URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Submission: On August 02 via api from DE — Scanned from DE

Summary

This website contacted 73 IPs in 9 countries across 61 domains to perform 222 HTTP transactions. The main IP is 2a02:e980:107::cf, located in United States and belongs to INCAPSULA, US. The main domain is www.proofpoint.com. The Cisco Umbrella rank of the primary domain is 180370.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on April 25th 2022. Valid for: a year.
This is the only time www.proofpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
21 2a02:e980:107... 19551 (INCAPSULA)
1 2a00:1450:400... 15169 (GOOGLE)
7 104.16.95.80 13335 (CLOUDFLAR...)
2 142.250.185.226 15169 (GOOGLE)
2 2606:4700:440... 13335 (CLOUDFLAR...)
2 23.205.237.4 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 143.204.89.30 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 192.28.144.124 15224 (OMNITURE)
3 23.47.212.127 16625 (AKAMAI-AS)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
1 199.232.188.157 54113 (FASTLY)
1 18.66.139.80 16509 (AMAZON-02)
2 2a02:26f0:350... 20940 (AKAMAI-ASN1)
4 6 52.17.151.21 16509 (AMAZON-02)
2 34.96.102.137 15169 (GOOGLE)
5 2606:4700:440... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
2 4 142.250.186.38 15169 (GOOGLE)
62 143.204.89.91 16509 (AMAZON-02)
1 51.11.20.152 8075 (MICROSOFT...)
3 2a03:2880:f00... 32934 (FACEBOOK)
1 2606:4700:440... 13335 (CLOUDFLAR...)
10 104.103.80.163 16625 (AKAMAI-AS)
2 8 2600:9000:215... 16509 (AMAZON-02)
1 1 68.67.153.60 29990 (ASN-APPNEX)
2 3 37.252.173.62 29990 (ASN-APPNEX)
1 2600:9000:215... 16509 (AMAZON-02)
1 1 216.200.122.11 6461 (ZAYO-6461)
2 2 142.250.186.70 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 158.255.109.19 8218 (NEO-ASN l...)
1 52.45.183.32 14618 (AMAZON-AES)
2 143.204.89.101 16509 (AMAZON-02)
2 2 52.209.232.242 16509 (AMAZON-02)
1 2 52.222.214.106 16509 (AMAZON-02)
1 35.244.174.68 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
6 6 2620:1ec:21::14 8068 (MICROSOFT...)
2 13.107.42.14 8068 (MICROSOFT...)
2 104.244.42.133 13414 (TWITTER)
2 104.244.42.67 13414 (TWITTER)
1 143.204.89.5 16509 (AMAZON-02)
1 143.204.89.27 16509 (AMAZON-02)
1 23.47.209.169 16625 (AKAMAI-AS)
2 2620:1ec:27::... 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
1 108.138.17.46 16509 (AMAZON-02)
1 92.123.37.164 16625 (AKAMAI-AS)
1 66.155.71.150 13768 (COGECO-PEER1)
2 3 18.193.145.56 16509 (AMAZON-02)
1 77.245.57.72 36057 (WEBAIR-IN...)
1 206.19.49.24 17225 (ATT-CERFN...)
12 15 52.16.111.147 16509 (AMAZON-02)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 2a03:2880:f10... 32934 (FACEBOOK)
2 3.124.147.191 16509 (AMAZON-02)
1 1 104.18.19.126 13335 (CLOUDFLAR...)
1 104.18.18.126 13335 (CLOUDFLAR...)
1 69.173.144.139 26667 (RUBICONPR...)
1 64.202.112.191 22075 (AS-OUTBRAIN)
1 185.64.189.110 62713 (AS-PUBMATIC)
1 3.126.56.137 16509 (AMAZON-02)
1 141.226.228.48 200478 (TABOOLA-AS)
1 13.248.245.213 16509 (AMAZON-02)
1 37.252.172.37 29990 (ASN-APPNEX)
1 35.244.159.8 15169 (GOOGLE)
1 1 142.250.185.130 15169 (GOOGLE)
3 20.120.124.64 8075 (MICROSOFT...)
1 151.101.66.137 54113 (FASTLY)
1 2 20.234.93.27 8075 (MICROSOFT...)
1 162.247.241.14 23467 (NEWRELIC-...)
4 3.94.218.138 14618 (AMAZON-AES)
2 34.193.113.164 14618 (AMAZON-AES)
222 73
Apex Domain
Subdomains
Transfer
62 driftt.com
js.driftt.com — Cisco Umbrella Rank: 5982
723 KB
23 adroll.com
s.adroll.com — Cisco Umbrella Rank: 2537
d.adroll.com — Cisco Umbrella Rank: 1677
34 KB
21 proofpoint.com
www.proofpoint.com — Cisco Umbrella Rank: 180370
3 MB
11 6sc.co
j.6sc.co — Cisco Umbrella Rank: 8102
c.6sc.co — Cisco Umbrella Rank: 11919
ipv6.6sc.co — Cisco Umbrella Rank: 8382
b.6sc.co — Cisco Umbrella Rank: 5215
17 KB
10 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 63
4788165.fls.doubleclick.net — Cisco Umbrella Rank: 569878
10487471.fls.doubleclick.net — Cisco Umbrella Rank: 585819
ad.doubleclick.net — Cisco Umbrella Rank: 218
stats.g.doubleclick.net — Cisco Umbrella Rank: 131
cm.g.doubleclick.net — Cisco Umbrella Rank: 223
7 KB
8 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 418
www.linkedin.com — Cisco Umbrella Rank: 530
px4.ads.linkedin.com — Cisco Umbrella Rank: 5809
6 KB
7 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 588
m.clarity.ms — Cisco Umbrella Rank: 5686
c.clarity.ms — Cisco Umbrella Rank: 1116
26 KB
7 marketo.com
app-abj.marketo.com — Cisco Umbrella Rank: 640716
143 KB
6 drift.com
metrics.api.drift.com — Cisco Umbrella Rank: 6553
bootstrap.api.drift.com — Cisco Umbrella Rank: 6919
487 B
6 google.com
www.google.com — Cisco Umbrella Rank: 15
adservice.google.com — Cisco Umbrella Rank: 104
1 KB
5 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 9493
4 KB
5 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 61
region1.google-analytics.com — Cisco Umbrella Rank: 2533
20 KB
4 company-target.com
api.company-target.com — Cisco Umbrella Rank: 3630
segments.company-target.com — Cisco Umbrella Rank: 1317
3 KB
4 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 521
ib.adnxs.com — Cisco Umbrella Rank: 254
4 KB
4 avct.cloud
ads.avct.cloud — Cisco Umbrella Rank: 3174
2 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 396
c.bing.com — Cisco Umbrella Rank: 231
13 KB
3 facebook.com
www.facebook.com — Cisco Umbrella Rank: 98
474 B
3 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 314
2 KB
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 160
195 KB
3 reactful.com
visitor.reactful.com — Cisco Umbrella Rank: 114698
106 KB
3 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 691
script.hotjar.com — Cisco Umbrella Rank: 864
vars.hotjar.com — Cisco Umbrella Rank: 886
68 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 4674
675 B
3 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 1645
m.addthis.com — Cisco Umbrella Rank: 1577
141 KB
3 demandbase.com
scripts.demandbase.com — Cisco Umbrella Rank: 6571
tag.demandbase.com — Cisco Umbrella Rank: 5197
82 KB
2 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 584
r.casalemedia.com — Cisco Umbrella Rank: 743
2 KB
2 6sense.com
epsilon.6sense.com — Cisco Umbrella Rank: 12495
823 B
2 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 555
553 B
2 t.co
t.co — Cisco Umbrella Rank: 460
525 B
2 bidr.io
match.prod.bidr.io — Cisco Umbrella Rank: 537
1019 B
2 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 16563
apt.techtarget.com — Cisco Umbrella Rank: 21256
2 KB
2 visualwebsiteoptimizer.com
dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 5420
2 KB
2 avocet.io
ads.avocet.io — Cisco Umbrella Rank: 4594
280 B
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 891
6 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 100
169 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3875
6 KB
2 geoip-js.com
geoip-js.com — Cisco Umbrella Rank: 14070
2 KB
2 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 134
32 KB
1 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 305
711 B
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 470
14 KB
1 openx.net
us-u.openx.net — Cisco Umbrella Rank: 420
273 B
1 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 437
140 B
1 taboola.com
sync.taboola.com — Cisco Umbrella Rank: 1075
90 B
1 yahoo.com
ups.analytics.yahoo.com — Cisco Umbrella Rank: 291
124 B
1 pubmatic.com
image2.pubmatic.com — Cisco Umbrella Rank: 1039
493 B
1 outbrain.com
sync.outbrain.com — Cisco Umbrella Rank: 722
308 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 359
239 B
1 convergeselect.net
cpm.convergeselect.net — Cisco Umbrella Rank: 102455
228 B
1 sitescout.com
pixel.sitescout.com — Cisco Umbrella Rank: 3697
267 B
1 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 1099
550 B
1 moatads.com
z.moatads.com — Cisco Umbrella Rank: 455
1 KB
1 rlcdn.com
