:01 GMT
content-encoding: gzip
age: 21640
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:33 GMT
server: nginx
etag: W/"c7cfc6582d8601a6327a21d994273fcd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Q1eylsBH1co48z8EpB9me53tSVwX0r9f
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: bcg_6BFDDM4uuyIPbXFiNu8PWgeCCOVBw930oR9-Ac8YnCbb7sKuNg==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 9 KB
3 KB 18ms
16ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DgvAfZ7BPwPZGfOrE621PjhvvHFr1DU0
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VfarEm82Vzaa-arl7sn3vuCBNu4HVU-zWI50i-uG-oUtT3WTFXYbGw==

GET
H2 200 24.81d46fe7.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 33 KB
10 KB 18ms
17ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.81d46fe7.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"4f751bc7b45f18c1d343a3081fe2509f"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: LcjepTSdTIP3TYamt9S6TQ4IzFvRquuU
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VO7MP0dRyFoWfjGTXvMdPDsLwaXSyRvKN-Kyi69thlFwAaLEd-BB1w==

GET
H2 200 25.49c6961c.chunk.css
js.driftt.com/core/assets/css/ Frame C8A7 8 KB
2 KB 18ms
17ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/25.49c6961c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"f80cd64e339375567091159cb077b941"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: bxrqjBCKX9ERzz7WjftbPaYdOBk8_KxN
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: IIAaYxHQ6L3eDbEMRWZhMogrwWuWqiCCPsUSH4P6sJAkxB2XatlbaQ==

GET
H2 200 25.fb56eef2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 12 KB
5 KB 19ms
18ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.fb56eef2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

7adcb70e6024511e632f7c3ea8f8fbd639b9ad4d6a7404140682002f5d6567c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:20:07 GMT
server: nginx
etag: W/"38c928b061b86c029aa682f6bebc8ebd"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ujXn.IxoIs_YEf5msLNJfqrX2WWi4hFh
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: vcymZjmWWJy4L1Lophk6CDp626MxrQtBqFiShZDoyAz9wuKx0uD0Kw==

GET
H2 200 19.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame C8A7 365 B
1008 B 19ms
18ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/19.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 365
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: "06b2963b029c0824382815165bfea73e"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: eDSgTpssczGDn2812OLuvvF.eUpzKWka
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ydMwkEYOXDU3vNwF6Y60CsEHvyXOwJ8_f5eoD1JX-TiUw1Gbm2p7dA==

GET
H2 200 19.c23fff6c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame C8A7 84 KB
23 KB 19ms
19ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.c23fff6c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f84f1b5eb8075f18171863ae29f94ee5f4d31d666c8366974b6fbf33e3661c96

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=hxkfn4ir6d6t&region=US&forceShow=false&skipCampaigns=false&sessionId=a6db6f43-8023-4af3-a2d5-4b23cbdd4cc5&sessionStarted=1642561721.502&campaignRefreshToken=71c8cffb-5f4c-453c-a80d-c877d1648260&hideController=false&pageLoadStartTime=1642561713664&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:20:06 GMT
server: nginx
etag: W/"fe5612bd16c014e45719a1150e5bb81e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: laTmq5WmGDO4Achyp2By3U1FRD62EthN
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rDTT2djmExZUoW_ObnaBFVgsMUhgVqXrKjZPLwm51Cp1ZSm6dJYRlw==

GET
H2 200 32.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 3 KB
1 KB 11ms
10ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/32.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: u5jls1rsjTMRW03RSXYJxMQTbD86EmFF
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: xUIe_xcpB43CpU1P0N7RVdI4CFuF-62-uVvnXeJiHk7wflb-MPvUjA==

GET
H2 200 32.b28e01c9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 3 KB
2 KB 15ms
15ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.b28e01c9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

3b6f404deff7d8bb1bd68dfb931256495073e25291975edfa559ffe6f5618108

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"33a035085f1b1760b03df16c954cb9e5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: oUsfCQqLP7IZ_8Pa1w6UboZ5WJXcp0fJ
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lZv-kx-gnTOPfNTFGJxirGfIzXKLhK_2JBBXCMwvlOoHOFDg5lKTsg==

GET
H2 200 0.0b2ebd4a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 9 KB
3 KB 27ms
27ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:16 GMT
server: nginx
etag: W/"c5efcdc9e465604f32cf24af10fd6c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: DgvAfZ7BPwPZGfOrE621PjhvvHFr1DU0
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zgEN8OzR1Hpi6GVz08xHQVODzm4tiIz0h6pWcL8gWKt6l01K5Gxlnw==

