www.cyberhaven.com Open in urlscan Pro
18.102.16.191  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJGMdYvbdyfPAAAAZQWCAjN4HXjNhAKTdZizzqumfLr5hr4-RFPHQ0prFMvRuojnGHmkg

121 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Show response www.cyberhaven.com/engineering-blog/	85 KB 28 KB	221ms 52ms	Document text/html	18.102.16.191 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 18.102.16.191 Milan, Italy, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-102-16-191.eu-south-1.compute.amazonaws.com Software / Resource Hash d12d0af1033d29ac38396fb9488163966b33c268220ef1a28e91f61e3e29fa30 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 127212 alt-svc h3=":443"; ma=86400 cf-cache-status HIT cf-ray 8f9f9e0ddd594c5b-MXP content-encoding gzip content-type text/html date Mon, 30 Dec 2024 05:26:51 GMT last-modified Sat, 28 Dec 2024 18:04:43 GMT surrogate-control max-age=432000 surrogate-key www.cyberhaven.com 64deefeac57fbbefc32df53d pageId:659f33bed6ad85bae1aa7e8e 659f33bed6ad85bae1aa7fe2 659f33bed6ad85bae1aa7e5e vary Accept-Encoding x-cluster-name eu-south-1-prod-hosting-red x-lambda-id f2977292-2142-4e42-9472-08bb2f02c915
GET H3	200	cyberhaven-2-0.7fc24bcb1.min.css cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/	295 KB 55 KB	103ms 50ms	Stylesheet text/css	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3873b4cb8cce5adf637f085d4577e3b4b0364cd7ae43609b618dbb08fe1027a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT etag "82de427c01c3d2be069f258bb6d853cd" x-amz-version-id hpz1DhbA8Aw1Ayi1NAQ4WRcSqQ.1gd.J age 193732 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:51 GMT content-type text/css last-modified Fri, 27 Dec 2024 23:20:51 GMT vary Accept-Encoding priority u=0,i=?0 x-amz-id-2 YMGMa+pBf247/t69ndziBp/Q+mq4Dtq4K3IhnjNMGhTi1DQBtMrTbR7V0ggSfPomlfloAw5em2o= cache-control public, max-age=31536000, immutable x-amz-request-id 9WQSBWNT9G0XQ7WW cf-ray 8f9f9e0e8862d28c-FRA accept-ranges bytes access-control-allow-origin * content-length 56195 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	fs-cc.js Show response cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/	29 KB 11 KB	95ms 29ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bdeed7650697bd478a6b0591a9ea29664b04a6681a4f9f7c4c2d3d10cdae42a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"73ae-nwFPCwd3UXiTZ7YuAXjbCNGDpOw" age 15177 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:51 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230135-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 10845 x-jsd-version 1.15.0
GET H2	200	js.cookie.min.js Show response cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/	2 KB 1 KB	94ms 28ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/js.cookie.min.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"6c3-1s0eec7oePdhcVrYEdKeoGY3QW4" age 4744000 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:51 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230030-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 860 x-jsd-version 3.0.5
GET H2	200	readtime.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/	4 KB 2 KB	33ms 32ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/readtime.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 164406864a5606d7181ae4c6f6b48c19478bbc7377178b51c0f53c68a28fe58d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"f7c-CEGEZn4mJhUtZe0HPZGxMFBlZeE" age 4941 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230158-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 1918 x-jsd-version 1.2.3
GET H2	200	richtext.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/	8 KB 4 KB	34ms 33ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2147-I41v+oq443LPQB6aPqMil27q9QY" age 13995 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230147-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3918 x-jsd-version 1.10.2
GET H2	200	socialshare.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/	9 KB 4 KB	36ms 35ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/socialshare.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash eafd7e17be354753ca120ef03d28aa45a37c423e89e9f2602e8fd5a24400f150 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2385-rwl9CAsmlk954AGumYBzecK5wJE" age 1550 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220106-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3619 x-jsd-version 1.3.1
GET H2	200	codehighlight.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/	4 KB 2 KB	35ms 35ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1254f8919b622330bce321d396d373e92655485778b03d3d1a04d493d44431ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1182-meaOv3e3adqfyT4jIRjTa76pxz4" age 36583 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230089-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 2031 x-jsd-version 1.5.2
GET H2	200	toc.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/	22 KB 9 KB	29ms 28ms	Script application/javascript	2a04:4e42:400::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8f3080c9459e76305ed52789a727b30786b4d8e27da652424db04a22f42ad83d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"57aa-2Zkk0AqSUYYUIrrzTHESzGgsbdg" age 39414 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220054-FRA, cache-mxp6947-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 8646 x-jsd-version 1.2.4
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 32 KB	153ms 53ms	Script application/javascript	52.222.232.99 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64deefeac57fbbefc32df53d Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.232.99 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-232-99.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" age 12207 access-control-allow-methods GET x-cache Hit from cloudfront x-amz-cf-id Nfow9ZFTlld60TAz2j9O7QWicSUTna_qt00ylQsZcUomNtEhN44M7w== date Mon, 30 Dec 2024 02:03:26 GMT content-type application/javascript last-modified Mon, 20 Jul 2020 17:53:02 GMT vary accept-encoding cache-control max-age=84600, must-revalidate via 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P4 server AmazonS3
GET H3	200	cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Show response cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/	708 KB 173 KB	145ms 128ms	Script text/javascript	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9c433a9098a5976b8d58b4371e89daafba4e0e9a05f5c880fe821355ba88684 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br cf-cache-status HIT etag W/"9792b65f944e5a2e92eae714f7201221" x-amz-version-id _GYyTxRjAFzEvmpHerpKKUquAFj9B32p age 79879 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:51 GMT content-type text/javascript last-modified Fri, 13 Dec 2024 17:48:45 GMT vary Accept-Encoding priority u=1,i=?0 x-amz-id-2 D2bsWaHyprSXvd87ue+PCwKZfSPnhiTzdxn/fJRHpvBk4DuC/lSOIvxw1bB0R4bnXgY2+4840u4CG7QbHlql0JpGqdVm0wnB cache-control public, max-age=31536000, immutable x-amz-request-id 289MC3GK1EGQP97Z cf-ray 8f9f9e0e8860d28c-FRA access-control-allow-origin * server cloudflare x-amz-server-side-encryption AES256
GET H2	200	form-124.js Show response hubspotonwebflow.com/assets/js/	10 KB 3 KB	147ms 54ms	Script application/javascript	76.76.21.123 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/form-124.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"392ca1f460caa2aa9439969a89f31c13" age 3946471 x-matched-path /assets/js/form-124.js access-control-allow-origin * date Mon, 30 Dec 2024 05:26:52 GMT content-disposition inline; filename="form-124.js" content-type application/javascript; charset=utf-8 server Vercel last-modified Wed, 13 Nov 2024 15:18:09 GMT x-vercel-id fra1::k9czn-1735536411998-dfe68f85f0e7
GET H2	200	gtm.js Show response www.googletagmanager.com/	412 KB 128 KB	165ms 78ms	Script application/javascript	2a00:1450:4001:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fcdfbc737cdbd1ee920921b28ffb7b116adbc8d9ddfb4b2c38356989eb57bffe Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Mon, 30 Dec 2024 05:26:52 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Mon, 30 Dec 2024 03:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 129869 x-xss-protection 0 server Google Tag Manager
