sansec.io Open in urlscan Pro
2606:4700:3032::681b:9cd5 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sansec.io/research/largest-magento-hack-to-date).
Submission: On October 01 via api (October 1st 2020, 6:50:50 pm UTC) from US

Summary HTTP 18 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3032::681b:9cd5, located in United States and belongs to CLOUDFLARENET, US. The main domain is sansec.io.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 5th 2020. Valid for: a year.

This is the only time sansec.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3032::681b:9cd5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	143.204.94.96 143.204.94.96	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
1 2	23.111.9.38 23.111.9.38	33438 (HIGHWINDS2) (HIGHWINDS2)
2	2a00:1450:400... 2a00:1450:4001:820::200e	15169 (GOOGLE) (GOOGLE)
18	6

9 2606:4700:3032::681b:9cd5 (United States)

ASN13335 (CLOUDFLARENET, US)

sansec.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 143.204.94.96 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-96.fra50.r.cloudfront.net

js.chargebee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.38 (Phoenix, United States) 1 redirects

ASN33438 (HIGHWINDS2, US)

cdn.mouseflow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	sansec.io sansec.io	206 KB
5	chargebee.com js.chargebee.com	66 KB
2	google-analytics.com www.google-analytics.com	18 KB
2	mouseflow.com 1 redirects cdn.mouseflow.com	56 KB
1	googletagmanager.com www.googletagmanager.com	29 KB
18	5

	Domain	Requested by
9	sansec.io	sansec.io
5	js.chargebee.com	sansec.io js.chargebee.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	cdn.mouseflow.com	1 redirects sansec.io
1	www.googletagmanager.com	sansec.io
18	5

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-05` - `2021-08-05`	a year	crt.sh
js.chargebee.com Amazon	`2020-04-17` - `2021-05-17`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.mouseflow.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-12` - `2022-09-14`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://sansec.io/research/largest-magento-hack-to-date).
Frame ID: F6096CD10EC10D72B2C8F4522E2747F6
Requests: 22 HTTP requests in this frame

Frame: https://js.chargebee.com/v2/master.html
Frame ID: AF9C28FC3247D95AEB8DCB704BFBB8A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

18
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

375 kB
Transfer

874 kB
Size

4
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/sansecio

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/sansec/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934.js HTTP 301
https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934_eu.js

18 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 404 Primary Request largest-magento-hack-to-date). Show response
sansec.io/research/ 10 KB
4 KB 82ms
58ms Document
text/html 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sansec.io/research/largest-magento-hack-to-date).
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 472a05f1caaf122a905084269f868e890fc5d7c2e023bef7c46208a8a2ca2eeb

Request headers

:method: GET
:authority: sansec.io
:scheme: https
:path: /research/largest-magento-hack-to-date).
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 404
date: Thu, 01 Oct 2020 18:50:32 GMT
content-type: text/html
set-cookie: __cfduid=d056f43e40c26c16db2c61567ecb17bdf1601578232; expires=Sat, 31-Oct-20 18:50:32 GMT; path=/; domain=.sansec.io; HttpOnly; SameSite=Lax; Secure
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
cf-cache-status: DYNAMIC
cf-request-id: 05871982ce00002b7d9da36200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 5db85eb14b172b7d-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 main.css
sansec.io/assets/css/ 165 KB
32 KB 24ms
23ms Stylesheet
text/css 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/css/main.css?e3b2cd8

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6db5b8cf5a90272d0784c5a582f74697da99cdcfb92deb8a096caf0033b7faed

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 289961
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 058719830e00002b7d9da41200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: W/"5f6db764-8b34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: text/css
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
cf-ray: 5db85eb1bc472b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 email-decode.min.js Show response
sansec.io/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
872 B 8ms
8ms Script
application/javascript 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
content-encoding: gzip
vary: Accept-Encoding
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 058719830e00002b7d9da42200000001
last-modified: Fri, 25 Sep 2020 20:04:17 GMT
server: cloudflare
etag: W/"5f6e4d41-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5db85eb1bc4b2b7d-FRA
expires: Sat, 03 Oct 2020 18:50:32 GMT