GET
H2 200 2.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 7 KB
2 KB 31ms
30ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/2.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Y5MQMpfNZ9bYDeQmDMLbw0xNzGrQukfM
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8tSp6Yj1v6OR8iYgdM9uPYnNen3RPzH-IAxLlU1-Q5O-qysr3TaAsw==

GET
H2 200 2.90bfb041.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 54 KB
16 KB 31ms
31ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/2.90bfb041.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:17 GMT
server: nginx
etag: W/"dc43e7dd478d83a9091a7335b8beb11d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: dNyr.b_J6AuxSb56NRWJ3LKsWJ9BzeOS
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XMVPSZZcLZKXZlgTeppyxbO_NXrt7ooovd2K_ko_UTqLy5GnzXrpsg==

GET
H2 200 1.ee2abab8.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 44 KB
7 KB 31ms
31ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.ee2abab8.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

5dbbdc87055e3735446865635b4678301f3e2a1a8796c5c8f9e6708aee679592

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 04 Jan 2022 15:53:42 GMT
content-encoding: gzip
age: 1250099
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 04 Jan 2022 15:08:15 GMT
server: nginx
etag: W/"c00b54e499f71a56923e5c2db3c1ebfc"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: xuVhTqr.cFOxlgjsfd4VCDjIAEraYcrH
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: RO-dgr61Yk2BE-AL40rFTD6hiwXYieoRusDJlG67mYyPNNquuN_YYA==

GET
H2 200 1.85c792f6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 70 KB
24 KB 32ms
32ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.85c792f6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

19b955ead2f498683ffc96ab3435a0008664c88fb54fb0c9a11c2375eab983df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 05 Jan 2022 16:46:54 GMT
content-encoding: gzip
age: 1160507
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 05 Jan 2022 15:20:06 GMT
server: nginx
etag: W/"cc05013e3177685648dd77589b386b45"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 08LFmMqk5GNBh2Z.wHlfl2yRGplkAi79
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: A06CZzuV7ezA_0qpW_sMkECUhvt1UGF_Ois2HzXlhI8OueSTbF90HQ==

GET
H2 200 30.d5d7fd22.chunk.css
js.driftt.com/core/assets/css/ Frame 4BC2 11 KB
3 KB 32ms
31ms Stylesheet
text/css 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/30.d5d7fd22.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

ce53cf4a2f572652f9a276c557363c035364d0630a4a4d88a39547dcd410a146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:02 GMT
content-encoding: gzip
age: 21639
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:31 GMT
server: nginx
etag: W/"9ce788b25621f27bc1c6feb81a4c7910"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: yUJ5ToXNAHd3hZRFAd7z1kLXpQwPBgjz
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: djFTX1kYXqMw1XmS3MKSQffxnpOlRA8L3f6uGQqnWRwFG7Nim9MX1A==

GET
H2 200 30.0264f740.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 4BC2 12 KB
5 KB 33ms
33ms Script
application/javascript 18.66.112.39

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.0264f740.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.f42802d1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.39 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e3369f08e111fdfc9099c11d13ba381f6cae96f9a61d963a192534b0a2ff3e65

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1642561713664
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 18 Jan 2022 21:08:02 GMT
content-encoding: gzip
age: 21639
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 18 Jan 2022 19:52:34 GMT
server: nginx
etag: W/"287d3aaba0f9d425aa4180a097390f6e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: fviFjSyt.hWwDTAczVkTKSn_BtYweW8F
via: 1.1 0c39e892d8c809025c8f47425847f680.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-P5
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: LZ5Q9hkypJWkpCsPW5JbMTiYXS9lWpejgKiD-s5It_83qFNdxCxoVQ==

POST v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame C8A7 0
0

OPTIONS v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0

POST ping
bootstrap.api.drift.com/widget_bootstrap/ Frame C8A7 0
0

OPTIONS ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 0
0

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 258ms
257ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=3576c97e67a9b7f8553a44ff1cc54791&svisitor=9d8e7b5c66480000b380e76117000000a9431d00&session=bea90c86-5290-4226-87e8-324ea6aab8f7&event=active_time_track&q=%7B%22currentTime%22%3A%22Wed%2C%2019%20Jan%202022%2003%3A08%3A41%20GMT%22%2C%22lastTrackTime%22%3A%22Wed%2C%2019%20Jan%202022%2003%3A08%3A40%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%226732%22%7D&isIframe=false&m=%7B%22description%22%3A%22How%20can%20malware%20rapidly%20change%20itself%20within%20seconds%20from%20one%20download%20to%20another%3F%20Read%20on%20to%20discover%20how%20Ursnif%20delivers%20custom%20malicious%20payloads%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Ursnif%20-%20A%20Polymorphic%20Delivery%20Mechanism%20Explained%20-%20SentinelOne%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&pageViewId=ac62bdc5-c6e0-4e41-8474-1eab56a335a4&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.sentinelone.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Wed, 19 Jan 2022 03:08:42 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5cd7f442ce254b26aa186e1c33abd83b