GET H3	200	676f447859d64b55526ac4ea_blog-hero-analysis.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	48 KB 49 KB	74ms 74ms	Image image/jpeg	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f447859d64b55526ac4ea_blog-hero-analysis.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02aaf64a14db538fd05ce260e97c3f59f34a811893d73928062a45e84de742e1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "1a76135b309733c2491985966d6d0560" x-amz-version-id NJizZKGhA87OUnTBSjxtYx7nz4yGTCP8 cf-cache-status HIT age 183014 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type image/jpeg last-modified Sat, 28 Dec 2024 00:21:14 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 Qy3zrnZgmFsE/4dsuHi7OyUUHumWdIC39Esjw//AtgIAtK9oKqYj3qjTQshKhoYU8pG3K79yI+z+X9RwgX6NnA== cache-control max-age=31536000, must-revalidate x-amz-request-id 48X8RF9W2YEP8VSP cf-ray 8f9f9e0f6972d28c-FRA accept-ranges bytes access-control-allow-origin * content-length 49457 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	84ms 83ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d04419609e6fa08a420ce68756b9bb81fc4ccde283575fb42ffc443e2caf3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "7017fb33ca20ea6252530f4175b595c6" x-amz-version-id nbgTfi_RoVFp7TQUfwt0fBsEIuZbE9lh age 1636230 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 gJhMn2Szeezt8PuGVLNAfz+oPTCXmHeCnPf6C14Hf6+WczXoQSvUeJv+ZErtYdEEW9GBl8NY4stVwvC3++0nIxMdwKCQXH9S1Eyr89nCsbk= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTCZ1ZWMJY9PQTZ cf-ray 8f9f9e0f8ef89bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 30936 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	85ms 84ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3edff1ede4f95fec11b4ad510397682faac14c622267b92fe314f6860f6eba12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "c74d82a73f65864871167b931348f7dd" x-amz-version-id 0K0YF9sKMHh27RzbO2HdYO7f4xfHi1Ni age 1636230 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 MCQEkNI9Skqtr9UHAlvblDXtXn39LUjYsuoQFWJpCnk8xjEAlGHCYc29sY+wKAKPHtqGdhoW3iD6nmRIMvp0B9f394igWsOQgIZcvgApZ8U= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTC6W8VNHM33H8W cf-ray 8f9f9e0f8ef99bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 30952 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf53f_TWKLausanne-300.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	29 KB 30 KB	96ms 96ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf53f_TWKLausanne-300.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43e196dea1bb50052e39bb72d5146ca65dcbeddbb56ca9f939d85c39e152f219 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "b6399e7dcfa3936c0f20e75e8ea070c7" x-amz-version-id ZBYM2pzvY3d3.LCU5xbdDaV6IOyUyQV. age 1641100 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 m6ydf77jwkKftQxQBU+1M7YG7wNfzAtOdtxHC2HwfIJKxLWi12d9A5YS1hbQnKJVPkvqhNiPYyo= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id S0D843DW7FKQQXYN cf-ray 8f9f9e0f8efb9bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 30152 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	97ms 97ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17e921e79da7db5200bf6306e57c9a561ff4dfa1215d250f15384aa0d23a1d23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "698fbe394f26b24fe5bda79219e312ea" x-amz-version-id IB8aQpEKbkqJmVgCCA4g6ZnSKyG9yt.w age 853466 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 20:34:13 GMT x-amz-id-2 lWnJbBoYdD7v8nAlLgeBjKNMLGVzMxjjrSK0yEyJ4/DAyqXU6aLtiMepqs4AErNOc8hviv/0vj7qzy17gG6Az5fLNIwiAVP0CzNv3J3ZVNA= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id Q7X64X2SFZH10WMY cf-ray 8f9f9e0f8efc9bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 31088 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	31 KB 32 KB	57ms 56ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf477dd7f1f2598513f268e5d86db59f2bf78cf5608b6d2b3bbede1ae015749d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "1079ff010de8753eb2eea411463e0a91" x-amz-version-id OlnoJq_KD3p4L6Vhpcl.niE2c5DijABz age 1625828 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 CtRoGf0fu8vjwsk9g5jMaubzrfJ+qErHoNOnNfkVGIeVDyb1Y8ZOyc1MyU0EULHa/VVpuv19F0c= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id H0PJZEQK51F6QYXP cf-ray 8f9f9e0f8efd9bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 31836 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	201ms 201ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f80afcc11946f09caeaad7fdd4febb98bbb145a41e24bfd36bd482bdf70caa3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "a1659b77956f1919811ab7b82c2276d5" x-amz-version-id YuICHYP_D8aK2yDWMfwtWbNeUZaHyz29 age 1641100 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 P1Q3i9+ephkS6tkM7ppEHyk0CazjiDVvbQycOxzKRmlE4/0kfBKH/2djV9BYPTBYdHN/NH8ARZL9YS1fsmJ5/jrlxfmtwPWUEwihAsNp3hM= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVT0KJSYE65TYGV5 cf-ray 8f9f9e0f8eff9bdd-FRA accept-ranges bytes access-control-allow-origin * content-length 30716 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f444c8108263f227e2659_Cyberhaven%20generic%20author.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	6 KB 7 KB	63ms 62ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f444c8108263f227e2659_Cyberhaven%20generic%20author.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68e2330e1344b9b74b1fe80c5762cd25dc38d48e4729a68e9efb08dbd871342c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "cc8175b9379835524077dbb651fc197f" x-amz-version-id Z7kNl.q4o2SWLNrLL6g88z625u7bIGzM age 183014 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:20:31 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ov4NQLfBHdAZF9TOgIKrXpnUY88Qs/dcrW9K7wQJQYQeYryhqSI9o+UwAWGTyn0dGTg5wChhLdoBEL/emH+7X5FadsBkGW3ZP6geHfvCP/k= cache-control max-age=31536000, must-revalidate x-amz-request-id 48XB49GWVZR1NZJE cf-ray 8f9f9e0f798cd28c-FRA accept-ranges bytes access-control-allow-origin * content-length 6596 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	68 KB 69 KB	63ms 62ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efd70a126766db0daeb2d0a39246bb00e2f5af423f2deceb8fb87febfe14970e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "811b488ff94f4f0b1f857afb7930bec9" x-amz-version-id C86hd2YZSjKZzA88LiOcRnpQygUaeudY age 10974 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 DDrxYC2qlrdEhexHdG6s7Z+R/3REuezcM6Md535traQY3vxFInROKTawEqk1ypTe1+C3Z9ETAcc= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZJ5HCF7J11Y25H cf-ray 8f9f9e0f8991d28c-FRA accept-ranges bytes access-control-allow-origin * content-length 70038 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	166 KB 167 KB	64ms 63ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38949f97e6770288dcf96195e601480f85bf502a50da7a2a6907a932092ffd34 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "ecb0956c5cf844c67d6066e1516c449a" x-amz-version-id bmspAXoyD0XKi6M8Mov7dn7NUWsFM10o age 10974 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ++QLBG/z6yn7VVAGKSHRgii8RQaPnUrHVmohLIgZuNErOwcTD/Zwig23TIP+/8v6o+IeKFK+/27AncA+Fb8tVz5CRnK5lF/eKt5njCxA/VU= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZVTG2KN5E2DFA2 cf-ray 8f9f9e0f8992d28c-FRA accept-ranges bytes access-control-allow-origin * content-length 170083 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	highlight.min.js Show response cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/	113 KB 41 KB	29ms 29ms	Script application/javascript	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1828162a4978444dfe33f4cd1f977f17cd13cf7d0f413f8eb9bab9437239736d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1c30f-0mStFr3znP7CsGwgIjuH/LN60ns" age 961620 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230041-FRA, cache-mxp6921-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 41100 x-jsd-version 11.4.0
GET H3	200	github-dark.min.css cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/	1 KB 999 B	30ms 30ms	Stylesheet text/css	151.101.65.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/github-dark.min.css Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9f208d022102b1d0c7aebfecd8e42ca7997d5de636649d2b31ea63093d809019 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"523-oe0DT1osdtatoK9R3LMOLlr5NqA" age 1632787 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Mon, 30 Dec 2024 05:26:52 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-eddf8230039-FRA, cache-mxp6921-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 619 x-jsd-version 11.4.0
GET H2	200	bda12b36-0455-47af-b8ba-9529bbb134fb.js Show response j.6sc.co/j/	4 KB 2 KB	473ms 350ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 73c5c9fb7e8e51a3af35769a05cac8b20493d7158c284c504f93eab13d0d53aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip x-amz-version-id N26XcBiiU4KO8qPH4s3OdRIA551zYsKR etag "2a619c6409aef52add1c19ae5d16a447" expires Mon, 30 Dec 2024 05:56:52 GMT x-amz-cf-id xUACpNAxW2SaWHglFJoDJE8CD8zjrsVaduc7KkwOjrBFLYYOQjaAYw== date Mon, 30 Dec 2024 05:26:52 GMT last-modified Thu, 21 Sep 2023 21:57:20 GMT vary Accept-Encoding content-type application/javascript x-amz-meta-content-type application/json cache-control private, max-age=1800 accept-ranges bytes content-length 1444 x-amz-cf-pop DUS51-P4 server AmazonS3 x-amz-server-side-encryption AES256
POST H3	200	collect www.google.com/ccm/	0 0	123ms 47ms	Ping text/plain	142.250.185.132 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&scrsrc=www.googletagmanager.com&frm=0&rnd=815196132.1735536412&auid=809540959.1735536412&navt=n&npa=1&gtm=45He4cc1v832240631za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735536412339&tfd=715&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.132 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	422 KB 134 KB	64ms 64ms	Script application/javascript	2a00:1450:4001:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 1337d1d7526a57e9466da4556ed708881b6483ac0be68ca3de7b03545c399623 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Mon, 30 Dec 2024 05:26:52 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136760 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	19 KB 8 KB	159ms 46ms	Script application/javascript	2a02:26f0:480:15::213:7e4a AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 6c0d4e3bd890a4bf01c9a301d3e3ff127af22636c4f94250cc230815eb701593 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding cache-control max-age=82260 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 7404 date Mon, 30 Dec 2024 05:26:52 GMT last-modified Wed, 18 Dec 2024 09:08:52 GMT content-type application/javascript;charset=utf-8 x-edgeconnect-midmile-rtt 0, 0 x-edgeconnect-origin-mex-latency 470, 470 x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	150ms 44ms	Script application/javascript	199.232.188.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Mon, 30 Dec 2024 05:26:52 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 20:04:45 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kcgs7200099-IAD, cache-muc13952-MUC x-amz-server-side-encryption AES256