GET
H2 200 main.js Show response
sansec.io/assets/js/ 34 KB
10 KB 14ms
13ms Script
application/javascript 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/js/main.js?e3b2cd8

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b108ba79c2468c92a4cc0032efd0f0b31b581c9f23239bef47af68c496712aa4

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 289961
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 058719832800002b7d9da45200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: W/"5f6db764-2825"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
cf-ray: 5db85eb1dce32b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 chargebee.js Show response
js.chargebee.com/v2/ 141 KB
43 KB 81ms
32ms Script
application/x-javascript 143.204.94.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.chargebee.com/v2/chargebee.js

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.96 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-96.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

430c57868971ae17811d95e75946dbd525ca2ed3c9ea6021f355e09b917665a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains; preload

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:46:00 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 273
x-cache: Hit from cloudfront
status: 200
last-modified: Wed, 30 Sep 2020 07:13:21 GMT
server: AmazonS3
etag: W/"e8da905835f3c2aa01e3a88a3eedd0ba"
strict-transport-security: max-age=300; includeSubdomains; preload
x-amz-version-id: 5FmiPA6pKL56UrGffjctz6KoqmVMrBu1
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
cache-control: max-age=300,public
x-amz-cf-pop: FRA50-C1
content-type: application/x-javascript
x-amz-cf-id: 33e6l90hSElpFyAi2TTfxOU2rzZkaTuB_GEltZf9qHVeQS-Hzc9znQ==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 74 KB
29 KB 34ms
34ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W4VK6TQ

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

188f39fa260575b32cee049b540ab0054ce09be02f51d0cfbc785e85ff25176b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29443
x-xss-protection: 0
last-modified: Thu, 01 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 01 Oct 2020 18:50:32 GMT

GET
H2

200

b8b33745-29ba-4a8d-8a21-4019ba29e934_eu.js Show response
cdn.mouseflow.com/projects/
Redirect Chain

https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934.js
https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934_eu.js

167 KB
55 KB

42ms
41ms

Script
application/javascript

23.111.9.38
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934_eu.js
Requested by: Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.38 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: c0d684eb6eb211b9e3ab52f3058bc20a234c55563a304495c815ebe7983aca3e

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
content-encoding: gzip
last-modified: Wed, 23 Sep 2020 06:00:23 GMT
server: NetDNA-cache/2.2
etag: W/"26f850d36e91d61:0"
status: 200
x-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=86400

Redirect headers

status: 301
date: Thu, 01 Oct 2020 18:50:32 GMT
server: NetDNA-cache/2.2
access-control-allow-origin: *
content-length: 178
location: https://cdn.mouseflow.com/projects/b8b33745-29ba-4a8d-8a21-4019ba29e934_eu.js
content-type: text/html

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cb184b98ef46f9a0917d5b0832a2f71468679c8befc102807fc04591ef28e9f9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 037fbdcacb9b81beee4b30af2e017373160bc86445e574adffb98a47f281fb11

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 903 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 64e248821f2dab00162064b4b7b4a932d56fe0f6e1b5bf0680d96f0fb97a0650

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 832 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6bb2d30928397291c267a57605309d304d6333eb6963935db500e46be34761f5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 439 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a22b7d76a9f370f4fa5cde5f3023a63d68e75b5a14b76f6f348c19bfdc3cfac

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 visby-cf-bold.woff2
sansec.io/assets/fonts/ 19 KB
19 KB 37ms
36ms Font
font/woff2 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/fonts/visby-cf-bold.woff2

Requested by

Host: sansec.io
URL: https://sansec.io/assets/css/main.css?e3b2cd8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a8261230c3d5031cf450b3bdf4c50af1ff5552bd14b0ba56c023254a62cb5872