Domain: metrics.api.drift.com
URL: https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Domain: metrics.api.drift.com
URL: https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Domain: bootstrap.api.drift.com
URL: https://bootstrap.api.drift.com/widget_bootstrap/ping

Domain: bootstrap.api.drift.com
URL: https://bootstrap.api.drift.com/widget_bootstrap/ping

Verdicts & Comments Add Verdict or Comment

154 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

49 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sentinelone.com/	1969-12-31 23:59:59	Name: __cfredirector_sm Value: DE
.go.sentinelone.com/	1970-01-20 00:16:03	Name: __cf_bm Value: S51PYZiEat69_7Ph8FW6uQVAjwbN10gkpuxBhJ_PX30-1642561713-0-AY94VI8yKNM1ExhtM3qi9Pw4vMHoK2FCGTKWAi3w6zAuIUisLPTrhT8KRAIR83ftQqo3kjoKMMqOrPqMzGsFHGk=
.6sc.co/	1970-01-20 17:47:13	Name: 6suuid Value: 9d8e7b5c66480000b380e76117000000a9431d00
www.sentinelone.com/	1970-01-20 17:47:13	Name: _tq_id.TV-45457227-1.802f Value: 652d958ac41a0642.1642561715.0.1642561715..
.sentinelone.com/	1970-01-20 02:25:37	Name: _gcl_au Value: 1.1.938202607.1642561715
www.sentinelone.com/	1970-01-24 00:14:35	Name: _omappvp Value: kPTNGlcDWaDDwit3Jev2q3tK4Y4eONScdzaeZf4LAwSx48fXIFKhhQyO1XYz3A9vXyC3OuRFvA3kLPev5TGlHtvd5wyNkPX4
www.sentinelone.com/	1970-01-20 00:16:02	Name: _omappvs Value: 1642561715327
.bing.com/	1970-01-20 09:37:37	Name: MUID Value: 08AF8AC46F036C612B739BF56E686D93
.sentinelone.com/	1970-01-20 17:47:13	Name: _ga Value: GA1.2.1250228294.1642561715
.sentinelone.com/	1970-01-20 00:17:28	Name: _gid Value: GA1.2.794220371.1642561715
www.sentinelone.com/	1970-01-20 00:26:06	Name: _an_uid Value: 0
www.sentinelone.com/	1970-01-20 17:47:13	Name: _gd_svisitor Value: 9d8e7b5c66480000b380e76117000000a9431d00
.sentinelone.com/	1970-01-20 08:54:25	Name: bf_lead Value: 1blndmqhofp800
.sentinelone.com/	1970-01-20 00:17:28	Name: _uetsid Value: 1738fd7078d511ecb7711ba0dfb1f062
.sentinelone.com/	1970-01-20 09:37:37	Name: _uetvid Value: 1739386078d511ec99af35b7706a0796
.sentinelone.com/	1970-01-20 02:25:37	Name: _rdt_uuid Value: 1642561715466.ffe7bd47-db6e-4eea-b7f2-ace0742b99b4
go.sentinelone.com/	1969-12-31 23:59:59	Name: BIGipServerab14web-nginx-app_https Value: !raAQpumyK4Vs1BHaQbCLRqc3TBcuihMqzGOX7JH6xhK6lpvpAylhShzTuLD5QW6g74+a6t+DiX+GX2A=
.linkedin.com/	1970-01-20 00:59:13	Name: UserMatchHistory Value: AQLyWhn6cR0RCQAAAX5wTr0XrkE8Pgc7otaFFSPeODW9iOuhiRTqwoAfJ8WwtHxNtysw8MmVOTWHfQ
.linkedin.com/	1970-01-20 00:59:13	Name: AnalyticsSyncHistory Value: AQJ7DgbdyUkhmgAAAX5wTr0XMQ9iuIxzRmsetI_Z3FUpcMpGQoamHN17TVyCbe1aHt7A50aKYhewsF9G5gJD2Q
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 17:47:55	Name: bcookie Value: "v=2&938e960c-2e9e-421d-888e-acc482dad431"
.linkedin.com/	1970-01-20 00:17:28	Name: lidc Value: "b=VGST04:s=V:r=V:a=V:p=V:g=2533:u=1:x=1:i=1642561715:t=1642648115:v=2:sig=AQGkyo5LQzSIeyxglh6OzWeZglQR8n4k"