GET H2	200	hotjar-3169094.js Show response static.hotjar.com/c/	13 KB 6 KB	197ms 77ms	Script application/javascript	18.66.102.11 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.11 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-11.fra56.r.cloudfront.net Software / Resource Hash 01ebe4823d9dd9661fc2d46509e1a4ac4c664df1a5475d5a8a32bd6d4038072f Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 content-encoding br etag W/fd878d80f7c68fb700a36117e6dcc084 cross-origin-resource-policy cross-origin x-content-type-options nosniff x-cache-hit 1 via 1.1 22993faf725ff29c940e58cb14ddf668.cloudfront.net (CloudFront) access-control-allow-origin * x-cache RefreshHit from cloudfront x-amz-cf-id SJ0AGC-3VPMlHg6jkk7NYprbHIb0XGT6g6kWD_d8TJEBw9KZiA36-w== date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding x-amz-cf-pop FRA56-P2
GET H3	200	2985.js Show response script.crazyegg.com/pages/scripts/0115/	7 KB 3 KB	560ms 498ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0115/2985.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0d810efe03fa42a406546c8b52a2b9623d2625938f7e1048fba55a71f99eafa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type text/javascript last-modified Mon, 30 Dec 2024 05:26:52 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9f9e11ab9f4d2b-FRA accept-ranges bytes access-control-allow-origin * content-length 2480 ce-version 11.5.340 server cloudflare
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	110ms 29ms	Script application/javascript	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Mon, 30 Dec 2024 05:26:52 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	100ms 45ms	Script application/x-javascript	157.240.252.13 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra3.fbcdn.net Software / Resource Hash 24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-TEjA78pS' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-TEjA78pS' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=43, rtx=0, c=23, mss=1232, tbw=4495, tp=9, tpl=0, uplat=0, ullat=-1 pragma public x-fb-debug cB9KvayW41+pMS8/3CzxxzopjASNop/QJNSkrQ/8QPyMQqdLAhH5B2yPXSyA9tqhPhnFgE/yUKgkly+MPYJIXg== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62282 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	155ms 48ms	Script text/javascript	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip age 4921 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],} x-content-type-options nosniff expires Mon, 30 Dec 2024 06:04:51 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 04:04:51 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 17168 server Golfe2
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/	16 KB 5 KB	285ms 191ms	Script application/javascript	2600:9000:2670:c000:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2670:c000:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Clearbit / Resource Hash 11e852bb791058078812ff8c0780eee92054fbaad4e03ca2f4263576ee487ac7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip etag W/"baf7329e47c04b0ab497040e04f53af5" x-envoy-response-flags - x-content-type-options nosniff via 1.1 b6a955345e4fcc7881bd0a9815e8286e.cloudfront.net (CloudFront) x-cache Miss from cloudfront x-amz-cf-id iuDT3MW3td6IUrbDP6jAkSu2xXteI6A61OVqnF9X7nuZIpDDQtplZA== date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit x-amz-cf-pop FRA56-P9
GET H3	200	62febdf93e32fb008eef5596 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	296ms 237ms	Script text/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62febdf93e32fb008eef5596 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 12778fdb4efa49a690cf8e49fba56c427fd8dfd2c7b60739ec59bf632cc2d943 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:52 GMT content-type text/javascript vary Accept-Encoding priority u=3,i=?0 access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url access-control-allow-credentials true via 1.1 google cf-ray 8f9f9e126d8839c7-FRA access-control-allow-origin * x-powered-by Express server cloudflare
GET H3	200	warmly.js Show response opps-widget.getwarmly.com/	1 KB 2 KB	138ms 81ms	Script text/javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b64ac9b7bf876d9264e9eebf36cc6385fcc3519947a89c5846dda7e04f7a070e Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status BYPASS etag W/"4c09ae33bcd4d090ac6377d96d5856783350463d2be8c5e352371aa9207cbc00-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TdaBKVnEY77Y4CXirAbX1wl7OHKefbKrdxiqt%2BB1sucBX8TlOhobYiKKgpCmMSq8DwRJ0miHpJiS6ekfuMNQwdT%2B3eafiJpDqgVlUxOOqUM61H44d%2F9uPDp4XYclDbKjyTWWPM6UALgg1Dl8"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache MISS server-timing cfL4;desc="?proto=QUIC&rtt=43364&min_rtt=43364&rtt_var=16262&sent=10&recv=7&lost=0&retrans=0&sent_bytes=4121&recv_bytes=4267&delivery_rate=75836&cwnd=12000&unsent_bytes=0&cid=95d572cfbf4c98de&ts=85&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 30 Dec 2024 05:26:52 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230179-FRA x-cache-hits 0 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=3,i=?0 x-timer S1735536413.553129,VS0,VE27 referrer-policy origin-when-cross-origin cf-ray 8f9f9e126c8fdc9a-FRA access-control-allow-origin * server cloudflare
GET H2	200	5298086.js Show response js-na1.hs-scripts.com/	2 KB 1 KB	152ms 83ms	Script application/javascript	2606:4700::6810:8bd1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/5298086.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8bd1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e14c17b025a5de806b09b97c5c9cf1da81756e2f676bc42308abcd1af2623b52 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3600 content-encoding gzip cf-cache-status HIT access-control-allow-credentials true x-content-type-options nosniff cf-ray 8f9f9e129ac4ed1a-MXP accept-ranges bytes access-control-allow-origin https://www.cyberhaven.com content-length 651 date Mon, 30 Dec 2024 05:26:52 GMT x-hubspot-correlation-id e6759666-39a8-47a8-bf0d-c1c4aae462ca content-type application/javascript;charset=utf-8 vary origin, Accept-Encoding server cloudflare last-modified Mon, 30 Dec 2024 03:36:02 GMT
GET H2	200	array.js Show response us-assets.i.posthog.com/static/	175 KB 62 KB	213ms 138ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/array.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 194433cfcf698601025b3b524cabab64841800b5467ec6e199de7f9169b5fd34 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9f9e12ae660e8b-MXP access-control-allow-origin * date Mon, 30 Dec 2024 05:26:52 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	web gtm-server.cyberhaven.com/measurement/	35 B 386 B	329ms 252ms	Image image/gif	34.8.125.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://gtm-server.cyberhaven.com/measurement/web?event_name=page_view&event_id=1735536876133_17355365859471&page_location=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension%3Ffbclid%3Dnull%26li_fat_id%3Dnull Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.8.125.141 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.125.8.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires Thu, 01 Jan 1970 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT content-type image/gif server Google Frontend
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4cc0/ Frame 75BF	0 0	124ms 40ms	Document text/html	2a00:1450:4001:802::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.cyberhaven.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 217891 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Fri, 27 Dec 2024 16:55:21 GMT expires Sat, 27 Dec 2025 16:55:21 GMT last-modified Thu, 12 Dec 2024 10:18:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
POST H2	204	collect region1.analytics.google.com/g/	0 0	133ms 50ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-WLE78NS0JZ&gtm=45je4cc1v890707664z8832240631za200zb832240631&_p=1735536412043&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1229856439.1735536412&ul=it-it&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1735536412&sct=1&seg=0&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clean_url=www.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.clean_path=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.level1=engineering-blog&ep.level2=cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tfd=842 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 548 B	148ms 49ms	Ping text/plain	2a00:1450:400c:c07::9d GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WLE78NS0JZ&cid=1229856439.1735536412&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c07::9d Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT content-type text/plain server Golfe2
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	165ms 58ms	Image image/gif	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-WLE78NS0JZ&cid=1229856439.1735536412&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1297443940 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Mon, 30 Dec 2024 05:26:52 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_kk14jgkb/	3 B 124 B	110ms 29ms	XHR application/json	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_kk14jgkb/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/json