id.rlcdn.com — Cisco Umbrella Rank: 661
98 B
1 adxcel-ec2.com
data.adxcel-ec2.com — Cisco Umbrella Rank: 3368
131 B
1 accountinsight.cloud
track.accountinsight.cloud — Cisco Umbrella Rank: 253666
259 B
1 gwmtracking.com
gwmtracking.com — Cisco Umbrella Rank: 15666
389 B
1 ml-api.io
attr.ml-api.io — Cisco Umbrella Rank: 19163
242 B
1 ml-attr.com
s.ml-attr.com — Cisco Umbrella Rank: 15828
279 B
1 chip2gift.com
secure.chip2gift.com — Cisco Umbrella Rank: 435790
304 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 684
15 KB
1 mktoresp.com
309-rhv-619.mktoresp.com — Cisco Umbrella Rank: 469535
318 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 73
1 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1352
43 KB
222 61
Domain Requested by
62 js.driftt.com www.proofpoint.com
js.driftt.com
21 www.proofpoint.com www.proofpoint.com
15 d.adroll.com 12 redirects s.adroll.com
www.proofpoint.com
8 b.6sc.co www.proofpoint.com
8 s.adroll.com 2 redirects www.googletagmanager.com
www.proofpoint.com
s.adroll.com
d.adroll.com
7 app-abj.marketo.com www.proofpoint.com
app-abj.marketo.com
5 tracking.g2crowd.com www.proofpoint.com
4 metrics.api.drift.com js.driftt.com
4 px.ads.linkedin.com 4 redirects
4 ads.avct.cloud 2 redirects www.proofpoint.com
4 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
www.proofpoint.com
3 m.clarity.ms www.clarity.ms
3 www.facebook.com www.proofpoint.com
3 x.bidswitch.net 2 redirects www.proofpoint.com
3 adservice.google.com www.proofpoint.com
4788165.fls.doubleclick.net
10487471.fls.doubleclick.net
3 secure.adnxs.com 2 redirects j.6sc.co
3 connect.facebook.net www.proofpoint.com
connect.facebook.net
3 visitor.reactful.com www.proofpoint.com
visitor.reactful.com
3 bat.bing.com www.googletagmanager.com
bat.bing.com
www.proofpoint.com
3 www.google.de www.proofpoint.com
3 www.google.com www.proofpoint.com
2 bootstrap.api.drift.com js.driftt.com
2 c.clarity.ms 1 redirects
2 epsilon.6sense.com j.6sc.co
2 www.clarity.ms bat.bing.com
www.clarity.ms
2 analytics.twitter.com www.proofpoint.com
2 t.co www.proofpoint.com
2 px4.ads.linkedin.com www.proofpoint.com
10487471.fls.doubleclick.net
2 www.linkedin.com 2 redirects
2 segments.company-target.com 1 redirects www.proofpoint.com
2 match.prod.bidr.io 2 redirects
2 api.company-target.com scripts.demandbase.com
js.driftt.com
2 ad.doubleclick.net 2 redirects
2 10487471.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 4788165.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 dev.visualwebsiteoptimizer.com www.proofpoint.com
2 ads.avocet.io 2 redirects
2 snap.licdn.com www.proofpoint.com
10487471.fls.doubleclick.net
2 s7.addthis.com www.proofpoint.com
s7.addthis.com
2 googleads.g.doubleclick.net www.googleadservices.com
2 scripts.demandbase.com www.proofpoint.com
tag.demandbase.com
2 www.googletagmanager.com www.proofpoint.com
www.googletagmanager.com
2 munchkin.marketo.net www.proofpoint.com
munchkin.marketo.net
2 geoip-js.com www.proofpoint.com
geoip-js.com
2 www.googleadservices.com www.proofpoint.com
www.googletagmanager.com
1 bam.nr-data.net js-agent.newrelic.com
1 c.bing.com 1 redirects
1 m.addthis.com s7.addthis.com
1 js-agent.newrelic.com www.proofpoint.com
1 cm.g.doubleclick.net 1 redirects
1 us-u.openx.net www.proofpoint.com
1 ib.adnxs.com www.proofpoint.com
1 eb2.3lift.com www.proofpoint.com
1 sync.taboola.com www.proofpoint.com
1 ups.analytics.yahoo.com www.proofpoint.com
1 image2.pubmatic.com www.proofpoint.com
1 sync.outbrain.com www.proofpoint.com
1 pixel.rubiconproject.com www.proofpoint.com
1 r.casalemedia.com www.proofpoint.com
1 dsum-sec.casalemedia.com 1 redirects
1 ipv6.6sc.co j.6sc.co
1 c.6sc.co j.6sc.co
1 apt.techtarget.com www.proofpoint.com
1 cpm.convergeselect.net www.proofpoint.com
1 pixel.sitescout.com 10487471.fls.doubleclick.net
1 pixel.mathtag.com 4788165.fls.doubleclick.net
1 tag.demandbase.com scripts.demandbase.com
1 stats.g.doubleclick.net www.google-analytics.com
1 z.moatads.com s7.addthis.com
1 vars.hotjar.com static.hotjar.com
1 script.hotjar.com static.hotjar.com
1 region1.google-analytics.com www.googletagmanager.com
1 id.rlcdn.com www.proofpoint.com
1 data.adxcel-ec2.com www.proofpoint.com
1 track.accountinsight.cloud www.proofpoint.com
1 gwmtracking.com 1 redirects
1 attr.ml-api.io www.proofpoint.com
1 s.ml-attr.com 1 redirects
1 j.6sc.co www.proofpoint.com
1 trk.techtarget.com www.proofpoint.com
1 secure.chip2gift.com www.googletagmanager.com
1 static.hotjar.com www.googletagmanager.com
1 static.ads-twitter.com www.googletagmanager.com
1 309-rhv-619.mktoresp.com munchkin.marketo.net
1 fonts.googleapis.com www.proofpoint.com
1 www.googleoptimize.com www.proofpoint.com
222 86
Subject Issuer Validity Valid
proofpoint.com
Sectigo RSA Organization Validation Secure Server CA
2022-04-25 -
2023-04-25
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
app-abj.marketo.com
Cloudflare Inc ECC CA-3
2022-05-05 -
2023-05-05
a year crt.sh
www.googleadservices.com
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-16 -
2023-06-16
a year crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
tag.demandbase.com
Go Daddy Secure Certificate Authority - G2
2021-10-18 -
2022-10-14
a year crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
odc-addthis-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
www.google.com
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
www.google.de
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2022-06-10 -
2022-12-10
6 months crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-22 -
2023-08-22
a year crt.sh
*.hotjar.com
Amazon
2021-11-25 -
2022-12-23
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
*.visualwebsiteoptimizer.com
Starfield Secure Certificate Authority - G2
2022-07-04 -
2023-08-05
a year crt.sh
*.g2crowd.com
Sectigo ECC Domain Validation Secure Server CA
2021-08-30 -
2022-09-28
a year crt.sh
*.reactful.com
Go Daddy Secure Certificate Authority - G2
2022-05-11 -
2023-05-09
a year crt.sh
*.doubleclick.net
GTS CA 1C3
2022-07-18 -
2022-10-10
3 months crt.sh
drift.com
Amazon
2021-09-08 -
2022-10-07
a year crt.sh
secure.norm0care.com
Sectigo RSA Domain Validation Secure Server CA
2022-06-13 -
2023-06-13
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-05-11 -
2022-08-09
3 months crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
s.adroll.com
Amazon
2022-07-03 -
2023-08-01
a year crt.sh
*.accountinsight.cloud
Sectigo RSA Domain Validation Secure Server CA
2022-06-10 -
2023-06-26
a year crt.sh
adxcel-ec2.com
Amazon
2021-11-17 -
2022-12-16
a year crt.sh
api.demandbase.com
Go Daddy Secure Certificate Authority - G2
2021-10-20 -
2022-09-26
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2022-02-03 -
2023-02-25
a year crt.sh
*.google.com
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
*.google.de
GTS CA 1C3
2022-07-11 -
2022-10-03
3 months crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-11-27 -
2022-11-29
a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2022-02-27 -
2023-02-27
a year crt.sh
pixel.mathtag.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-05 -
2023-07-05
a year crt.sh
*.sitescout.com
GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1
2021-12-15 -
2023-01-15
a year crt.sh
*.techtarget.com
Sectigo RSA Domain Validation Secure Server CA
2021-10-13 -
2022-11-12
a year crt.sh
adroll.mgr.consensu.org
Amazon
2021-09-09 -
2022-10-08
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
*.6sense.com
Amazon
2022-05-31 -
2023-06-29
a year crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 02
2022-06-07 -
2023-06-02
a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2022 Q2
2022-07-10 -
2023-08-11
a year crt.sh
*.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1
2022-01-10 -
2023-02-10
a year crt.sh