.sentinelone.com/	1970-01-20 09:01:37	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Wed+Jan+19+2022+03%3A08%3A35+GMT%2B0000+(GMT)&version=6.23.0&isIABGlobal=false&hosts=&landingPath=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&groups=C0003%3A0%2CC0001%3A1%2CC0002%3A0%2CC0004%3A0
.sentinelone.com/	1970-01-20 17:47:13	Name: _mkto_trk Value: id:327-MNM-087&token:_mch-sentinelone.com-1642561715544-55071
.twitter.com/	1970-01-20 17:47:13	Name: personalization_id Value: "v1_f4jF/lGLZnUE6eE7aviWJw=="
.sentinelone.com/	1970-01-20 00:16:01	Name: _gat_UA-38175129-1 Value: 1
.prfct.co/	1970-01-20 17:47:13	Name: pa_uid Value: pa_j2atkZMYVHC1wo8L2
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 17:47:55	Name: bscookie Value: "v=1&20220119030835d81cfbfa-8967-47cc-8b9a-70e4d845522eAQEzt7dCp62VQl--UsL2nlAzDfc51g72"
.linkedin.com/	1970-01-20 17:38:41	Name: li_gc Value: MTswOzE2NDI1NjE3MTU7MjswMjGC2nfwdzo6X++m7n4umkn1+E00P/qJ3Pyzo03PW9snRQ==
.adnxs.com/	1970-01-20 02:25:37	Name: uuid2 Value: 3898358582406463517
.prfct.co/	1970-01-20 17:47:13	Name: pa_twitter_ts Value: 1642561716045
.sentinelone.com/	1970-01-20 02:25:37	Name: _fbp Value: fb.1.1642561716100.681417235
.adnxs.com/	1970-01-20 02:25:37	Name: anj Value: dTM7k!M4/8CxrEQF']wIg2ImIG!Wrd!@wnf-Te9(>wL5L!!'B^$_*P%
.prfct.co/	1970-01-20 17:47:13	Name: pa_yahoo_ts Value: 1642561716114
.prfct.co/	1970-01-20 17:47:13	Name: pa_openx_ts Value: 1642561716115
.prfct.co/	1970-01-20 17:47:13	Name: pa_rubicon_ts Value: 1642561716114
.prfct.co/	1970-01-20 17:47:13	Name: pa_google_ts Value: 1642561716115
.facebook.com/	1970-01-20 02:25:37	Name: fr Value: 0LdWGgiU1cTLMBEOG..Bh54C0...1.0.Bh54C0.
.sentinelone.com/	1970-01-20 09:01:37	Name: _hjSessionUser_2714452 Value: eyJpZCI6ImUzOGQ1MjcxLWRlZTQtNTEyNC04NGRjLTg3Y2QzY2VhOTQ2NCIsImNyZWF0ZWQiOjE2NDI1NjE3MTU1NjMsImV4aXN0aW5nIjpmYWxzZX0=
.sentinelone.com/	1970-01-20 00:16:03	Name: _hjFirstSeen Value: 1
www.sentinelone.com/	1970-01-20 00:16:01	Name: _hjIncludedInSessionSample Value: 0
.sentinelone.com/	1970-01-20 00:16:03	Name: _hjSession_2714452 Value: eyJpZCI6IjkyMzFhNTU3LTEzNjItNDI5OS1hNWUyLTNmYzM0OWViYTRiZiIsImNyZWF0ZWQiOjE2NDI1NjE3MTYyNDksImluU2FtcGxlIjpmYWxzZX0=
.sentinelone.com/	1970-01-20 00:16:03	Name: _hjAbsoluteSessionInProgress Value: 0
.yahoo.com/	1970-01-20 09:01:59	Name: A3 Value: d=AQABBLSA52ECEBjMQnYYCBaN-JcP2KqQ5IcFEgEBAQHS6GHxYQAAAAAA_eMAAA&S=AQAAAvwo_b-iF6dk6ciIWLcte1c
.doubleclick.net/	1970-01-20 09:37:37	Name: IDE Value: AHWqTUlrxGV30BhJwDmmPKBD6XyceaCeTBG--ZeVz--CfKWXp4ZFSrwMyWTBGE7TjEg
.analytics.yahoo.com/	1970-01-20 09:03:04	Name: IDSYNC Value: 18z4~22qr
www.sentinelone.com/	1970-01-20 17:47:13	Name: _gd_visitor Value: 87c48453-ea9b-4254-8f57-5a82b729e265
www.sentinelone.com/	1970-01-20 00:16:16	Name: _gd_session Value: bea90c86-5290-4226-87e8-324ea6aab8f7