GET H2	200	t2_kk14jgkb_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	91ms 34ms	XHR application/json	2a04:4e42:200::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_kk14jgkb_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:200::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	207ms 127ms	Image image/gif	151.101.65.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1735536412473&id=t2_kk14jgkb&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=821ec22f-f78e-4000-81b3-1ba864b40e76&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Mon, 30 Dec 2024 05:26:52 GMT content-type image/gif server Varnish
GET H3	200	321517546861767 Show response connect.facebook.net/signals/config/	69 KB 14 KB	87ms 86ms	Script application/x-javascript	157.240.252.13 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/321517546861767?v=2.9.179&r=stable&domain=www.cyberhaven.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra3.fbcdn.net Software / Resource Hash eb24f0f3a43ff4aac43ed08c045e810d847652a5393b3db67de9f6c055deebc5 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-BGffaAx3' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-BGffaAx3' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality EXCELLENT; q=0.9, rtt=43, rtx=0, c=77, mss=1232, tbw=70511, tp=65, tpl=0, uplat=42, ullat=0 pragma public x-fb-debug Bd+HiBeq/gzSP0oDFJo7IWD7gtjv/Pa3A+3Bk36E2faYwan74m48DzSR2FdfaIF0MTo9o3qoE9F1APOeEqXDbA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	adsct t.co/1/i/	43 B 629 B	323ms 226ms	Image image/gif	172.66.0.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=5a2a78bf-b992-4e7f-9eee-7e98df05700e&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=b145bfe4-59b5-4a89-94e4-83115ed7e5fd&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=0 x-transaction-id f54ecfc26eb0d15e cache-control no-cache, no-store, max-age=0 x-connection-hash a376fdd65b9a4c5b57dbe125b580afba24c9ce69ac41ea161f83fff796674c40 cf-cache-status DYNAMIC cf-ray 8f9f9e137bd5363f-FRA x-response-time 174 content-length 43 date Mon, 30 Dec 2024 05:26:52 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 724 B	255ms 145ms	Image image/gif	104.244.42.67 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=5a2a78bf-b992-4e7f-9eee-7e98df05700e&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=b145bfe4-59b5-4a89-94e4-83115ed7e5fd&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.67 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 15c0f18527ebbed8 cache-control no-cache, no-store, max-age=0 x-connection-hash 4c1461f22417df5c07afb9348bb491bd25688fb6ac031094b06cdd04c1380338 x-response-time 101 content-length 43 date Mon, 30 Dec 2024 05:26:52 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	46ms 46ms	Script application/javascript	2a02:26f0:480:15::213:7e4a AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:15::213:7e4a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=16941 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Mon, 30 Dec 2024 05:26:52 GMT last-modified Mon, 02 Dec 2024 10:13:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 410 B	55ms 54ms	Image image/gif	2a00:1450:4001:806::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1294049048&utmhn=www.cyberhaven.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=it-it&utmje=0&utmfl=-&utmhid=101705814&utmr=-&utmp=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&utmht=1735536412521&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D154243370.1229856439.1735536412.1735536413.1735536413.1%3B%2B__utmz%3D154243370.1735536413.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1194666966&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],} x-content-type-options nosniff content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0 expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 30 Dec 2024 05:26:52 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif server Golfe2
GET H2	200	modules.60031afbf51fb3e88a5b.js Show response script.hotjar.com/	223 KB 56 KB	138ms 46ms	Script application/javascript	52.222.236.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.236.43 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-236-43.fra56.r.cloudfront.net Software / Resource Hash e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b4a1a7933e55e780894c3f39b1aca0b4" age 1013745 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id xp3gVn1kzS4zEMKtfShsMx75KDl6yx7bcsaFy9w44FTs597ylDoz9g== date Wed, 18 Dec 2024 11:51:07 GMT content-type application/javascript; charset=utf-8 last-modified Wed, 18 Dec 2024 11:50:24 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 82386e4e4f56a0c01411d1aea6f3fd46.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56408 x-amz-cf-pop FRA56-P4
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 811 B	264ms 192ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1962740&time=1735536412583&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.cyberhaven.com/ Response headers x-li-pop afd-prod-ltx1-x content-encoding gzip x-fs-uuid 00062a760f6058123122b84db9745713 x-msedge-ref Ref A: 8C17330721254A798548FCB1300AF102 Ref B: ZRHEDGE1422 Ref C: 2024-12-30T05:26:52Z x-li-fabric prod-ltx1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYqdg9gWBIxIrhNuXRXEw== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Mon, 30 Dec 2024 05:26:51 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recen...	0 267 B	272ms 205ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJGMdYvbdyfPAAAAZQWCAjN4HXjNhAKTdZizzqumfLr5hr4-RFPHQ0prFMvRuojnGHmkg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: BC21EF4125C44479B3FB48FDD6562077 Ref B: MIL30EDGE1420 Ref C: 2024-12-30T05:26:53Z x-li-fabric prod-lor1 x-li-uuid AAYqdg9mdiQVozIyuZjASA== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lor1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735536412583&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQJGMdYvbdyfPAAAAZQWCAjN4HXjNhAKTdZizzqumfLr5hr4-RFPHQ0prFMvRuojnGHmkg x-msedge-ref Ref A: 4B06857BD915423EA346726122BD6487 Ref B: ZRHEDGE1519 Ref C: 2024-12-30T05:26:52Z x-li-fabric prod-lor1 x-li-uuid AAYqdg9iSO4vRXCZUdHacg== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Mon, 30 Dec 2024 05:26:52 GMT
GET H3	200	/ www.facebook.com/tr/	0 19 B	100ms 49ms	Image text/plain	157.240.252.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1735536412594&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735536412594.70473977115507802&ler=empty&cdl=API_unavailable&it=1735536412500&coo=false&eid=1735536876133_17355365859471&tm=1&exp=j3&rqm=GET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-fra3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=48, rtx=0, c=23, mss=1232, tbw=4496, tp=9, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Mon, 30 Dec 2024 05:26:52 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 195 B	482ms 482ms	Image image/png	157.240.252.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1735536412594&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735536412594.70473977115507802&ler=empty&cdl=API_unavailable&it=1735536412500&coo=false&eid=1735536876133_17355365859471&tm=1&exp=j3&rqm=FGET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-01-fra3.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7454072131010833187"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x388744eefc87a3b9","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["5988309531205427"]},"debug_reporting":true,"debug_key":"3784289539274422243"} date Mon, 30 Dec 2024 05:26:53 GMT content-type image/png vary Accept-Encoding x-fb-debug iF/8rVvewFFX2a7PdiOwaxJWTgEhG4maHlSKO4fDSS957qFr8OEbvAKD32TXpjO/gApToVau5htklIRhn8wi0A== priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7454072131010833187", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality EXCELLENT; q=0.9, rtt=48, rtx=0, c=23, mss=1232, tbw=4912, tp=13, tpl=0, uplat=432, ullat=0 cross-origin-opener-policy same-origin-allow-popups pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	config.js Show response us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/	963 B 827 B	444ms 444ms	Script application/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/config.js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224f0faed26a56018f3d6f3d5e8fe2dda990c262ca0903c723145d2b47d1b108 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status EXPIRED x-content-type-options nosniff date Mon, 30 Dec 2024 05:26:53 GMT content-type application/javascript vary Origin, Referer, Accept-Encoding last-modified Mon, 30 Dec 2024 05:26:53 GMT x-frame-options SAMEORIGIN cache-control max-age=300 cross-origin-opener-policy same-origin x-envoy-upstream-service-time 19 referrer-policy same-origin allow GET, HEAD, OPTIONS cf-ray 8f9f9e13cea90e8b-MXP accept-ranges bytes access-control-allow-origin * content-length 606 server cloudflare
POST H2	200	/ Show response us.i.posthog.com/decide/	861 B 837 B	400ms 125ms	Fetch application/json	35.172.42.21 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/decide/?v=3&ip=1&_=1735536412748&ver=1.203.1&compression=base64 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.172.42.21 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-172-42-21.compute-1.amazonaws.com Software envoy / Resource Hash c28e2af4e14aafdc9b247281d5aa398e81f6c95a1543caa0fdc786ffe4552856 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/x-www-form-urlencoded Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 6 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