This page contains 10 frames:

Primary Page: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Frame ID: 2C82056ECC767A236A1180D418E31234
Requests: 159 HTTP requests in this frame

Frame: https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716
Frame ID: 4CA30A2D9739C9210FE22672186208A9
Requests: 3 HTTP requests in this frame

Frame: https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Frame ID: 32389256CC4F8B9DAAFBC2A1F15672EC
Requests: 5 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-54d18b2ccd1c7fa42c71f18525ba4ad0.html
Frame ID: 5FF70F924C408D3B8B62A12E5BD2CC1B
Requests: 1 HTTP requests in this frame

Frame: https://app-abj.marketo.com/index.php/form/XDFrame
Frame ID: BD6CD11C9BA055B10F7B2F7F8C5CF500
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: C22CFCCA9380B24FC3D3F8966AB86971
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Frame ID: F04335D21F018BD918C820E1A5E626DC
Requests: 32 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Frame ID: C813E424D8DDAC9B49149CAB1FA1F82B
Requests: 32 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 7E750E52BABEF86C97344E236CEE6208
Requests: 1 HTTP requests in this frame

Frame: https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Frame ID: 4FBBBF21BF90FE33E7E796EABEA14065
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities | Proofpoint USFacebookTwitterLinkedInEmail

Detected technologies

Overall confidence: 75%
Detected patterns

Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • marketo\.\w+/js/forms(?:[\d.]+)/js/forms([\d.]+)\.min\.js

Overall confidence: 100%
Detected patterns
  • moatads\.com

Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

222
Requests

89 %
HTTPS

30 %
IPv6

61
Domains

86
Subdomains

73
IPs

9
Countries

5135 kB
Transfer

11896 kB
Size

78
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j HTTP 307
  • https://ads.avct.cloud/s?r=1&add=5aba5f53ab79f7f51390a95a&ty=j HTTP 307
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
Request Chain 74
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j HTTP 307
  • https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j HTTP 307
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5d1dcad3b00320110090d553&ty=j
Request Chain 75
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716 HTTP 302
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716
Request Chain 82
  • https://10487471.fls.doubleclick.net/activityi;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities HTTP 302
  • https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Request Chain 83
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 302
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID HTTP 307
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID HTTP 302
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=9006202609544540301
Request Chain 84
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=551295332 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 88
  • https://match.prod.bidr.io/cookie-sync/demandbase HTTP 303
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1 HTTP 303
  • https://segments.company-target.com/log?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA HTTP 303
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA&verifyHash=610c6518d285b8f7e33549b5af09262e1b6f8d61
Request Chain 92
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%252C3976212%26time%3D1659452604180%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252Fus%252Fblog%252Fthreat-insight%252Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&liSync=true&e_ipv6=AQLE9dFU6PlkBwAAAYJfFULNPIo34l8rvGmXAi_XYRPIf032zfmQ8zKoG9AYC6zWF8cW6F6I
Request Chain 114
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 115
  • https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 120
  • https://x.bidswitch.net/sync?dsp_id=59&user_group=2&user_id=55bf37a7-f069-44f6-b3e2-9ebe84eb409b HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=59&user_group=2&user_id=55bf37a7-f069-44f6-b3e2-9ebe84eb409b HTTP 302
  • https://cpm.convergeselect.net/user-sync?dsp=328334&t=image&gdpr=&gdpr_consent=&uid=9ba72ed6-f9a0-4c29-ae6c-fb2d0820fd9b
Request Chain 122
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2782676%26time%3D1659452604598%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252F%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQLZ8IsFlEhXdgAAAYJfFUKEwvbbQngtGJt_-036Jqas84m3hPhGMsypMCe5XpDD0W22B7W5
Request Chain 141
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pv=48954637277.48699&cookie=&adroll_s_ref=&keyw= HTTP 302
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Request Chain 145
  • https://d.adroll.com/cm/index/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605 HTTP 302
  • https://r.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605&C=1
Request Chain 146
  • https://d.adroll.com/cm/n/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expires=365
Request Chain 147
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Request Chain 148
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 149
  • https://d.adroll.com/cm/r/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 150
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Request Chain 151
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&dongle=c85e
Request Chain 152
  • https://d.adroll.com/cm/b/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Request Chain 153
  • https://d.adroll.com/cm/x/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Request Chain 155
  • https://d.adroll.com/cm/o/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=a936ea965ec8b6ed963497c3f8cd95bf&gdpr=1&gdpr_consent=
Request Chain 156
  • https://d.adroll.com/cm/g/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=qTbqll7Itu2WNJfD-M2Vvw HTTP 302
  • https://d.adroll.com/cm/g/in
Request Chain 166
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&RedC=c.clarity.ms&MXFR=03C31C27B30A61260A890DD3B70A6F91 HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&MUID=30124BC6A04E6247140B5A32A19C6347