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.sentinelone.com/blog/ursnif-polymorphic-delivery-mechanism-explained/ Message: Access to script at 'https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5cd7f442ce254b26aa186e1c33abd83b' from origin 'https://www.sentinelone.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5cd7f442ce254b26aa186e1c33abd83b Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nv1yw&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=33cf60e2-5183-4c09-9c12-c7d6592ba50f&tw_document_href=https%3A%2F%2Fwww.sentinelone.com%2Fblog%2Fursnif-polymorphic-delivery-mechanism-explained%2F&tpx_cb=twttr.conversion.loadPixels Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.sentinelone.com/wp-json/wordpress-popular-posts/v1/popular-posts Message: Failed to load resource: the server responded with a status of 500 ()
network	error	URL: https://api.rebrandly.com/v1/links Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://analytics.twitter.com/i/adsct?p_id=48571&p_user_id=pa_j2atkZMYVHC1wo8L2 Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self' http://sentinelone.lookbookhq.com https://sentinelone.lookbookhq.com http://sentinelone.pathfactory.com https://sentinelone.pathfactory.com http://assets.sentinelone.com https://assets.sentinelone.com https://app.scalyr.com https://app.eu.scalyr.com localhost;
Strict-Transport-Security	max-age=15768000;, max-age=300
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOW-FROM SAMEORIGIN, sentinelone.pathfactory.com, sentinelone.lookbookhq.com, assets.pathfactory.com, go.sentinelone.com, www.sentinelone.com, app.scalyr.com, app.eu.scalyr.com, localhost
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10466992.fls.doubleclick.net
327-mnm-087.mktoresp.com
899029.smushcdn.com
a.omappapi.com
a.quora.com
adservice.google.com
adservice.google.de
alb.reddit.com
analytics.twitter.com
api.brightfunnel.com
api.omappapi.com
api.rebrandly.com
b.6sc.co
bam.nr-data.net
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
cdn.abrankings.com
cdn.cookielaw.org
cdn.onesignal.com
cloud.typography.com
cm.g.doubleclick.net
collector-5527.tvsquared.com
connect.facebook.net
de.sentinelone.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
ga.clearbit.com
geolocation.onetrust.com
go.sentinelone.com
googleads.g.doubleclick.net
j.6sc.co
js-agent.newrelic.com
js.driftt.com
metrics.api.drift.com
munchkin.brightfunnel.com
munchkin.marketo.net
pixel-geo.prfct.co
pixel.rubiconproject.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
t.co
tag.marinsm.com
ups.analytics.yahoo.com
us-u.openx.net
vars.hotjar.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
www.sentinelone.com
bootstrap.api.drift.com
cdn.onesignal.com
metrics.api.drift.com
104.111.232.231
104.111.233.140
104.117.217.134
104.17.72.206
104.244.42.3
104.244.42.69
104.82.195.159
108.174.10.14
142.250.181.226
142.250.185.226
142.250.186.70
143.204.215.118
143.204.215.33
143.204.98.104
151.101.129.2
151.101.192.65
151.101.65.140
151.101.66.137
151.139.242.10
162.247.242.18
172.67.74.101
18.135.20.243
18.156.0.31
18.66.112.39
18.66.97.53
185.33.221.11
192.28.144.124
199.232.136.157
2600:9000:2057:1400:11:8a36:7200:93a1
2606:4700:10::6814:b844
2606:4700::6810:9540
2620:12a:8001::2
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:811::200a
2a00:1450:4001:812::2003
2a00:1450:4001:829::2002
2a00:1450:4001:829::2004
2a00:1450:4001:82a::2008
2a00:1450:4001:82b::200e
2a00:1450:4001:82f::2003
2a00:1450:400c:c07::9d
2a02:26f0:f7::5c7b:e053
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42::396
3.215.119.159
3.224.194.150
3.248.4.87
35.157.40.192
35.244.159.8
52.222.236.17
54.216.103.176
69.173.144.139
89.187.169.47