POST H2	200	/ Show response us.i.posthog.com/e/	13 B 405 B	396ms 127ms	Fetch application/json	35.172.42.21 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/e/?ip=1&_=1735536412752&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.172.42.21 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-172-42-21.compute-1.amazonaws.com Software envoy / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 7 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H2	200	6si.min.js Show response j.6sc.co/	69 KB 19 KB	49ms 49ms	Script application/javascript	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "6763d3a0-115be" x-content-type-options nosniff expires Mon, 30 Dec 2024 08:26:52 GMT accept-ranges bytes content-length 19249 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 19 Dec 2024 08:04:48 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	0 172 B	324ms 209ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 x-envoy-response-flags - x-content-type-options nosniff content-length 0 date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript;charset=utf-8 server Clearbit
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	168 KB 45 KB	334ms 219ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash 9be0e78d405feaf2f28eaa33d8f8b0c298c5385a546d825fba34e81aed740be0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip x-envoy-response-flags - x-content-type-options nosniff date Mon, 30 Dec 2024 05:26:52 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	70 KB 25 KB	215ms 147ms	Script application/javascript	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers x-request-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-encoding gzip cf-cache-status EXPIRED x-amz-version-id 8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_ etag W/"ceb8bcb73e5536d8416735a3977d227a" cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-content-type-options nosniff x-cache Hit from cloudfront x-evy-trace-listener listener_https x-amz-cf-id 8WfkRX3JAvexG5l-W6G4VtYiAK3XggMdfy0nlP-0JfveLJ71QnecPQ== x-hubspot-correlation-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-type application/javascript; charset=utf-8 last-modified Mon, 09 Dec 2024 13:03:17 UTC x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-4w2hc x-envoy-upstream-service-time 5 x-hs-target-asset collected-forms-embed-js/static-1.1112/bundles/project.js server cloudflare x-evy-trace-virtual-host all x-amz-server-side-encryption AES256 access-control-max-age 3000 access-control-allow-methods GET x-hs-cache-status MISS date Mon, 30 Dec 2024 05:26:53 GMT vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8ef5bfb0bfdeedcb-FRA via 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront) cf-ray 8f9f9e149edb5a2b-MXP access-control-allow-origin * x-evy-trace-route-configuration listener_https/all x-amz-cf-pop IAD12-P3
GET H2	200	conversations-embed.js Show response js.usemessages.com/	94 KB 27 KB	102ms 35ms	Script application/javascript	2606:4700::6810:4b8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4b8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d2b03470a7d1ae7aba4f78432a23655d3e5092f63312f3dcc3bd1f3e2ed7ec5 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all x-request-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-encoding gzip cf-cache-status HIT etag W/"4dfe3f6f9786f2063afe9a04ac031914" x-amz-version-id fDaori16DhigsoRwsdU7m4W4sxmAcg6S cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod age 574 x-content-type-options nosniff x-cache Hit from cloudfront x-hs-cache-status HIT x-amz-cf-id j-SnkIpB8dxYR4_xkUb1_co81133geiWWU2BVr0S_m3zvz2sOR5wuw== date Mon, 30 Dec 2024 05:26:52 GMT x-hubspot-correlation-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-type application/javascript; charset=utf-8 last-modified Tue, 17 Dec 2024 16:16:40 UTC vary accept-encoding x-evy-trace-listener listener_https x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-mglm2 x-envoy-upstream-service-time 0 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19372/bundles/project.js&cfRay=8f76c22c89cd8fd6-FRA via 1.1 b77313059f3d50280ced20238b151620.cloudfront.net (CloudFront) cf-ray 8f9f9e14ac8dee78-MXP x-evy-trace-route-configuration listener_https/all x-hs-target-asset conversations-embed/static-1.19372/bundles/project.js x-amz-cf-pop IAD12-P3 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	5298086.js Show response js.hs-analytics.net/analytics/1735529700000/	68 KB 25 KB	122ms 54ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1735529700000/5298086.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash deff21bdd3cf5ec27f508fe5d3e13bcd67ffb7dda68e07d97582cddc6ab4e7f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 x-request-id e871e0f2-0b18-4668-af4a-fdd0de6971dd content-encoding gzip cf-cache-status HIT etag W/"db94dc959471013f74dd433982c87807" x-amz-version-id null expires Mon, 30 Dec 2024 05:28:08 GMT x-evy-trace-listener listener_https date Mon, 30 Dec 2024 05:26:52 GMT x-hubspot-correlation-id e871e0f2-0b18-4668-af4a-fdd0de6971dd content-type text/javascript last-modified Wed, 06 Nov 2024 18:35:26 GMT vary origin, Accept-Encoding x-amz-id-2 z/YNqXQrfaavk5cAdaH3FhA8gMQikISlsmSfnekFXyyS/58zecqp1jyR7PpUy69+pU2PGSla7tCAt6E0/DuSzyW056zWMF6pYZ76wl5Pnds= x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-vkszw x-envoy-upstream-service-time 49 access-control-allow-credentials false x-amz-request-id RYDPS4QMPXHKFZPK cf-ray 8f9f9e14bbebed23-MXP x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	banner.js Show response js.hs-banner.com/v2/5298086/	71 KB 26 KB	209ms 133ms	Script text/javascript	2606:4700:4400::ac40:9310 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/5298086/banner.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1f5bfd29b1b65351bdeec611c0f02131e5a8a7336e2d87075b15dff2b7f3f8f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all access-control-max-age 604800 x-request-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing content-encoding gzip cf-cache-status HIT etag W/"70c5670e6d77885ece19beb74afe4af5" x-amz-version-id GcEt1rgO1vU4WsJ6afMIGzER7IXMa_OI access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD expires Mon, 30 Dec 2024 05:28:09 GMT x-evy-trace-listener listener_https date Mon, 30 Dec 2024 05:26:53 GMT x-hubspot-correlation-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea content-type text/javascript; charset=UTF-8 last-modified Thu, 24 Oct 2024 19:19:32 GMT vary origin, Accept-Encoding x-amz-id-2 MQCYBvG4V5+djwpG0cU2tMuf/xfG+OQ3887eGE3FR+ewuikvYiayuXnhJbexmo5WsCK+SjZoz4I= access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public timing-allow-origin * x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-85276 x-envoy-upstream-service-time 156 access-control-allow-credentials true x-amz-request-id 6NB4N8W9R5GSAPVD cf-ray 8f9f9e151c37ed23-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-amz-server-side-encryption AES256
POST H2	200	/ Show response content.hotjar.io/	56 B 171 B	306ms 129ms	XHR application/json	54.155.186.43 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://content.hotjar.io/?site_id=3169094&gzip=1 Requested by Host: script.hotjar.com URL: https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 54.155.186.43 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-155-186-43.eu-west-1.compute.amazonaws.com Software / Resource Hash 4df787ec87fa587ac924047b76e7dd4091636f35e5560d188434d0b9b2a67359 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain; charset=UTF-8 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 86400 access-control-allow-origin * content-length 56 date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 706 B	152ms 53ms	XHR application/json	185.89.210.46 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 192.145.127.215; 192.145.127.215; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://www.cyberhaven.com an-x-request-uuid e5343ba6-67bb-490d-94e9-dedddc4905d7 content-length 11 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Mon, 30 Dec 2024 05:26:52 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H/1.1	200 OK	/ Show response c.6sc.co/	7 B 332 B	172ms 56ms	XHR text/html	2.17.100.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2.17.100.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a2-17-100-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers Access-Control-Max-Age 86400 Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Methods GET,POST Access-Control-Allow-Origin https://www.cyberhaven.com Content-Length 7 Date Mon, 30 Dec 2024 05:26:53 GMT Content-Type text/html Access-Control-Allow-Headers *
GET H2	200	/ Show response ipv6.6sc.co/	18 B 311 B	151ms 45ms	XHR text/html	2a02:26f0:480:23::1726:629c AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:629c Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 6cba0fd7551dfe0a0f2e4c5c47ba43fc659d9989bc8cd2beaef958f6ad776f65 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:24:44::12 expires Mon, 30 Dec 2024 05:26:53 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1735536412955_388391911_1347291782_28_1032_42_45_219";dur=1 access-control-allow-origin https://www.cyberhaven.com content-length 18 date Mon, 30 Dec 2024 05:26:53 GMT content-type text/html vary Origin