222 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
www.proofpoint.com/us/blog/threat-insight/
84 KB
21 KB
Document
General
Full URL
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
abc6c562c5e759ee6f1e642cc6a864ed683e537c85e28c497f16a123c1873dcd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
max-age=86261, public
Content-Encoding
gzip
Content-Length
20214
Content-Type
text/html; charset=UTF-8
Date
Tue, 02 Aug 2022 15:03:22 GMT
Etag
"1659398512"
Expires
Wed, 03 Aug 2022 15:01:03 GMT
Feature-Policy
geolocation 'self'
Last-Modified
Tue, 02 Aug 2022 00:01:52 GMT
Referrer-Policy
origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-CDN
Imperva
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 32) q(0 -1 -1 4) r(0 -1)
X-Permitted-Cross-Domain-Policies
none
optimize.js
www.googleoptimize.com/
114 KB
43 KB
Script
General
Full URL
https://www.googleoptimize.com/optimize.js?id=GTM-KKGL4NZ
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5dbe6afdce11b34fe60f255161e8625e1cc78f7a7f680c5f620b1a603872de0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
43840
x-xss-protection
0
expires
Tue, 02 Aug 2022 15:03:23 GMT
proofpoint.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
18 KB
18 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"01c16c31"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
14-102858190-0 0CNN RT(1659452602817 12) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=128388, public
Content-Length
18296
Expires
Thu, 04 Aug 2022 02:43:10 GMT
RobotoCondensed-Regular-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Regular-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"39ed386e"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
2-8960560-0 0CNN RT(1659452602818 12) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=121782, public
Content-Length
21036
Expires
Thu, 04 Aug 2022 00:53:04 GMT
fjalla-one-v7-latin-regular.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
20 KB
20 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 09:53:20 GMT
X-CDN
Imperva
Etag
"3a88d25f"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
14-102858191-0 0CNN RT(1659452602818 16) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=121782, public
Content-Length
19976
Expires
Thu, 04 Aug 2022 00:53:04 GMT
fjalla-one-v7-latin-regular.woff2
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
16 KB
17 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff2
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"80852160"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
4-25385198-0 0CNN RT(1659452602818 12) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=128389, public
Content-Length
16540
Expires
Thu, 04 Aug 2022 02:43:11 GMT
RobotoCondensed-Bold-webfont.woff
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/
21 KB
21 KB
Font
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Bold-webfont.woff
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Origin
https://www.proofpoint.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"8df65834"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
1-4760663-0 0CNN RT(1659452602818 13) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=121782, public
Content-Length
21384
Expires
Thu, 04 Aug 2022 00:53:04 GMT
css_9u0o5eJuu6TGwZMprqQy-6DGTA-fv7Mh1BBQctJUE2M.css
www.proofpoint.com/sites/default/files/css/
25 KB
5 KB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_9u0o5eJuu6TGwZMprqQy-6DGTA-fv7Mh1BBQctJUE2M.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
f6ed28e5e26ebba4c6c19329aea432fba0c64c0f9fbfb321d4105072d2541363
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 17 Jul 2022 06:17:11 GMT
X-CDN
Imperva
Etag
"032a9b05"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 54) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=121782, public
Content-Length
4376
Expires
Thu, 04 Aug 2022 00:53:04 GMT
css_0uDpo4qmDSIxZjtjObFLJ6sn8xtKQuQfdACDeFKUh6Y.css
www.proofpoint.com/sites/default/files/css/
3 MB
1 MB
Stylesheet
General
Full URL
https://www.proofpoint.com/sites/default/files/css/css_0uDpo4qmDSIxZjtjObFLJ6sn8xtKQuQfdACDeFKUh6Y.css
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
d2e0e9a38aa60d2231663b6339b14b27ab27f31b4a42e41f74008378529487a6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 29 Jul 2022 00:25:46 GMT
X-CDN
Imperva
Etag
"955de9b2"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/css
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 74) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=813335, public
Content-Length
1199549
Expires
Fri, 12 Aug 2022 00:58:57 GMT
modernizr.min.js
www.proofpoint.com/modules/custom/pp_theme/js/
5 KB
3 KB
Script
General
Full URL
https://www.proofpoint.com/modules/custom/pp_theme/js/modernizr.min.js?v=3.11.7
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
084390577243b6986d5564d152916a37a3124305e11b2817d0c2eabc863e081b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 03 Feb 2021 00:23:16 GMT
X-CDN
Imperva
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript
X-Iinfo
2-8960560-0 0CNN RT(1659452602818 45) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=121783, public
Content-Length
2533
Expires
Thu, 04 Aug 2022 00:53:05 GMT
modernizr-additional-tests.js
www.proofpoint.com/core/misc/
652 B
870 B
Script
General
Full URL
https://www.proofpoint.com/core/misc/modernizr-additional-tests.js?v=3.11.7
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9b7b5d56054f5bab6ea5dfd9472ceb900f406a8a35a3df5b17b606521a411a35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:22 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 28 Oct 2021 00:38:28 GMT
X-CDN
Imperva
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
application/javascript
X-Iinfo
14-102858190-0 0CNN RT(1659452602817 66) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=125930, public
Content-Length
411
Expires
Thu, 04 Aug 2022 02:02:12 GMT
logo-reg.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
3 KB
2 KB
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/logo-reg.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 08:56:17 GMT
X-CDN
Imperva
Etag
"13fdd2ef"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/svg+xml
X-Iinfo
2-8960560-0 0CNN RT(1659452602818 485) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=128389, public
Content-Length
1124
Expires
Thu, 04 Aug 2022 02:43:12 GMT
ransomware-nav-promo.png
www.proofpoint.com/sites/default/files/nav-promo-images/
607 KB
607 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/nav-promo-images/ransomware-nav-promo.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
9732077979c7e132e29da395c2788f43f6dd4ab3020b0c0c539744be21339507
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Jan 2022 06:01:51 GMT
X-CDN
Imperva
Etag
"7124de60"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
14-102858191-0 0CNN RT(1659452602818 488) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=126014, public
Content-Length
621607
Expires
Thu, 04 Aug 2022 02:03:37 GMT
home.svg
www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/
784 B
943 B
Image
General
Full URL
https://www.proofpoint.com/themes/custom/proofpoint/dist/app-drupal/assets/home.svg
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sat, 02 Jan 2021 09:53:20 GMT
X-CDN
Imperva
Etag
"4c25cdee"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/svg+xml
X-Iinfo
1-4760663-0 0CNN RT(1659452602818 485) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=128389, public
Content-Length
477
Expires
Thu, 04 Aug 2022 02:43:12 GMT
bitcoin1small.webp
www.proofpoint.com/sites/default/files/styles/image_1920_400/public/images/Blog/
143 KB
144 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/styles/image_1920_400/public/images/Blog/bitcoin1small.webp?itok=-4sfG8q-
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6e7ac0dc584f9886aca10766fd4cca5cbc7b252b9d66799999e9cb87063dd7ca
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 08 Feb 2021 09:18:36 GMT
X-CDN
Imperva
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Iinfo
4-25385198-0 0CNN RT(1659452602818 485) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=509370, public
Content-Length
146704
Expires
Mon, 08 Aug 2022 12:32:53 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/
206 KB
69 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 14 Jun 2022 21:04:07 GMT
server
cloudflare
age
5890
etag
"2e0e88-3391f-5e16ebec83fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7347b332991abbc8-FRA
expires
Tue, 02 Aug 2022 19:03:23 GMT
conversion.js
www.googleadservices.com/pagead/
44 KB
17 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
cafe /
Resource Hash
169654a2040e9f83c46d4cd65600c3dc9db6db042904c22cc97645fb4323c362
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17001
x-xss-protection
0
server
cafe
etag
6464440653375776403
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 02 Aug 2022 15:03:23 GMT
js_YFxiPbJ8oC0iarvMLwNDwoZBTDt8LyvEqhyWIyR9QWQ.js
www.proofpoint.com/sites/default/files/js/
169 KB
58 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_YFxiPbJ8oC0iarvMLwNDwoZBTDt8LyvEqhyWIyR9QWQ.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
605c623db27ca02d226abbcc2f0343c286414c3b7c2f2bc4aa1c9623247d4164
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 29 Jul 2022 00:25:52 GMT
X-CDN
Imperva
Etag
"c1c02b83"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 504) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=811442, public
Content-Length
59170
Expires
Fri, 12 Aug 2022 00:27:25 GMT
geoip2.js
geoip-js.com/js/apis/geoip2/v2.1/
3 KB
2 KB
Script
General
Full URL
https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:264a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 01 Aug 2022 19:43:43 GMT
server
cloudflare
age
276
etag
W/"62e82cef-da4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=43200
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
7347b33438ad91cf-FRA
expires
Wed, 03 Aug 2022 03:03:23 GMT
js_Mypic69v3AM_k2tnVLPIrzNXY0af6UrC_DJGJz1MY-A.js
www.proofpoint.com/sites/default/files/js/
9 KB
3 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_Mypic69v3AM_k2tnVLPIrzNXY0af6UrC_DJGJz1MY-A.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
332a6273af6fdc033f936b6754b3c8af335763469fe94ac2fc3246273d4c63e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Tue, 21 Jun 2022 16:09:28 GMT
X-CDN
Imperva
Etag
"6e3ea0aa"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 551) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=125932, public
Content-Length
2188
Expires
Thu, 04 Aug 2022 02:02:15 GMT
munchkin.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
js_7lqJyJCkQZSrsCnNflEWq5PnaVamHlFodTCQ99ZmwDg.js
www.proofpoint.com/sites/default/files/js/
1 MB
436 KB
Script
General
Full URL
https://www.proofpoint.com/sites/default/files/js/js_7lqJyJCkQZSrsCnNflEWq5PnaVamHlFodTCQ99ZmwDg.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
ee5a89c890a44194abb029cd7e5116ab93e76956a61e5168753090f7d666c038
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Fri, 29 Jul 2022 00:29:18 GMT
X-CDN
Imperva
Etag
"23414c8b"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
text/javascript
X-Iinfo
14-102858190-0 0CNN RT(1659452602817 485) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=823453, public
Content-Length
446065
Expires
Fri, 12 Aug 2022 03:47:36 GMT
gtm.js
www.googletagmanager.com/
410 KB
97 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b7ece1df6a5a51eadf5fb7af7b7cb9108529f79787f95aee6682867a62e8fc6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
98940
x-xss-protection
0
expires
Tue, 02 Aug 2022 15:03:23 GMT
css
fonts.googleapis.com/
11 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Oswald:200,300,400,500,600,700|Open+Sans+Condensed:300
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/css/css_0uDpo4qmDSIxZjtjObFLJ6sn8xtKQuQfdACDeFKUh6Y.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ba95ed077caa1b5b8b0938c45e2223e486f179f659a64bcc4d6ea3d240235734
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Tue, 02 Aug 2022 15:03:23 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Tue, 02 Aug 2022 15:03:23 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 02 Aug 2022 15:03:23 GMT
truncated
/
44 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
82 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
90 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
38 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
209 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
204 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
221 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
720 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
444 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
606 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
685 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
460 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/
465 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
ransomware-bg-img.png
www.proofpoint.com/sites/default/files/nav-promo-images/
14 KB
14 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/nav-promo-images/ransomware-bg-img.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
6907f421de451fd5e7f962c48d39191bd7d86390df35df8b416d3ca0eb558436
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 22 Jan 2022 06:00:50 GMT
X-CDN
Imperva
Etag
"ebf7b974"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 595) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=122601, public
Content-Length
13846
Expires
Thu, 04 Aug 2022 01:06:44 GMT
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
914ae362937120d900bb5c5d95c70f3957fa2270c308925e4a72ad56446911cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cea918e6af14ac3645e0e33b30cb802820aed3e549defbd618be220c31546625