99.86.3.92
012743d9f8e3a8cb9fd4a9466aa2eb026a53d446d530d60440463e555ad0fc87
02d7c60fa62b7709af4f8e0d74c509f4dad23562007f457654f7ab6299013362
03f94ea8844e57c376e7fa137ca45fedfd4282be27aaa3d3ce25afe79dd7e375
04016017106740a0c449a2dc33655f441bbc2b48e1bfd633be8cec5ee15b8984
04686da390f8eec3ccd75869fa71e22cad452cfcff6ffa31c979f599d64831d8
04e86fcf247e2d9809596331db17a2a0d3efe9c9bf1d8d9babd04645286ee68c
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
05c1b18ed199fea9af5168c7769dff2cd69f02706fa2568ab2e305be8dfb9c52
088e1ef91a320f014eecd7495cedfa7fee5e167cadaf55545ce137f4ff749ba8
0a64ee2e2a7ae726b4dab3b2c1c3a0f25aa600aff793409f03817948d883f5e4
0d4c6544e66a3453f790183e5468b7f2b09304b0779543143fc68284fe536849
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1189e3c5878312d863ea2225d00a89f8a35153e4542270bac42baabb8c937a64
12f63d55e2bfac64d9d4ca717460906bb1adec9679bd80dad76b2aa844118522
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
160371118ad2e4d470bc6801bb253ec18332e7b6fb7225bb6d365a99bdb99d22
16c13044cedc5c7482ad7db51913c164ffabc787ec5b6b0246acfec84cd6d01b
181fa10be49f875d78816391e202c05f90be6b0d5597edc25f524b1183e434e6
19b955ead2f498683ffc96ab3435a0008664c88fb54fb0c9a11c2375eab983df
1c483a1caf094b8e3a922a5773e342df31d68ef351f6b35af4bbac9dd0aefcdd
1cbf80f7d71564dc48af2c5d6bb5d15fc2aec0d541101c5eedf84bad1b908cab
1cf451d2d8d425375505bd10c5540e8e5cce3cbbd5932be038285d8b6a650e63
1ee6321fadd1f1471732c38d5965e5bc125d5da86d1a769f506d4bbc752d1331
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c
23bc191756969f062a5620a800396e7496e5b2a5fe00d486e2c041adc5d45927
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2689a0237a95cfd8135f8da3ac79c430e903f3c542f8b862f68141c84c348c43
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
3109fef8b2a9ab71fca698483d2bae36d8fed772517c259dacce872e739bb690
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3229ca2228578c18cb365b9d7d9d5bb84d9070ac42ddfc14570943546c3afaf3
3302b8fa7dc8d62e1758af8ae584b8fc91d489e44d3e32485d41c0fc93f439f6
357ab13888827f74dcdaacae0e9f438025b194bd916f08ea9f8740a71253bd88
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3834f0a520d623453cdb6b03b88331bc0394367eb18809f1037ea18c699ebded
392f196c197758bafbfb4a917625b5a20a84cd7977433a134140f9c6f745058f
3b6f404deff7d8bb1bd68dfb931256495073e25291975edfa559ffe6f5618108
4038a666dfd5af607a0374ad6e934cf1007e78da69329dbc341eaf757bb38beb
41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c
41fce12706bd67f9c0d5d7a6e1394bd88684efee9a10cd3403b527181374e1b3
49c6f7925a020059af53cab3baa5d2ea485e6807744ba07f1b2e90ee47266a44
49f1fe168324ed0f76fbbab536b991c992296cd48da5ce9dd8bc8ea55e2ef946
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b6b4ee9a261fdc0b35ed7b55e8f9b9226456b5429f499156bab1ae3e877f728
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e795936b182c89a5cf3b7e59c0b19e64d00cee4d099053580215837a9cfd009
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
4f7b89695827926507fa8e0b19001e189f3bf7759e9c2b1e24eb06bdbcf98c62
516cbc569d4e8f15ac7917f186a911d85fd0aaca2d0ca074a6583e95486af856
5466092ef0deb16007dc2e8e61eb345b380ab6663bd3ef41808ffb7360abd61a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5a164c7c15f8197903a11533e5fe6894fc3e75abf931897d86d039d0661e4bfc
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5a4934fe889bc2f975cd69f0c35adc72107079ef0d36a139fa141b5219e0e6b0
5b86af60d9f8678ab66ac440e146e40656a7baa94b846811ed99b7cf8fb80f44
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5dbbdc87055e3735446865635b4678301f3e2a1a8796c5c8f9e6708aee679592
60f4893aeccee80d922be14d7aebb526a19c775ebe54df72282870891ef59b3a
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
6435ed7ffc6e90262f5b72fbeeb5f2eba5322d735c016d6fb60243d169434a2c