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Origin: https://sansec.io
Referer: https://sansec.io/assets/css/main.css?e3b2cd8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 84
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19816
cf-request-id: 058719833d00002b7d9da48200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: "5f6db764-4d68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5db85eb1fd312b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 visby-cf-extra-bold.woff2
sansec.io/assets/fonts/ 19 KB
19 KB 23ms
22ms Font
font/woff2 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/fonts/visby-cf-extra-bold.woff2

Requested by

Host: sansec.io
URL: https://sansec.io/assets/css/main.css?e3b2cd8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c7ffbdfe3ead838c2c9570120bc7ca9c05ae9d525cef15bc61cf130f6fabd51

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Origin: https://sansec.io
Referer: https://sansec.io/assets/css/main.css?e3b2cd8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 84
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19780
cf-request-id: 058719833d00002b7d9da49200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: "5f6db764-4d44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5db85eb1fd342b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 roboto-regular.woff2
sansec.io/assets/fonts/ 15 KB
15 KB 14ms
13ms Font
font/woff2 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/fonts/roboto-regular.woff2

Requested by

Host: sansec.io
URL: https://sansec.io/assets/css/main.css?e3b2cd8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Origin: https://sansec.io
Referer: https://sansec.io/assets/css/main.css?e3b2cd8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 84
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 15736
cf-request-id: 058719833d00002b7d9da4a200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: "5f6db764-3d78"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5db85eb1fd362b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 visby-cf-demi-bold.woff2
sansec.io/assets/fonts/ 19 KB
19 KB 14ms
14ms Font
font/woff2 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://sansec.io/assets/fonts/visby-cf-demi-bold.woff2

Requested by

Host: sansec.io
URL: https://sansec.io/assets/css/main.css?e3b2cd8

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f79da08498e17778025277d002d90a8c6d5b527a1a86fafd73fc712be7ce9ce7

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Origin: https://sansec.io
Referer: https://sansec.io/assets/css/main.css?e3b2cd8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:32 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 84
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19840
cf-request-id: 058719833d00002b7d9da4b200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: "5f6db764-4d80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5db85eb1fd392b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 1-fb322714eefc5849584b.js Show response
js.chargebee.com/v2/ 55 KB
17 KB 28ms
27ms Script
application/x-javascript 143.204.94.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.chargebee.com/v2/1-fb322714eefc5849584b.js

Requested by

Host: js.chargebee.com
URL: https://js.chargebee.com/v2/chargebee.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.96 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-96.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

bebfc1a309d528084327388648ab6cc439bbab06b0a695b7bfe5bd8ace3a73bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains; preload

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 6mrKd5H9XSt3JeJCgGlryz1CO66JyRAe
content-encoding: gzip
etag: "59c4d94d74de01180baa7b21e223d735"
age: 206
x-cache: Hit from cloudfront
status: 200
strict-transport-security: max-age=300; includeSubdomains; preload
last-modified: Wed, 30 Sep 2020 07:13:22 GMT
server: AmazonS3
date: Thu, 01 Oct 2020 18:47:07 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
cache-control: max-age=300,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: n0Cef_dhtJk0e4yONPShdNvM8Rs5CwE4I3Wc6mK35wIXlIAGBo4peA==

GET
H2 200 13-4ff60732512b48a4902f.js Show response
js.chargebee.com/v2/ 15 KB
5 KB 28ms
27ms Script
application/x-javascript 143.204.94.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.chargebee.com/v2/13-4ff60732512b48a4902f.js

Requested by

Host: js.chargebee.com
URL: https://js.chargebee.com/v2/chargebee.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.96 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-96.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

5124d656d5850422e026546af094d8f3123dc897a6fc20758b31adf1b7a4fe24

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains; preload

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: KWHoHVkzxt9Kz.jYvcVXsq_2y4AeQHNo
content-encoding: gzip
etag: "b3e11a5f0ab09288305b1ea34a67a41f"
age: 265
x-cache: Hit from cloudfront
status: 200
strict-transport-security: max-age=300; includeSubdomains; preload
last-modified: Wed, 30 Sep 2020 07:13:21 GMT
server: AmazonS3
date: Thu, 01 Oct 2020 18:46:07 GMT
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
cache-control: max-age=300,public
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: wthOg2ZPvwG5MdnuF5CN-pbOQAE1kFJAjeaUxS_KUTD120IZQVB9tw==