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
Screen%20Shot%202022-07-20%20at%208.38.15%20AM_0.png
www.proofpoint.com/sites/default/files/inline-images/
437 KB
438 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202022-07-20%20at%208.38.15%20AM_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
653a656337923a87f3a33f0cbcbb38bc4ba3b4c20b3f9b74cc8636f15394525a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 20 Jul 2022 15:02:57 GMT
X-CDN
Imperva
Etag
"d8e6f61b"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
5-38397060-0 0CNN RT(1659452602754 653) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=151366, public
Content-Length
447940
Expires
Thu, 04 Aug 2022 09:06:09 GMT
Screen%20Shot%202022-07-20%20at%208.39.04%20AM_0.png
www.proofpoint.com/sites/default/files/inline-images/
143 KB
144 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202022-07-20%20at%208.39.04%20AM_0.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
412497348d5be70ad308a8bb163dcc6ff003612444770261c12fc20ccdf92990
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 20 Jul 2022 15:03:22 GMT
X-CDN
Imperva
Etag
"c63849f5"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
4-25385198-0 0CNN RT(1659452602818 593) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=151367, public
Content-Length
146864
Expires
Thu, 04 Aug 2022 09:06:10 GMT
Screen%20Shot%202022-07-20%20at%209.09.03%20AM.png
www.proofpoint.com/sites/default/files/inline-images/
114 KB
114 KB
Image
General
Full URL
https://www.proofpoint.com/sites/default/files/inline-images/Screen%20Shot%202022-07-20%20at%209.09.03%20AM.png
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a02:e980:107::cf , United States, ASN19551 (INCAPSULA, US),
Reverse DNS
Software
/
Resource Hash
0d98648e4d3caf7339c64a2d5b068f8278e5b6a5efa81927820f443dca146e9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
X-Content-Type-Options
nosniff
Last-Modified
Wed, 20 Jul 2022 15:10:03 GMT
X-CDN
Imperva
Etag
"4da489f6"
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Type
image/png
X-Iinfo
2-8960560-0 0CNN RT(1659452602818 589) q(0 -1 -1 -1) r(0 -1)
Cache-Control
max-age=151368, public
Content-Length
116286
Expires
Thu, 04 Aug 2022 09:06:11 GMT
truncated
/
45 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/png
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-205-237-4.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:23 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Thu, 10 Nov 2022 15:03:23 GMT
MP9Jyqtx.min.js
scripts.demandbase.com/
92 KB
20 KB
Script
General
Full URL
https://scripts.demandbase.com/MP9Jyqtx.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-30.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8052a6fb6e64307417bdc20498d493634e5dd08188191d36dc64cd9672165e5a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id
Sn8D59q1zutrfU5eJtaPT.xE..b7EAZc
content-encoding
gzip
etag
W/"e3481cf4519ff99804e97355293f3f40"
age
1886
x-cache
Hit from cloudfront
vary
Accept-Encoding
last-modified
Thu, 13 Jan 2022 01:16:33 GMT
server
AmazonS3
date
Tue, 02 Aug 2022 14:40:58 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
via
1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
-jlrPh02bVAlZLlg0c_V44ZqRcMFWFVnhOelRFjs8wbDW-j_W0-0UA==
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
2 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1659452603665&cv=9&fst=1659452603665&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
709f47c65b7ca90f38a9600316852b29ddacc258b9ad1599e8ed966d5edb331f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1100
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visitWebPage
309-rhv-619.mktoresp.com/webevents/
2 B
318 B
Ping
General
Full URL
https://309-rhv-619.mktoresp.com/webevents/visitWebPage?_mchNc=1659452603721&_mchCn=&_mchId=309-RHV-619&_mchTk=_mch-proofpoint.com-1659452603721-69287&_mchHo=www.proofpoint.com&_mchPo=&_mchRu=%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:24 GMT
Content-Encoding
gzip
Server
nginx/1.20.1
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
b3244f2c-6d02-4c3c-af67-f6222676df85
me
geoip-js.com/geoip/v2.1/country/
93 B
367 B
XHR
General
Full URL
https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Requested by
Host: geoip-js.com
URL: https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:264a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c8f585f6eb6a9e8760ab07a76ea5e5c4d0b55631ed86d393e345594242e939e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/vnd.maxmind.com-error+json; charset=UTF-8; version=2.1
access-control-allow-origin
*
cf-ray
7347b336cb528fd6-FRA
content-length
93
truncated
/
207 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
getForm
app-abj.marketo.com/index.php/form/
6 KB
2 KB
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getForm?munchkinId=309-RHV-619&form=10895&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&callback=jQuery112408172436084607198_1659452603574&_=1659452603575
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
82e7f496b33db55afa55d97294c0eed6f50ec46281b3778f6e2123f8ba7bcb32

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cf-ray
7347b3361e94bbc8-FRA
cached
true
addthis_widget.js
s7.addthis.com/js/300/
353 KB
114 KB
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js?_=1659452603674
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/sites/default/files/js/js_YFxiPbJ8oC0iarvMLwNDwoZBTDt8LyvEqhyWIyR9QWQ.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.47.212.127 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-47-212-127.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
content-encoding
gzip
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
server
nginx/1.15.8
etag
W/"5f971164-5834c"
vary
Accept-Encoding
x-distribution
99
content-type
application/javascript
cache-control
public, max-age=600
date
Tue, 02 Aug 2022 15:03:24 GMT
x-host
s7.addthis.com
content-length
116401
/
www.google.com/pagead/1p-user-list/950296937/
42 B
548 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1659452603665&cv=9&fst=1659452400000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=662053122&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/
42 B
548 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1659452603665&cv=9&fst=1659452400000&num=1&guid=ON&eid=375603260&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&fmt=3&is_vtc=1&random=662053122&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
forms2.css
app-abj.marketo.com/js/forms2/css/
13 KB
3 KB
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
865
vary
Accept-Encoding
content-length
2623
last-modified
Tue, 14 Jun 2022 21:04:07 GMT
server
cloudflare
etag
"225bf1-3437-5e16ebec83fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7347b336e805bbc8-FRA
expires
Tue, 02 Aug 2022 19:03:23 GMT
forms2-theme-plain.css
app-abj.marketo.com/js/forms2/css/
828 B
383 B
Stylesheet
General
Full URL
https://app-abj.marketo.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
189
vary
Accept-Encoding
content-length
246
last-modified
Tue, 14 Jun 2022 21:04:07 GMT
server
cloudflare
etag
"225bef-33c-5e16ebec83fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
7347b336e808bbc8-FRA
expires
Tue, 02 Aug 2022 19:03:24 GMT
getKnownLead
app-abj.marketo.com/index.php/form/
49 B
260 B
Script
General
Full URL
https://app-abj.marketo.com/index.php/form/getKnownLead?form=10895&lpId=&munchkinId=309-RHV-619&filledFields=true&_mkt_trk=id%3A309-RHV-619%26token%3A_mch-proofpoint.com-1659452603721-69287&callback=jQuery112408172436084607198_1659452603574&_=1659452603576
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac6c1d1d9bed9485e3df5bd93b225dc77f7c738580ac4824a9ae2d4b124bfbe5
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/javascript; charset=utf-8
cf-ray
7347b336e80ebbc8-FRA
js
www.googletagmanager.com/gtag/
200 KB
71 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c2253ae47d13653a1decea3c2f7ddddeb6b25a99f9bc1842634633d071c618e4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
73024
x-xss-protection
0
expires
Tue, 02 Aug 2022 15:03:24 GMT
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
7047
date
Tue, 02 Aug 2022 13:05:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Tue, 02 Aug 2022 15:05:57 GMT
conversion_async.js
www.googleadservices.com/pagead/
40 KB
15 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s53-in-f2.1e100.net
Software
cafe /
Resource Hash
b3b810fd46e7aad5b789896519011ab5366b39dbb19a5663c53525f756e89bfb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15160
x-xss-protection
0
server
cafe
etag
9823212955285023900
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Tue, 02 Aug 2022 15:03:24 GMT
bat.js
bat.bing.com/
38 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Thu, 28 Jul 2022 17:32:37 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 4735A226B607499381E61F8690FE99A9 Ref B: FRAEDGE1219 Ref C: 2022-08-02T15:03:24Z
etag
"80a8697a8a2d81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
date
Tue, 02 Aug 2022 15:03:24 GMT
accept-ranges
bytes
content-length
11367
uwt.js
static.ads-twitter.com/
56 KB
15 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ae57d5e97bf1a0db8777b7531cd32cb09ee6f07bed183bb880469cc20f355086