64a23f8f8c73218f7f6dea6783caa6a186d8f98bd96c50dc9d7eb2d099a644b8
64d117a5cdaf7b8aa3bc5ff1abeec0e1d98b834782d49f34260c4e1ecc7ec4c2
6522666d0b38e568303ffecca0b5324536aa6abb39a0c7641663d125b61a7dca
65b7a96db299dbbd6fd4a553960c668fd4e29a15e807940681921101b44bcccf
668555d4b5bc0bf0bfcd1b86f5666737729f19ed09eff468ceeb549d6c501e3b
696991cbecd2aad100d6531183525c326add046c882d4954e3d8fe5a6a0babab
6cf4ddc728ae2116b65b72832d21cdf33961c094ce95ea8a5b676b7d71212f82
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
72562f00bd821b6edc0368065bf009468955ba01f8ead742d8bbc2470c4358c4
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
77fc7e2cee3f1b71326ab2d9e121017b176205d0c8bbb013dfe7ebfccb2c5cab
7885decee353da0127b3651560230d127d45b10fcc38e757a9acc453198c4017
7a5d0f939c5224a8efb5b96759dd0509360b5d071774bb702f788f37a00a8426
7adcb70e6024511e632f7c3ea8f8fbd639b9ad4d6a7404140682002f5d6567c3
811dff95dee018cf649eb427d5eb74bf9687bbdf09123f501334c13eb983f193
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
853205496e0c3ef4e3d9bf39b4131f254bc0c7bcb792018ce64399aa7296530e
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8aec3b020f5db302d0b10d2451c4a6d4f7916f4c4c976fc70d214d99652db517
9047a3143fafa376962d7ba8768c3ebdeeb4d40ce467adb9120a39ad865c7119
91297de4b37cc5b3ef84aa37b43667637e121cdcf7c421b6253093fe8ed25a03
95f35e1959ce4156ff0c8342109ccbf64e6bbe029221053fed01d0e54e66be92
99ac0e388250281fe8851ef71799b3222bab0db5612c2c17deba3962626e0ec1
9cd7629d2e66537eb15542646bfd16cd461aaf18592c35f19ce7d67ada586635
9d8f8c89a5f7c90adc5196d1c10fe3e8c46d16cb8d24de13ade83de53183027d
9e0e5afa64a4e4bea31acef5b5a5a6022c3530edf576c8789c89327b1502338a
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a5ad436c025c2a03ccc5672aed9469ac98d22b73df5b1d20ed2adb46c0c4daf9
a899a0398bbfbb8343c67e83098446254c1609aae412962cff6929087135a51c
a8d4f6b8f6a42784c365f6a0fa15cd246b349625afcc66d7d339b0afb2821735
ab68a1d182c709631556c042e544af8ec88ee85cdf2b61b2acc5a21651b256f0
ac3774c809f279d74ee1c089012274410b5715f3d0729a47100c0776a7952943
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60
adedd0befd73ee02e5480f500d1c8518bc6ab5ec39f4f06024102f53e8c0a683
b06a32f937f86decd9c7dfa491fa6c81439f25f8eb81bc4e4554b528a7628458
b104f3eafc945a3963971d3d55fa0f9d57133e442f28c6c1dc407c9ec071af40
b4f80028ddc6dc380c89927fb2d2d3dd9c580a24f99db9b93e32ce0b607d5c88
b66e62306d1b6f738c7095c9577957ff21f80d62ed611768eee45d1cf833512c
b93b9165269362989e2855d0bf0ae232d7193a45c43627b2d03b26d7eb98263b
b9ddcbc73a2a42b603661b51028d38aba3374f67385f3307e1cfcebdee2f4838
ba0429c39149c85d1a9b6d03e40a59de57367d1fd22bbab68bee7e0b17c05f2d
bbbf54133750e80c88ffa99b7dfcf4ff670e878d0f1959f55ecd1f678dff6e37
bd2da6f7f9edd096289d54aeb4231d7eeb0c95a84fba5985b5745195fcd6acd6
bd713db29fb234eb7584927050df71683e11b7b72bda4fcf72a88f8a7ff2f56d
be6fd9a631e5209751754ab9483e96c211ad649ca8957d8230ffa4b37b99cf60
bfbfa1f0038354da826498b8f9101a61fba78329305f5861a566667ad4fbc9ff
c254279147099e0b696b281d62b436b8aed42fb0f3abf1ba17abc398ca6c90e2
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c4317447371075eb3ca50437e1900816b3f13ce19d265f1d895ccb7171453a35
c5da2e1eefbe4efd64ec18b775495cf3011d9ae03842917bfe1b0a50e03a7a44
c66c8be72f0f2c0a85d3693ebd2e5a480c5b1d4e705c065cd7117dddfe3f6957
cc9ca4084b17e68f51fc3dff6c030e842306d1b62bdf2064ef9ec044c9376886
ce261eb163fcaee6953cedc35059732a133766ab824dc512bbdf9424d48601e4
ce53cf4a2f572652f9a276c557363c035364d0630a4a4d88a39547dcd410a146
d068b3d14b7ae9b85523042a3de08ac3510eddfd234305174b635fb218bbb1cc
d0d937b32b0a1fa6bbdcc5389f695a36147c1b3ba869ecc507b765adf0300393
d11abf7d6f4725555bfd3493838bae4afe645ac11b8a4a62ef92daf760b03b56
d36d8a76a8b7d7fe8655db34eb54e4a4b6d422cdd1a67810d3dd5c014edb14e4