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/site/	5 KB 2 KB	195ms 156ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/site/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2d07344bbcf44d8d26bea24c38958091cce502489ddd42659b040a51adfdb71e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json last-modified Mon, 30 Dec 2024 05:26:53 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9f9e150f4fd365-FRA accept-ranges bytes access-control-allow-origin * content-length 1767 ce-version 11.5.340 server cloudflare
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	217ms 148ms	Preflight text/plain	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=96efae27f37741c38b212e71fdfdb5e5&traceId=96efae27f37741c38b212e71fdfdb5e5 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://www.cyberhaven.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8f9f9e155d4fedcd-MXP content-length 18 content-type text/plain; charset=utf-8 date Mon, 30 Dec 2024 05:26:53 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k1vmcye5HqquRr4%2FP9h0MJ9V%2Bxf4NhuHA98rl60OI%2F4CDMaONjdJ49Vj29jeK%2BmoQVSzGXdp47sNo83BzX1r4veBkYrUn4w%2FbHtJMKkGF2o6%2FCPT%2F%2FFdFFD4HWCCPzQLYg2p34bp2mD3OI%2B6Rw%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-hubspot-correlation-id 4687ff3c-1ef1-4970-bd27-afcab4b3a218
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	297 B 938 B	417ms 417ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=96efae27f37741c38b212e71fdfdb5e5&traceId=96efae27f37741c38b212e71fdfdb5e5 Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d5be351ae5fcd04cfcaf42a8b2ac9a945bc922cd4dca124cc4a093d61200a37 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 X-HubSpot-Messages-Uri https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IyKIXP%2FBjNSC6kKUj6LKKzBPKXJDtprw%2BDX5j2cTblo%2Bisuf3gPZ6VnTQI42fFctIn2Se7LYZ%2BxFNC5vDAlrd%2BKp9ZOk5lng82YYDSf3M0Lf4FAZ62sMRzSJa0FQgzKwNQM6H8VMFjNsJo82Zg%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff date Mon, 30 Dec 2024 05:26:53 GMT x-hubspot-correlation-id 4e882302-e126-456d-96e6-3ac0691bdf54 content-type application/json;charset=utf-8 vary origin, Accept-Encoding access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials false cf-ray 8f9f9e173ebaedcd-MXP access-control-allow-origin https://www.cyberhaven.com content-length 235 server cloudflare
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 656 B	156ms 73ms	XHR application/json	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash f4a34c3d3a257c60a880889233ebb2169035f172404bc1aad871d90b18170839 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	169ms 51ms	Preflight	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 30 Dec 2024 05:26:53 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	153ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A12%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	153ms 138ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	151ms 136ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22218d4ca0f0d30c4801ecd3d056a7fae0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22555171e6d4c91ba269d673d31c487f9d31fe33c9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22bda12b36-0455-47af-b8ba-9529bbb134fb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	133 B 640 B	362ms 352ms	XHR application/json	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=5298086&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51cde42c03bdfd44328fe282089cbd8e3ee5185c09d38ac0814480d824de684a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, */* Referer https://www.cyberhaven.com/ Response headers x-robots-tag none access-control-max-age 180 x-request-id 4cdb6b45-8455-4bfd-8442-f9becaff2789 content-encoding br cf-cache-status DYNAMIC access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff x-evy-trace-listener listener_https date Mon, 30 Dec 2024 05:26:53 GMT x-hubspot-correlation-id 4cdb6b45-8455-4bfd-8442-f9becaff2789 content-type application/json;charset=utf-8 vary Accept-Encoding access-control-allow-headers * x-evy-trace-route-service-name envoyset-translator cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-2w2nl x-envoy-upstream-service-time 8 cf-ray 8f9f9e15af125a2b-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H3	200	4905af20a771527fdcc240cf8ab4172a.js Show response script.crazyegg.com/pages/versioned/common-scripts/	107 KB 37 KB	47ms 47ms	Script text/javascript	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 9f17058a6ac8f171e452a0ed24075c6e592834eef8dc12e343ade35adc73c4cc Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT age 344541 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:53 GMT content-type text/javascript last-modified Thu, 12 Dec 2024 18:42:04 GMT vary Accept-Encoding priority u=3,i=?0 cache-control public, max-age=31536000, s-maxage=31536000 timing-allow-origin * cf-ray 8f9f9e160d184d2b-FRA accept-ranges bytes access-control-allow-origin * content-length 37122 server cloudflare
GET H2	200	recorder.js Show response us-assets.i.posthog.com/static/	112 KB 40 KB	139ms 139ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/recorder.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ec3f8ef2aa975a22f11d5d3592111d857a5917287a00ca6cf191d72859354d75 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9f9e164f600e8b-MXP access-control-allow-origin * date Mon, 30 Dec 2024 05:26:53 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	dead-clicks-autocapture.js Show response us-assets.i.posthog.com/static/	14 KB 5 KB	137ms 137ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6efafe07fd29b04ec60906d17ea4e89d6c0601d49ff2f160e06d709060bbcee2 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=14400 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 3 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9f9e164f610e8b-MXP access-control-allow-origin * date Mon, 30 Dec 2024 05:26:53 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
GET H2	200	web-vitals.js Show response us-assets.i.posthog.com/static/	10 KB 4 KB	139ms 139ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/web-vitals.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7196c8f501e096262228f56c988d4fb9e4b2e3e331e411f40c30e6889f282fb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8f9f9e164f620e8b-MXP access-control-allow-origin * date Mon, 30 Dec 2024 05:26:53 GMT content-type text/javascript; charset="utf-8" last-modified Sun, 29 Dec 2024 09:11:31 GMT vary Accept-Encoding server cloudflare
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	307ms 202ms	XHR application/json	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload access-control-max-age 7200 access-control-expose-headers content-encoding gzip x-envoy-response-flags - access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; x-content-type-options nosniff access-control-allow-origin https://www.cyberhaven.com date Mon, 30 Dec 2024 05:26:52 GMT content-type application/json vary Accept-Encoding, Origin server Clearbit
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/sampling/	160 B 389 B	154ms 154ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/sampling/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 54b470fa4aa8d9260bd1f34779a3247ca00feec0bf247d6651d7b9800b0c58da Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status MISS alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json last-modified Mon, 30 Dec 2024 05:26:53 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8f9f9e16d95cd365-FRA accept-ranges bytes access-control-allow-origin * content-length 149 ce-version 11.5.340 server cloudflare
GET H2	200	blockedDomains.json Show response hubspotonwebflow.com/assets/js/	98 KB 23 KB	57ms 57ms	Fetch application/json	76.76.21.123 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/blockedDomains.json Requested by Host: hubspotonwebflow.com URL: https://hubspotonwebflow.com/assets/js/form-124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 76.76.21.123 Walnut, United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"04708d47dd194d37b8231a65de7a66f1" age 6875269 x-matched-path /assets/js/blockedDomains.json access-control-allow-origin * date Mon, 30 Dec 2024 05:26:53 GMT content-disposition inline; filename="blockedDomains.json" content-type application/json; charset=utf-8 server Vercel last-modified Thu, 10 Oct 2024 20:46:42 GMT x-vercel-id fra1::5fsk8-1735536413359-1879ba44ffa4
GET H2	200	__ptq.gif track.hubspot.com/	45 B 1 KB	206ms 137ms	Image image/gif	2606:4700::6810:7574 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=151041951&v=1.1&a=5298086&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&cts=1735536413342&vi=5be831e505766ce8a8db20a4186a0e47&nc=true&u=208653005.5be831e505766ce8a8db20a4186a0e47.1735536413341.1735536413341.1735536413341.1&b=208653005.1.1735536413341&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7574 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none x-request-id ad74d95e-b6af-4201-b84a-3784cfa9a8f6 cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UBmM2yoWikOfvT%2Fk0H1enmj78Cn4xYjcpERSvLVlel86jx%2FVfz%2Bn9v4yK3QCaXuRvuWxIrFtAmwEQwWQQQbQ9P2jn%2B6tb0FkHFLwCKJKPLDdvuzlx4pm%2FzAywhOUa9teuni5KX10qSvx%2BXv4A8Ts"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-evy-trace-listener listener_https p3p CP="NOI CUR ADM OUR NOR STA NID" date Mon, 30 Dec 2024 05:26:53 GMT x-hubspot-correlation-id ad74d95e-b6af-4201-b84a-3784cfa9a8f6 content-type image/gif vary origin, Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator cache-control no-cache, no-store, no-transform nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-cvxr8 x-envoy-upstream-service-time 4 access-control-allow-credentials false cf-ray 8f9f9e17ec71eea7-MXP x-evy-trace-route-configuration listener_https/all content-length 45 server cloudflare x-evy-trace-virtual-host all