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
last-modified
Thu, 28 Jul 2022 21:38:45 GMT
etag
"ca88912498e17137955859948f14e272+gzip+gzip"
vary
Accept-Encoding,Host
x-tw-cdn
FT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control
no-cache
x-cache
HIT, HIT
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
content-length
15196
x-served-by
cache-iad-kcgs7200090-IAD, cache-muc13953-MUC
hotjar-1456002.js
static.hotjar.com/c/
5 KB
3 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.139.80 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-139-80.fra60.r.cloudfront.net
Software
/
Resource Hash
d269dd13dcc6c4d29d137133b556725572600bcb4c7ca33c769a1a287d27e699
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=86400; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
age
53
x-cache
Hit from cloudfront
date
Tue, 02 Aug 2022 15:02:55 GMT
cross-origin-resource-policy
cross-origin
via
1.1 9c920cc684a38b53bc9c7a44ba794874.cloudfront.net (CloudFront)
cache-control
max-age=60
etag
W/51b51418a80e430f990d9afe928fa6e9
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
x-amz-cf-pop
FRA60-P4
x-amz-cf-id
VswzP8PfYo2r-f7_IVKB534l5iJbhSebA2FCoSEhmUzdbXzqWrekNw==
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
last-modified
Wed, 13 Apr 2022 23:25:22 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=61430
accept-ranges
bytes
content-length
3085
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5aba5f53ab79f7f51390a95a&ty=j
  • https://ads.avct.cloud/s?r=1&add=5aba5f53ab79f7f51390a95a&ty=j
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
0
336 B
Script
General
Full URL
https://ads.avct.cloud/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
52.17.151.21 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-17-151-21.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
content-type
application/javascript

Redirect headers

location
/s?bounce=true&r=1&add=5aba5f53ab79f7f51390a95a&ty=j
date
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
100
content-type
text/html; charset=utf-8
j.php
dev.visualwebsiteoptimizer.com/
3 KB
1 KB
Script
General
Full URL
https://dev.visualwebsiteoptimizer.com/j.php?a=359897&u=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&r=0.5004059669662095
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gams1 /
Resource Hash
4a15153e4eba73495ca558c997c11f0643c4d449f116d955b5018cfa8eee924e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

timing-allow-origin
*
date
Tue, 02 Aug 2022 15:03:23 GMT
via
1.1 google
server
gams1
content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-type
application/javascript; charset=UTF-8
1594.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
420 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1594.js?p=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
908a3e46-585f-4bb4-a17c-104edfb4e2a5
x-runtime
0.004669
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
7347b338f8799060-FRA
1644.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
430 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1644.js?p=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
59e6ad23-3b44-4cb5-9efc-45af8f93c5f3
x-runtime
0.004147
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
7347b338f87a9060-FRA
1645.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
412 B
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1645.js?p=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
afa23b8f-cf50-4475-b88f-84d216cb03e0
x-runtime
0.004674
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
7347b338f87d9060-FRA
1646.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1646.js?p=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
673fab6a-04d8-4b8e-b060-97bdb1f97c2d
x-runtime
0.003923
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
7347b338f87b9060-FRA
1647.js
tracking.g2crowd.com/attribution_tracking/conversions/
16 B
1 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1647.js?p=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&e=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2437 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
Security Headers
Name Value
Content-Security-Policy default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
x-permitted-cross-domain-policies
none
x-xss-protection
1; mode=block
x-request-id
47ea067e-69d5-4171-b210-2d1028b98bb1
x-runtime
0.002057
referrer-policy
strict-origin-when-cross-origin
server
cloudflare
x-frame-options
SAMEORIGIN
etag
W/"3dae93a05edd9dcfc1864b87178a31e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=604800
x-download-options
noopen
content-type
text/javascript; charset=utf-8
cache-control
max-age=600, public
content-security-policy
default-src 'self' *.g2crowd.com *.g2.com; connect-src 'self' *.g2crowd.com *.g2.com; font-src 'self' *.g2crowd.com *.g2.com; form-action 'self' *.g2crowd.com *.g2.com; frame-src 'self' *.g2crowd.com *.g2.com; img-src 'self' *.g2crowd.com *.g2.com; manifest-src 'self' *.g2crowd.com *.g2.com; media-src 'self' *.g2crowd.com *.g2.com; object-src 'self' *.g2crowd.com *.g2.com; script-src 'self' *.g2crowd.com *.g2.com; style-src 'self' *.g2crowd.com *.g2.com; worker-src 'self' *.g2crowd.com *.g2.com
cf-ray
7347b338f87e9060-FRA
main.rtfl.js
visitor.reactful.com/dist/
273 KB
106 KB
Script
General
Full URL
https://visitor.reactful.com/dist/main.rtfl.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
4d71e28edcd31a762462d68b69b58c84965188c5f19c64f9d55fe0520e33985d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 08:44:25 GMT
content-encoding
gzip
server
Google Frontend
age
22739
etag
"T5buNg"
content-type
application/javascript; charset=UTF-8
x-cloud-trace-context
5c98a64e6899465eba31d8a1fb22c8f2
cache-control
public,public, max-age=432000
content-length
107826
expires
Sun, 07 Aug 2022 08:44:25 GMT
s
ads.avct.cloud/
Redirect Chain
  • https://ads.avocet.io/s?add=5d1dcad3b00320110090d553&ty=j
  • https://ads.avct.cloud/s?r=1&add=5d1dcad3b00320110090d553&ty=j
  • https://ads.avct.cloud/s?bounce=true&r=1&add=5d1dcad3b00320110090d553&ty=j
123 B
479 B
Script
General
Full URL
https://ads.avct.cloud/s?bounce=true&r=1&add=5d1dcad3b00320110090d553&ty=j
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
52.17.151.21 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-17-151-21.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
afd7a9d5cc383d276f5d55d3465f9b32bf8b26c604d938445e9b1e8d82c776db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
123
content-type
application/javascript

Redirect headers

location
/s?bounce=true&r=1&add=5d1dcad3b00320110090d553&ty=j
date
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
100
content-type
text/html; charset=utf-8
activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716
4788165.fls.doubleclick.net/ Frame 4CA3
Redirect Chain
  • https://4788165.fls.doubleclick.net/activityi;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
  • https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
548 B
444 B
Document
General
Full URL
https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f6.1e100.net
Software
cafe /
Resource Hash
e3fab69734b09f71257e38bc41703c3794bce4f28abe5c62544a9e411f3076aa
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
421
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 15:03:24 GMT
expires
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 15:03:24 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
5dfsgn7m2kst.js
js.driftt.com/include/1659452700000/
210 KB
60 KB
Script
General
Full URL
https://js.driftt.com/include/1659452700000/5dfsgn7m2kst.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
bc58857f15c8adbf1889d31dad903f9330f95fd6e96fa214e23d4566dae1831d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id
fV.Pj2ghbo_TXix_cMzTU4MMjF9jRV82
content-encoding
gzip
etag
W/"6a31b8486ed000c6b91db09c683a6099"
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 18:38:45 GMT
server
nginx
date
Tue, 02 Aug 2022 15:03:24 GMT
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript; charset=utf-8
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
NjNO_DCHdqkCnAy3z76ozvCIgfpPfLy38wwbf7XXoUChLj1v5xw6Dg==
206034.js
secure.chip2gift.com/js/
16 B
304 B
Script
General
Full URL
https://secure.chip2gift.com/js/206034.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
51.11.20.152 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Kestrel /
Resource Hash
e9b3c1ef5622bc620a5c1d364aa9fbec2c9d6230bb5f6ab825825db09dd71f6a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:24 GMT
Server
Kestrel
Content-Type
text/javascript
Expires
0
Cache-Control
no-store, must-revalidate
Connection
keep-alive
Content-Length
16
Request-Context
appId=cid-v1:abe8a76f-f1a2-4b2e-9017-0ea36ffb5c20
fbevents.js
connect.facebook.net/en_US/
99 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
27fc02705fe7e895aeec26f7ec3e645e4544c4561f7ce7cfbdb6502e99e942cb
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
content-security-policy-report-only
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; preload; includeSubDomains
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26465
x-xss-protection
0
pragma
public
x-fb-debug
QvEvUmMfZHb08NukZ644Slk4q6GDySnyGduchYl+Oq1kRXdfaD5InaqjgMR5XhnO9l/C9sMST37z0Kcp8W15CA==
x-fb-trip-id
720026100
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 02 Aug 2022 15:03:24 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
tracking.js
trk.techtarget.com/
2 KB
1 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:91d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 15 Oct 2021 14:31:37 GMT
server
cloudflare
age
542
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript
expires
Tue, 02 Aug 2022 15:04:22 GMT
cache-control
max-age=1200
cf-ray
7347b33a3cb59b7c-FRA
cf-bgj
minify
6si.min.js
j.6sc.co/
31 KB
10 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:24 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
9715
Pragma
no-cache
Last-Modified
Thu, 05 May 2022 03:45:17 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"6273484d-7b02"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Tue, 02 Aug 2022 15:03:24 GMT
roundtrip.js
s.adroll.com/j/
52 KB
17 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
J7p8W1lQgNY91qwUxZU3x.y9IQrTVjMu
Content-Encoding
gzip
Etag
W/"d570d2e0cc47679b5bf3a6f9ff5b9e5b"
Age
3031
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Last-Modified
Thu, 30 Jun 2022 21:03:48 GMT
Server
AmazonS3
Date
Tue, 02 Aug 2022 14:13:17 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
wv9Q2bGGGCT5mfqWzhqs26VTmVB9j4wpx8mlrycsHzBNITL_W7vsPg==
activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat...
10487471.fls.doubleclick.net/ Frame 3238
Redirect Chain
  • https://10487471.fls.doubleclick.net/activityi;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthr...
  • https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fww...
1 KB
827 B
Document
General
Full URL
https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MGR7P8X
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.38 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f6.1e100.net
Software
cafe /
Resource Hash
c505cf7b6472ef7ea667490958e05773c64d1c2a40ab13eebd8bbf8dc38b598c
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
about:blank
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
804
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 15:03:24 GMT
expires
Tue, 02 Aug 2022 15:03:24 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 15:03:24 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
/
attr.ml-api.io/
Redirect Chain
  • https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dproofpoint.com%26pId%3d%24UID
  • https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dproofpoint.com%2526pId%253d%2524UID
  • https://attr.ml-api.io/?domain=proofpoint.com&pId=9006202609544540301
0
242 B
Image
General
Full URL
https://attr.ml-api.io/?domain=proofpoint.com&pId=9006202609544540301
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
2600:9000:2156:5000:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
via
1.1 45de888accabe1a1cb5a389e8c9c1e06.cloudfront.net (CloudFront)
apigw-requestid
WPZtmh2nIAMEJjA=
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
content-type
application/json
content-length
0
x-amz-cf-id
yx_j6xqGxTh3UWGvj3P7S0R6Zf01PqkVDhH8beRNaqXAHC8D9lbv0w==