GET
H2 200 animation.css
js.chargebee.com/v2/ 758 B
1 KB 25ms
25ms Stylesheet
text/css 143.204.94.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.chargebee.com/v2/animation.css

Requested by

Host: js.chargebee.com
URL: https://js.chargebee.com/v2/chargebee.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.96 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-96.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

e3b7f54cf81a0ff1f16662abce7b1970ed6a8a8191da96cf05dcf6644d203df3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains; preload

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: UIoH.VeE8h3fg6FNMEuTVMx0udqXNqrD
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
etag: "f8a79fc47c28375628855b4c78ff6f85"
age: 253
x-cache: Hit from cloudfront
status: 200
content-length: 758
last-modified: Fri, 18 Sep 2020 09:34:29 GMT
server: AmazonS3
date: Thu, 01 Oct 2020 18:46:20 GMT
strict-transport-security: max-age=300; includeSubdomains; preload
content-type: text/css
cache-control: max-age=300,public
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 4aHX5K3vUbQMC0_km4i874ikPAzzATLUbIb_-UjAqEOoesYQvmvYmg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W4VK6TQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 1012
date: Thu, 01 Oct 2020 18:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 01 Oct 2020 20:33:41 GMT

GET
H2 200 code.jpg
sansec.io/assets/images/ 86 KB
86 KB 36ms
35ms Image
image/jpeg 2606:4700:3032::681b:9cd5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sansec.io/assets/images/code.jpg

Requested by

Host: sansec.io
URL: https://sansec.io/research/largest-magento-hack-to-date).

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::681b:9cd5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e428b7573cf7502cf2977f4b14302f43ea5b42390033590436ce2ccb3a697f1d

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 18:50:33 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 85
content-security-policy-report-only: script-src 'self' 'unsafe-eval' 'unsafe-inline' *.googletagmanager.com *.mouseflow.com *.google-analytics.com *.chargebee.com; frame-src 'self' *.chargebee.com; object-src 'self'; report-uri /scripts/csp-report.php;
status: 200
x-sansec-tlp-red: dHlwZSBkZWFsd2l0aGl0IGF0IGZyb250cGFnZQo=
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 87580
cf-request-id: 05871984b900002b7d9da76200000001
last-modified: Fri, 25 Sep 2020 09:24:52 GMT
server: cloudflare
etag: "5f6db764-1561c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1601578233"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
x-xss-protection: 1; mode=block
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 5db85eb45d502b7d-FRA
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 master.html
js.chargebee.com/v2/ Frame AF9C 0
0 32ms
32ms Document
text/html 143.204.94.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.chargebee.com/v2/master.html

Requested by

Host: js.chargebee.com
URL: https://js.chargebee.com/v2/13-4ff60732512b48a4902f.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.96 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-96.fra50.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains; preload

Request headers

:method: GET
:authority: js.chargebee.com
:scheme: https
:path: /v2/master.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://sansec.io/research/largest-magento-hack-to-date).
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://sansec.io/research/largest-magento-hack-to-date).