GET H3	200	widget-tA7EQKQY.js Show response opps-widget.getwarmly.com/	598 KB 183 KB	92ms 50ms	Script text/javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc6d50d5d2484099d6743c7978504b4d781fdb3974629742ec15c7772798f0bf Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"f7b80d857423a14c3abd182b35f25ecc8b513bdee66a9c0e3e8bec251b8b6b47-br" age 2859 x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qYjHAjHaGPZajx%2Bg0E%2B3Y6FCL8wxJ5zKbf6T8g%2BkeSR7%2BmRbI%2BoFFdW0Efqup8B5DeVA4%2Btebqaz6nXb4LESYRyIlYVsd0dJ84xzTHu%2FwRf6UvRipVte9Sn7RdlDHc6mHbpp3Q4RCNBfpcot"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache HIT server-timing cfL4;desc="?proto=QUIC&rtt=39621&min_rtt=39620&rtt_var=14860&sent=9&recv=6&lost=0&retrans=0&sent_bytes=2155&recv_bytes=4073&delivery_rate=36290&cwnd=12000&unsent_bytes=0&cid=210ef299c5059a24&ts=50&x=1", cfExtPri, cfHdrFlush;dur=0 date Mon, 30 Dec 2024 05:26:53 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230050-FRA x-cache-hits 96 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=1,i=?0 x-timer S1735261732.027078,VS0,VE0 referrer-policy origin-when-cross-origin cf-ray 8f9f9e17caa4d274-FRA access-control-allow-origin * server cloudflare
GET H3	200	6515e83924723987bacc4b6b_favicon.png cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	2 KB 2 KB	52ms 52ms	Other image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/6515e83924723987bacc4b6b_favicon.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35f594c6250e4f6beb23551ea8b2128ca0faa451998403ac7859bc51873b3cf2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "7f9532364c9c4bd7e55de7b330a315d7" x-amz-version-id 2PFNNcwh85NMJaJS3FT9RI.EWY5iSVaq age 1243712 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Mon, 30 Dec 2024 05:26:53 GMT content-type image/png last-modified Thu, 28 Sep 2023 20:55:22 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 DXBM/QZjP7VP0udFWwQW1Ne7Ln2t4YKWVp1eFwUKXXpTzGxa2UJL/gJOzqOckRkg147HE3WbLM62S9LLMIF80Un+8HW3s9kvXNDcEiWLLzw= cache-control max-age=31536000, must-revalidate x-amz-request-id RFQT0G6005M45KPE cf-ray 8f9f9e178d87d28c-FRA accept-ranges bytes access-control-allow-origin * content-length 1946 server cloudflare x-amz-server-side-encryption AES256
OPTIONS H2	200	details eps.6sc.co/v3/company/ Frame	0 0	144ms 44ms	Preflight	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,epsiloncookie,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,epsiloncookie,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Mon, 30 Dec 2024 05:26:53 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	details Show response eps.6sc.co/v3/company/	738 B 655 B	62ms 62ms	Fetch application/json	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://eps.6sc.co/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 9d3d1562c7ca9da6bacad14844adfc7dcfd6f9f0bd0016f1ef70845ae0c00bf0 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb EpsilonCookie null User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json vary Origin, Accept-Encoding
OPTIONS H2	200	v v.eps.6sc.co/ Frame	0 0	413ms 316ms	Preflight application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Mon, 30 Dec 2024 05:26:53 GMT via 1.1 ea1aadbeedf1001a86f79fc729fb39e0.cloudfront.net (CloudFront) x-amz-apigw-id DlxMtF7GoAMENjw= x-amz-cf-id Tk72kTrRqALj3XE4C9QNMMAOVE9sbCO9y3-45dLfWlMeINDL1vRzUg== x-amz-cf-pop FRA60-P10 x-amzn-requestid 914d470d-0171-4672-9b22-b25385490567 x-cache Miss from cloudfront
POST H2	200	v Show response v.eps.6sc.co/	12 B 519 B	194ms 193ms	XHR application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers x-amz-apigw-id DlxMuHWAoAMESKg= x-amzn-trace-id Root=1-67722f1d-0a7378a819b50ac5188e9a67;Parent=01db9a43b6cd2af3;Sampled=0;Lineage=1:56167173:0 access-control-allow-methods OPTIONS,POST x-amzn-requestid 9cf6534c-c30e-4997-8caf-d8202724e694 via 1.1 ea1aadbeedf1001a86f79fc729fb39e0.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 12 x-amz-cf-id QHkVuiTG8KKis9GkwxOpqZt06iuVUDaEol4ckVKHZXvaij3d0eaCVw== date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json x-amz-cf-pop FRA60-P10 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	138ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=https%3A%2F%2Fepsilon.6sense.com&q=%7B%22name%22%3A%22https%3A%2F%2Fepsilon.6sense.com%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1399.0999999046326%2C%22duration%22%3A328%2C%22initiatorType%22%3A%22xmlhttprequest%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1399.0999999046326%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1727.0999999046326%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=&d=1&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET		159e3174-424e-4dca-a504-c34daa29c0fc https://www.cyberhaven.com/ Frame	0 0
POST H2	200	clock Show response tracking.crazyegg.com/	41 B 147 B	98ms 97ms	XHR text/plain	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1735536413400&tk=8278c3be49784fffa4a1b15f884798b8 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash 02ca7f4957de246afd764d0cd64d6aad9358453cc1ff2a72dced6314026483ca Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers cache-control no-store access-control-allow-origin * content-length 41 date Mon, 30 Dec 2024 05:26:53 GMT content-type text/plain server awselb/2.0
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/	19 B 462 B	150ms 43ms	XHR application/json	13.35.58.40 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.40 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-40.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 8460659 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id tTFTmdPfhCr1oHMo4aBBgI7WhOZ3NiUbfkS3yqqiZih_Uh3X_9qhdA== date Mon, 23 Sep 2024 07:15:55 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 503c2bd0b7e26f747c58a5188346ef54.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P10 server AmazonS3
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/	19 B 461 B	152ms 43ms	XHR application/json	18.66.122.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/4905af20a771527fdcc240cf8ab4172a.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.122.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-122-72.fra60.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 31536000 access-control-expose-headers Access-Control-Allow-Origin etag "d06f04fccf68d0b228a5923187ce1afd" age 8975676 access-control-allow-methods GET, HEAD x-cache Hit from cloudfront x-amz-cf-id FBMts3fVT5UceyPejSroipoM9n7dvXRXbyW4J1EuYRObxzS6D-Z4Cw== date Tue, 17 Sep 2024 08:12:17 GMT content-type application/json last-modified Fri, 08 Jul 2022 22:25:51 GMT via 1.1 d71acb203a3e8fc7db2c1cf9725d51da.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 19 x-amz-cf-pop FRA60-P2 server AmazonS3
OPTIONS H2	204	clock tracking.crazyegg.com/ Frame	0 0	224ms 85ms	Preflight	46.137.150.200 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?u=1152985&st=411982&t=1735536413400&tk=8278c3be49784fffa4a1b15f884798b8 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 46.137.150.200 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-46-137-150-200.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Authorization,Content-Type,Access-Control-Allow-Origin,Access-Control-Allow-Methods access-control-allow-methods * access-control-allow-origin * access-control-max-age 86400 cache-control public, max-age=86400 date Mon, 30 Dec 2024 05:26:53 GMT server awselb/2.0 vary Access-Control-Request-Headers, Origin, Access-Control-Request-Method
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	138ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=ni%3Aepsv&q=%7B%22or%22%3A%22%22%2C%22nr%22%3A%22%22%2C%22orl%22%3A328%2C%22nrl%22%3A209%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22match%22%3Atrue%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	200	v v.eps.6sc.co/ Frame	0 0	136ms 135ms	Preflight application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token access-control-allow-methods OPTIONS,POST access-control-allow-origin * content-length 0 content-type application/json date Mon, 30 Dec 2024 05:26:53 GMT via 1.1 ea1aadbeedf1001a86f79fc729fb39e0.cloudfront.net (CloudFront) x-amz-apigw-id DlxMsH-jIAMEJng= x-amz-cf-id _EVQpJf-fWLqmCrsNBzhFsDlwOav0P-wvIxeffvhBkGyMOCHM_5zmQ== x-amz-cf-pop FRA60-P10 x-amzn-requestid b5f1ca07-686e-4d1d-8716-711bfcc9a420 x-cache Miss from cloudfront