Redirect headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:24 GMT
X-Proxy-Origin
185.213.155.168; 185.213.155.168; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
0d9a7aa3-8c1b-4772-866c-d87af908da92
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://attr.ml-api.io/?domain=proofpoint.com&pId=9006202609544540301
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://gwmtracking.com/p/v/1/5b7320b8f870815f7f59492b/format/img?gtmcb=551295332
  • https://ad.doubleclick.net/ddm/activity/src=8909468;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
63 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:26 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type
text/html; charset=UTF-8
location
https://adservice.google.com/ddm/fls/z/src=8909468;dc_pre=CKyE2ti2qPkCFQvisgodkYcKFQ;type=invmedia;cat=1l6xh4ap;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
122
track.accountinsight.cloud/track/
2 B
259 B
Image
General
Full URL
https://track.accountinsight.cloud/track/122
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
158.255.109.19 , France, ASN8218 (NEO-ASN legacy Neotelecoms, FR),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:24 GMT
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache
Content-Length
2
Expires
-1
/
data.adxcel-ec2.com/pixel/
43 B
131 B
Image
General
Full URL
https://data.adxcel-ec2.com/pixel/?ad_log=referer&action=content&content_id=%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pixid=93500acd-fb24-4d4c-b771-2b769752ab62
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.45.183.32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-45-183-32.compute-1.amazonaws.com
Software
/
Resource Hash
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
43
Content-Type
image/gif
ip.json
api.company-target.com/api/v2/
444 B
950 B
XHR
General
Full URL
https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&page_title=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&src=tag&key=2e81efc731d57cb3e458d08fae112991
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-101.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
45a3e44c1347d274cfbf71f7b942211eb9fd780c397150c4be62df62adfed0df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
request-id
7f120e0e-3a36-4027-8e15-8be9a852398f
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 a09186728c1bcdf0a561aedd92656804.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
wKm_LcKmoXutRiqUfGv5JciTEaYLpvDtJGXsxNKh33fOHi4GCaiZWA==
expires
Mon, 01 Aug 2022 15:03:24 GMT
validateCookie
segments.company-target.com/
Redirect Chain
  • https://match.prod.bidr.io/cookie-sync/demandbase
  • https://match.prod.bidr.io/cookie-sync/demandbase?_bee_ppp=1
  • https://segments.company-target.com/log?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA
  • https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA&verifyHash=610c6518d285b8f7e33549b5af09262e1b6f8d61
26 B
409 B
Image
General
Full URL
https://segments.company-target.com/validateCookie?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA&verifyHash=610c6518d285b8f7e33549b5af09262e1b6f8d61
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
52.222.214.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-214-106.fra56.r.cloudfront.net
Software
/
Resource Hash
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
Via
1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Content-Type
image/gif
Transfer-Encoding
chunked
Connection
keep-alive
trace-id
d312e1f5d908a55d
X-Amz-Cf-Id
fH71cF03YRxzwMHNU8-vB4-P-XFCTQ4tHBV2eK6maq46Nvj9l9rwZA==

Redirect headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
Via
1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA56-P3
Vary
Origin
X-Cache
Miss from cloudfront
Location
/validateCookie?vendor=choca&user_id=AACjlU7F0nkAABBzS8j6LA&verifyHash=610c6518d285b8f7e33549b5af09262e1b6f8d61
Connection
keep-alive
trace-id
bb7c98dfbe366d79
Content-Length
0
X-Amz-Cf-Id
YxTqJBbf_N7stVM6R9m4t5BHvtYrDh9-gMx9lMv0IP82JvYtfSSDSw==
464526.gif
id.rlcdn.com/
0
98 B
Image
General
Full URL
https://id.rlcdn.com/464526.gif
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?random=1659452604119&cv=9&fst=1659452604119&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg7r0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
28806cdf54095cc97e3db450f02e04f8a086b8dac6aea8f58c4dd4e720c2c1cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1112
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
region1.google-analytics.com/g/
0
349 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-B1V8SZE3GL&gtm=2oe7r0&_p=2088000008&_z=ccd.v9B&cid=1266778076.1659452604&ul=en-us&sr=1600x1200&_s=1&sid=1659452604&sct=1&seg=0&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&dt=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-c...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D169250%252C3955937%252C3976212%26time%3D1659452604180%26url%3Dhttps%253A%252F%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-c...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-...
0
142 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&liSync=true&e_ipv6=AQLE9dFU6PlkBwAAAYJfFULNPIo34l8rvGmXAi_XYRPIf032zfmQ8zKoG9AYC6zWF8cW6F6I
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: B673B807BE7D4F4A9784CD3BD9182744 Ref B: FRAEDGE1511 Ref C: 2022-08-02T15:03:25Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXlQ2sPwpptcLDg4sOunA==
x-li-fabric
prod-ltx1