Response headers

status: 200
content-type: text/html
content-length: 203
last-modified: Wed, 30 Sep 2020 07:13:21 GMT
x-amz-version-id: SxqOmh8zqPsP9iqvNXTLQW3EyI14AUF0
accept-ranges: bytes
server: AmazonS3
strict-transport-security: max-age=300; includeSubdomains; preload
date: Thu, 01 Oct 2020 18:50:26 GMT
etag: "3607938810f72e4cc2d39a78749db51d"
cache-control: max-age=300,public
x-cache: Hit from cloudfront
via: 1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: _-uF1L-64pvxCfsr70ziFRpPhzKfVvpD8fKhbmynIXrjhrxm11WCCQ==
age: 7

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
59 B 13ms
13ms XHR
text/plain 2a00:1450:4001:820::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=69780063&t=pageview&_s=1&dl=https%3A%2F%2Fsansec.io%2Fresearch%2Flargest-magento-hack-to-date).&ul=en-us&de=UTF-8&dt=Sorry%2C%20page%20not%20found%20%E2%80%93%20Sansec&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1825982655&gjid=841305269&cid=302524237.1601578233&tid=UA-134290941-1&_gid=962276603.1601578233&_r=1&gtm=2wg9g1W4VK6TQ&z=298885817

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://sansec.io/research/largest-magento-hack-to-date).
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Oct 2020 18:50:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://sansec.io
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.sansec.io/	1970-01-19 12:52:58	Name: _gat_UA-134290941-1 Value: 1
.sansec.io/	1970-01-19 12:54:24	Name: _gid Value: GA1.2.962276603.1601578233
.sansec.io/	1970-01-20 06:24:10	Name: _ga Value: GA1.2.302524237.1601578233
.sansec.io/	1970-01-19 13:36:10	Name: __cfduid Value: d056f43e40c26c16db2c61567ecb17bdf1601578232

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.mouseflow.com
js.chargebee.com
sansec.io
www.google-analytics.com
www.googletagmanager.com
143.204.94.96
23.111.9.38
2606:4700:3032::681b:9cd5
2a00:1450:4001:809::2008
2a00:1450:4001:820::200e
037fbdcacb9b81beee4b30af2e017373160bc86445e574adffb98a47f281fb11
188f39fa260575b32cee049b540ab0054ce09be02f51d0cfbc785e85ff25176b
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
430c57868971ae17811d95e75946dbd525ca2ed3c9ea6021f355e09b917665a0
472a05f1caaf122a905084269f868e890fc5d7c2e023bef7c46208a8a2ca2eeb
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
5124d656d5850422e026546af094d8f3123dc897a6fc20758b31adf1b7a4fe24
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
64e248821f2dab00162064b4b7b4a932d56fe0f6e1b5bf0680d96f0fb97a0650
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bb2d30928397291c267a57605309d304d6333eb6963935db500e46be34761f5
6db5b8cf5a90272d0784c5a582f74697da99cdcfb92deb8a096caf0033b7faed
8c7ffbdfe3ead838c2c9570120bc7ca9c05ae9d525cef15bc61cf130f6fabd51
9a22b7d76a9f370f4fa5cde5f3023a63d68e75b5a14b76f6f348c19bfdc3cfac
a8261230c3d5031cf450b3bdf4c50af1ff5552bd14b0ba56c023254a62cb5872
b108ba79c2468c92a4cc0032efd0f0b31b581c9f23239bef47af68c496712aa4
bebfc1a309d528084327388648ab6cc439bbab06b0a695b7bfe5bd8ace3a73bb
c0d684eb6eb211b9e3ab52f3058bc20a234c55563a304495c815ebe7983aca3e
cb184b98ef46f9a0917d5b0832a2f71468679c8befc102807fc04591ef28e9f9
e3b7f54cf81a0ff1f16662abce7b1970ed6a8a8191da96cf05dcf6644d203df3
e428b7573cf7502cf2977f4b14302f43ea5b42390033590436ce2ccb3a697f1d
f79da08498e17778025277d002d90a8c6d5b527a1a86fafd73fc712be7ce9ce7

sansec.io Open in urlscan Pro 2606:4700:3032::681b:9cd5 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

375 kBTransfer

874 kBSize

4 Cookies

2 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

20 JavaScript Global Variables

4 Cookies

Indicators

sansec.io Open in urlscan Pro
2606:4700:3032::681b:9cd5 Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

375 kB
Transfer

874 kB
Size

4
Cookies

18 HTTP transactions
5 data transactions