POST H2	200	v Show response v.eps.6sc.co/	12 B 519 B	196ms 192ms	XHR application/json	13.35.58.23 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://v.eps.6sc.co/v Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.35.58.23 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-35-58-23.fra60.r.cloudfront.net Software / Resource Hash 512a4f403d30a587ad5ab0b9fa7b2fd4f078249ee03f9c23c445332838f6a436 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-type application/json Referer https://www.cyberhaven.com/ Response headers x-amz-apigw-id DlxMtGRNoAMEOcA= x-amzn-trace-id Root=1-67722f1d-3b311d387d85a9cb23c5b9ac;Parent=5b5b6aacf96c3a52;Sampled=0;Lineage=1:56167173:0 access-control-allow-methods OPTIONS,POST x-amzn-requestid 7179de47-f4fc-498f-9016-1e3ef4c2af15 via 1.1 ea1aadbeedf1001a86f79fc729fb39e0.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront content-length 12 x-amz-cf-id aBtvA56DZhr7CMM2y2wxxJb7GO3LdW70v9jfGjGMMaLQ9oLl777k4g== date Mon, 30 Dec 2024 05:26:53 GMT content-type application/json x-amz-cf-pop FRA60-P10 access-control-allow-headers Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	138ms 138ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=6sense-temp-analytics&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=https%3A%2F%2Feps.6sc.co&q=%7B%22name%22%3A%22https%3A%2F%2Feps.6sc.co%2Fv3%2Fcompany%2Fdetails%22%2C%22entryType%22%3A%22resource%22%2C%22startTime%22%3A1735.0999999046326%2C%22duration%22%3A209.09999990463257%2C%22initiatorType%22%3A%22fetch%22%2C%22deliveryType%22%3A%22%22%2C%22nextHopProtocol%22%3A%22%22%2C%22renderBlockingStatus%22%3A%22non-blocking%22%2C%22workerStart%22%3A0%2C%22redirectStart%22%3A0%2C%22redirectEnd%22%3A0%2C%22fetchStart%22%3A1735.0999999046326%2C%22domainLookupStart%22%3A0%2C%22domainLookupEnd%22%3A0%2C%22connectStart%22%3A0%2C%22secureConnectionStart%22%3A0%2C%22connectEnd%22%3A0%2C%22requestStart%22%3A0%2C%22responseStart%22%3A0%2C%22firstInterimResponseStart%22%3A0%2C%22responseEnd%22%3A1944.1999998092651%2C%22transferSize%22%3A0%2C%22encodedBodySize%22%3A0%2C%22decodedBodySize%22%3A0%2C%22responseStatus%22%3A200%2C%22serverTiming%22%3A%5B%5D%2C%22metadata%22%3A%7B%22region%22%3A%22header-blocked%22%2C%22ores%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%2C%22nres%22%3A%22%7B%5C%22company%5C%22%3A%7B%5C%22domain%5C%22%3A%5C%22%5C%22%2C%5C%22name%5C%22%3A%5C%22%5C%22%2C%5C%22region%5C%22%3A%5C%22%5C%22%2C%5C%22country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22industry%5C%22%3A%5C%22%5C%22%2C%5C%22companyId%5C%22%3A%5C%22%5C%22%2C%5C%22country_iso_code%5C%22%3A%5C%22IT%5C%22%2C%5C%22address%5C%22%3A%5C%22%5C%22%2C%5C%22zip%5C%22%3A%5C%22%5C%22%2C%5C%22phone%5C%22%3A%5C%22%5C%22%2C%5C%22employee_range%5C%22%3A%5C%22%5C%22%2C%5C%22revenue_range%5C%22%3A%5C%22%5C%22%2C%5C%22employee_count%5C%22%3A%5C%22%5C%22%2C%5C%22annual_revenue%5C%22%3A%5C%22%5C%22%2C%5C%22is_blacklisted%5C%22%3Afalse%2C%5C%22state_code%5C%22%3A%5C%22%5C%22%2C%5C%22is_6qa%5C%22%3Afalse%2C%5C%22geoIP_country%5C%22%3A%5C%22Italy%5C%22%2C%5C%22geoIP_state%5C%22%3A%5C%22Lombardy%5C%22%2C%5C%22geoIP_city%5C%22%3A%5C%22Milan%5C%22%2C%5C%22company_match%5C%22%3A%5C%22Non-actionable%20Match%5C%22%2C%5C%22additional_comment%5C%22%3A%5C%22There%20is%20no%20valid%20B2B%20use%20case%20as%20this%20was%20matched%20to%20something%20other%20than%20a%20company%20name%2Fdomain%20(i.e.%20bot%2C%20host%2C%20noisy%20signal%2C%20etc.)%5C%22%2C%5C%22industry_v2%5C%22%3A%5B%5D%2C%5C%22sic%5C%22%3A%5C%22%5C%22%2C%5C%22sic_description%5C%22%3A%5C%22%5C%22%2C%5C%22naics%5C%22%3A%5C%22%5C%22%2C%5C%22naics_description%5C%22%3A%5C%22%5C%22%7D%2C%5C%22scores%5C%22%3A%5B%5D%2C%5C%22segments%5C%22%3A%7B%5C%22ids%5C%22%3A%5B%5D%2C%5C%22names%5C%22%3A%5B%5D%2C%5C%22list%5C%22%3A%5B%5D%7D%2C%5C%22confidence%5C%22%3A%5C%22NA%5C%22%7D%22%7D%7D&isIframe=false&m=%7B%22endpoint%22%3A%22epsilon.6sense.com%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=&d=1&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:53 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:53 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
POST H3	200	sessions.createSession Show response opps-api.getwarmly.com/api/sessions/trpc/	2 KB 2 KB	291ms 238ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 50f5a4d68dad5d5a0833db0cb2932521e4fe251fe6692de3eab90103bb7946e6 Request headers x-warmly-user-identifier x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 02185b19-be52-4719-a9d4-1860ff2f992e X-Warmly-Target session-server User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2089 date Mon, 30 Dec 2024 05:26:54 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	sessions.createSession opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	255ms 159ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 05:26:53 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		29587bfc-a384-42e3-92db-0ec5dec87cdd https://www.cyberhaven.com/ Frame	0 0
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	190ms 189ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A52%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f02dad-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:54 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:54 GMT content-type image/gif last-modified Sat, 18 Feb 2023 01:45:17 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	204	sessions.trackScriptAdded opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	155ms 155ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 05:26:54 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		cs a.usbrowserspeed.com/	0 0
POST H3	200	sessions.trackScriptAdded Show response opps-api.getwarmly.com/api/sessions/trpc/	65 B 82 B	173ms 171ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 02185b19-be52-4719-a9d4-1860ff2f992e content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Mon, 30 Dec 2024 05:26:54 GMT content-type application/json; charset=utf-8 vary Origin
GET H3	200	chat.getMessages Show response opps-api.getwarmly.com/api/sessions/trpc/	31 B 47 B	172ms 172ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%2254431145-e11a-4716-8f47-c7158f76bfc8%22%7D%7D Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 2485e74dd82a729476c358bb9ad59c0322ee42bfeeac9805606cb9da39a47f98 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 02185b19-be52-4719-a9d4-1860ff2f992e content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 date Mon, 30 Dec 2024 05:26:54 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	chat.getMessages opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	158ms 158ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%2254431145-e11a-4716-8f47-c7158f76bfc8%22%7D%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 05:26:54 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	138ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A53%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%222001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:54 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:54 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
POST H3	200	sessions.updateHubspotUserToken Show response opps-api.getwarmly.com/api/sessions/trpc/	33 B 49 B	167ms 166ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash ded6935dc09c7888de1b41c8ab7cebf82223c044f9eced4628c8236962fec3c5 Request headers x-warmly-session-id 54431145-e11a-4716-8f47-c7158f76bfc8 x-warmly-user-identifier c8b10d50-ccfc-40a1-bc91-cb42ee9bc9bc x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 02185b19-be52-4719-a9d4-1860ff2f992e X-Warmly-Target session-server x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33 date Mon, 30 Dec 2024 05:26:55 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.updateHubspotUserToken opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	158ms 158ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Mon, 30 Dec 2024 05:26:55 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
POST H2	200	/ Show response us.i.posthog.com/s/	15 B 248 B	1177ms 1165ms	Fetch application/json	35.172.42.21 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/s/?ip=1&_=1735536415748&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.172.42.21 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-35-172-42-21.compute-1.amazonaws.com Software envoy / Resource Hash 0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers x-envoy-upstream-service-time 815 access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 15 date Mon, 30 Dec 2024 05:26:56 GMT content-type application/json vary origin, access-control-request-method, access-control-request-headers server envoy
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	146ms 146ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A54%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:55 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:55 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	137ms 137ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:56 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:56 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	139ms 139ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=5eb6cea4-3cf6-4fe2-8905-b7e0633b3954&session=bd1495e3-8ce1-4f84-8eb7-baab912f8646&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2030%20Dec%202024%2005%3A26%3A56%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=e8f00644-3d37-45d6-859c-8ea1881be39d&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A12&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Mon, 30 Dec 2024 05:26:57 GMT accept-ranges bytes content-length 43 date Mon, 30 Dec 2024 05:26:57 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/159e3174-424e-4dca-a504-c34daa29c0fc

Domain

www.cyberhaven.com

URL

blob:https://www.cyberhaven.com/29587bfc-a384-42e3-92db-0ec5dec87cdd

Domain

a.usbrowserspeed.com

URL

https://a.usbrowserspeed.com/cs?pid=4dd5c5fae59ce3249cf6f13469fbc883b27c8135ce5092e6a3b38092dc07d387&puid=54431145-e11a-4716-8f47-c7158f76bfc8&r=%0A%20%20%20%20https%3A%2F%2Fapi.immagnify.com%2Fv1%2Fintegrations%2Ffxf%2Fwebhook%2FkhlFEhkHvc%3Fhem%3D%24%7BHEM_SHA256_LOWERCASE%7D%26up_id%3D%24%7BUP_ID%7D%26puid%3D54431145-e11a-4716-8f47-c7158f76bfc8%26ip%3D%24%7BIP%7D%0A%20%20