d407f76c95cd40603bcfb779b9078aa78a88c65056c13adfd2c7eb5e1a188890
d46000a68446c0f0d39593395be6e2ceaea9184cce92cf0ff80cdb5312d45458
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
da55c932f701632b195de449eeb5aca58252a8f8a0fe949231556ee4d6dc9696
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc380695af9f92a38f1570106049fb6d12f0a0aa3a2fe0ac1fb04801eeabfa0d
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dcfc540946183ee12e6ccb43e706ad1a30b4f0205c25adcfa316829075f94a31
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd7ec90bdddc830689a2a4e0b9d3864cd99aa688309ce12c36c625bb5c154398
dddf04d190be2e7006f807221d5f5852bf45a97c2aad4c66b1f0a1661efa7dda
de02e745c51299417a1126c3707d033de02baef0f9be8fed07185c1a6b74eac1
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dfed159907574337d5a3198b898e17e6f0d6c5c325d8ee2fd2343b7cddb34994
e04cd604df1afd7f5e3eedcc1ee997955f575f74443b575d6355f4142aae092d
e05047926caff00bd8838e1bd26284ac1b5b9bbc3a754361e60f79d41ee77d71
e21d2669ef9c2b4358906325d4da70cc33ae5380c1fb7fdfdb9d24d9fbbceeec
e3369f08e111fdfc9099c11d13ba381f6cae96f9a61d963a192534b0a2ff3e65
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e41e2b5c9df3073d6f7da0080ad2f3eca4994ab372d2f65fa76b14f8868663ec
e7e2024764e94bff400b354a7cb714ab75f1b9fd4b3fb09de18dca2d6c2e56a5
e868d39bbb74d42dffcee0cb1a50ecd105e1a1737d9080246dbdd54a8206d8f0
e8cde893252a0ab0ce56429b052ed6ae7df55848794b32d459076e12706330fc
e8fd6832e13fca9622a46af5fddb394c358ef083d84002896aca34613d77780e
e99a52151c294c42df9ab0df1048d2403af8d1cf94817c26c706c8d75d002743
eae2c34014a512a5bebe4a87261c00c87807d4d185dfe1bc0cc09eae0592e6ae
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
ebbfcf00d982ffc70935655966e42b6b5083371d59ad9a3be6acad251b612a6d
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef593584d9432b51ed1cec6f58f844bfa6f81ef0fe27fd9404e400e1346fa09b
ef6de6beb1cf5bf809eccfe10f99aea0e0969c71d4eab5446410fef72695679f
ef990e608982588e9c0e86de964fefb24d33a5229965c5d9a0f2c6cd9d86c3fc
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660
f0dbd5ad7b0ead52f6375610e738f5727261715f392d0892047e160f50138f5d
f196a7c963a7423a617c88b9aa25ed9bb1b500fb9b9cc788f1070127b6a8e68a
f2701b5a824dd7e7fe3ef2cc67fcdc93b9ae49f41e70f82e16de52057fd5f15e
f2fcd7287f4c5a41131831882a8227fd5d21311715f1812dd2b4cf7398ec0569
f3927c309fec9aca7f0dab152c4fbd8e5aa69a1f744a2eda686f01f45d2d3b37
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f69a13217482dc43f25e74cfcb9391d0f06d22501f10f5cb5e413d2d98a5cd23
f6e8266cf94edf161680868e39d5dd0be966424c35ee493d0a57f8288f2d6ba7
f784bdae89887d6c9a1d2452ca83d2444ff4d4a12a1a2484ab2ff6b370912408
f7b78ab3994d3f6de37b359cc3d243d44caca23578c342b6f3966dda1cb9fd70
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f84f1b5eb8075f18171863ae29f94ee5f4d31d666c8366974b6fbf33e3661c96
f9a3bb5c387dd36fde93f604f7532035c603942c96e008bb1808dd37ec3639e4
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f
fddda23f711f28038cc34b216d5278692a4a93631433d3b90540981d1422e1b9
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

www.sentinelone.com Open in urlscan Pro 172.67.74.101 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

216 Requests

84 %HTTPS

34 %IPv6

47 Domains

64 Subdomains

56 IPs

7 Countries

10210 kBTransfer

14958 kBSize

49 Cookies

23 Outgoing links

Redirected requests

216 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 19 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.sentinelone.com Open in urlscan Pro
172.67.74.101 Public Scan

Screenshot
Live screenshot

Full Image

216
Requests

84 %
HTTPS

34 %
IPv6

47
Domains

64
Subdomains

56
IPs

7
Countries

10210 kB
Transfer

14958 kB
Size

49
Cookies

216 HTTP transactions
19 data transactions