Redirect headers

date
Tue, 02 Aug 2022 15:03:24 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 69E4F2591DBD47A3A2BAEDDBCF1ACFEA Ref B: FRAEDGE1107 Ref C: 2022-08-02T15:03:25Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=169250%2C3955937%2C3976212&time=1659452604180&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&liSync=true&e_ipv6=AQLE9dFU6PlkBwAAAYJfFULNPIo34l8rvGmXAi_XYRPIf032zfmQ8zKoG9AYC6zWF8cW6F6I
x-li-proto
http/2
content-length
0
x-li-uuid
AAXlQ2sMqtBCii+vF5idQw==
17087961.js
bat.bing.com/p/action/
1 KB
843 B
Script
General
Full URL
https://bat.bing.com/p/action/17087961.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
6caa3674bca088112c5370c516f7d89127be1c22b9a658adc3ceeca0d254ebd1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: AD9F1732CD3E41A6A33B1E4EA0EC67C5 Ref B: FRAEDGE1219 Ref C: 2022-08-02T15:03:24Z
date
Tue, 02 Aug 2022 15:03:24 GMT
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private,max-age=60
content-length
667
0
bat.bing.com/action/
0
174 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=17087961&tm=gtm002&Ver=2&mid=bbe27471-ab3b-47a8-a461-639765703b16&sid=41727f50127411edb35667ab7257b730&vid=4172a7d0127411ed8abcbdb7e4159cbb&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buy,%20Sell,%20Steal,%20EvilNum%20Targets%20Cryptocurrency,%20Forex,%20Commodities%20%7C%20Proofpoint%20US&p=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&r=&lt=1076&evt=pageLoad&sv=1&rn=710099
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 57010AAF345E4FE8A7B6036C2E078303 Ref B: FRAEDGE1219 Ref C: 2022-08-02T15:03:24Z
date
Tue, 02 Aug 2022 15:03:24 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/950296937/?random=1659452604119&cv=9&fst=1659452400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg7r0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=4045464449&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/950296937/
42 B
64 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/950296937/?random=1659452604119&cv=9&fst=1659452400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2wg7r0&sendb=1&frm=0&url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tiba=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&async=1&fmt=3&is_vtc=1&random=4045464449&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
t.co/i/
43 B
337 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=00f6a9cb-270a-4f03-8925-89bb747761eb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=b2872f0c-e034-4c1a-9575-f2389bd424e7&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nyk4d&type=javascript&version=2.4.15
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-response-time
105
date
Tue, 02 Aug 2022 15:03:24 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9dd7a7cefa1f8dadb1c84aea48a354d97f61fed16536d2603a6a7036457afbe7
content-length
43
adsct
analytics.twitter.com/i/
43 B
355 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=00f6a9cb-270a-4f03-8925-89bb747761eb&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=b2872f0c-e034-4c1a-9575-f2389bd424e7&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=nyk4d&type=javascript&version=2.4.15
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-response-time
102
date
Tue, 02 Aug 2022 15:03:24 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
aca6ec4385a50c6e16267bfbd9dd4498356eefe0bf5fdcfc60e548ec7f8b5785
content-length
43
adsct
t.co/i/
43 B
188 B
Image
General
Full URL
https://t.co/i/adsct?bci=3&eci=2&event_id=f5cc47c3-4182-416b-ad88-f7d694f8ede5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=b2872f0c-e034-4c1a-9575-f2389bd424e7&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o73l9&type=javascript&version=2.4.15
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.133 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-response-time
106
date
Tue, 02 Aug 2022 15:03:24 GMT
server
tsa_o
strict-transport-security
max-age=0
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9dd7a7cefa1f8dadb1c84aea48a354d97f61fed16536d2603a6a7036457afbe7
content-length
43
adsct
analytics.twitter.com/i/
43 B
198 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=f5cc47c3-4182-416b-ad88-f7d694f8ede5&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&p_id=Twitter&p_user_id=0&pl_id=b2872f0c-e034-4c1a-9575-f2389bd424e7&tw_document_href=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o73l9&type=javascript&version=2.4.15
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.67 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-response-time
106
date
Tue, 02 Aug 2022 15:03:24 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
aca6ec4385a50c6e16267bfbd9dd4498356eefe0bf5fdcfc60e548ec7f8b5785
content-length
43
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2088000008&t=pageview&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&ul=en-us&de=UTF-8&dt=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=590019719&gjid=38447159&cid=1266778076.1659452604&tid=UA-2257074-1&_gid=814220863.1659452604&_r=1&gtm=2wg7r0MGR7P8X&cd19=1266778076.1659452604&z=2055360552
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
modules.bb562e057a78838c3c4b.js
script.hotjar.com/
248 KB
64 KB
Script
General
Full URL
https://script.hotjar.com/modules.bb562e057a78838c3c4b.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-5.fra50.r.cloudfront.net
Software
/
Resource Hash
950c9b43bb82d94e66d52b2ec81ee6f2d71c378c3aaf0108c50c03d70b735173
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 13:51:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
4338
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=86400; includeSubDomains
content-length
64869
access-control-allow-origin
*
last-modified
Tue, 02 Aug 2022 13:50:25 GMT
etag
"5ca53ec7c34af0fd5f63975c6cf4eced"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 9eb0e845437929074828e0cf53f179ae.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
saWVjU6LAzWV1oGzgDqhE0t_3i3pVtGONtF4xsd6fr13ZBsWoxNFCg==
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2088000008&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&ul=en-us&de=UTF-8&dt=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Demandbase&ea=API%20Resolution&el=IP%20API&_u=aDDAAEABAAAAAC~&jid=&gjid=&cid=1266778076.1659452604&tid=UA-2257074-1&_gid=814220863.1659452604&gtm=2wg7r0MGR7P8X&cd19=1266778076.1659452604&cd1=(Non-Company%20Visitor)&cd2=(Non-Company%20Visitor)&cd3=(Non-Company%20Visitor)&cd4=(Non-Company%20Visitor)&cd5=(Non-Company%20Visitor)&cd6=(Non-Company%20Visitor)&cd7=Bot&cd8=(Non-Company%20Visitor)&cd9=(Non-Company%20Visitor)&cd10=Frankfurt%20am%20Main&cd11=HE&cd12=Germany&cd13=(Non-Company%20Visitor)&cd14=(Non-Company%20Visitor)&cd15=(Non-Company%20Visitor)&cd16=(Non-Company%20Visitor)&cd17=(Non-Company%20Visitor)&cd18=(Non-Company%20Visitor)&z=76414528
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 01 Aug 2022 17:42:34 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
76850
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
box-54d18b2ccd1c7fa42c71f18525ba4ad0.html
vars.hotjar.com/ Frame 5FF7
2 KB
1 KB
Document
General
Full URL
https://vars.hotjar.com/box-54d18b2ccd1c7fa42c71f18525ba4ad0.html
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-1456002.js?sv=7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-27.fra50.r.cloudfront.net
Software
/
Resource Hash
3b534eeaf216d2e54730d1c9bb15344f4b78712e6c781d31555585c51651e989
Security Headers
Name Value
Strict-Transport-Security max-age=86400; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
90917
cache-control
max-age=31536000
content-encoding
br
content-length
1044
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 01 Aug 2022 13:48:07 GMT
etag
"b310868fbdb4c8ee7d37e1b85ae269fa"
last-modified
Mon, 01 Aug 2022 13:47:35 GMT
strict-transport-security
max-age=86400; includeSubDomains
vary
Accept-Encoding
via
1.1 e38834cd8f7f79ef118dc9bba0861780.cloudfront.net (CloudFront)
x-amz-cf-id
NNG3rdHA0KkjSVdk36q1RPs9-UKgXhCJOwmpld8U7E1De3ERANQhaw==
x-amz-cf-pop
FRA50-C1
x-cache
Hit from cloudfront
x-robots-tag
none
moatframe.js
z.moatads.com/addthismoatframe568911941483/
2 KB
1 KB
Script
General
Full URL
https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1659452603674
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.47.209.169 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-47-209-169.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

unused62
8096267
date
Tue, 02 Aug 2022 15:03:25 GMT
content-encoding
gzip
last-modified
Fri, 08 Nov 2019 20:13:52 GMT
server
AmazonS3
x-amz-request-id
3DA20F33DFB043F4
etag
"f14b4e1f799b14f798a195f43cf58376"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=26324
accept-ranges
bytes
content-length
948
x-amz-id-2
g7+QTkfgFpKXdjIV1ns3PedgNVHG4mi9TLupYfjziOmGieTRD5DTu0V21U3C4oqBbTG5njMGxL0=
v.gif
dev.visualwebsiteoptimizer.com/
35 B
52 B
Image
General
Full URL
https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=359897&d=proofpoint.com&u=D8C333896BF9A1AA591147053DB178082&h=f1f52251f8cca7dcb1d4c8d03d918dc0&t=false&r=0.0275489654273553
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.96.102.137 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
137.102.96.34.bc.googleusercontent.com
Software
gnv3c /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
via
1.1 google
x-content-type-options
nosniff
server
gnv3c
content-type
image/gif
cache-control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 10 Jan 2005 00:00:01 GMT
17087961
www.clarity.ms/tag/uet/
2 KB
2 KB
Script
General
Full URL
https://www.clarity.ms/tag/uet/17087961
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/17087961.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:1425 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
d0777c7ce21d13f06a66f06728ecdd7e77186499b44c26858a2bbc13ce4a0f2d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
x-powered-by
ASP.NET
x-azure-ref
0vTzpYgAAAAB2sX705XzjRKgP1ukG1TJZTUlMMzBFREdFMDYwNgA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
content-length
1656
expires
-1
collect
stats.g.doubleclick.net/j/
4 B
444 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2257074-1&cid=1266778076.1659452604&jid=590019719&gjid=38447159&_gid=814220863.1659452604&_u=YADAAEAAAAAAAC~&z=1764493456
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Tue, 02 Aug 2022 15:03:24 GMT
content-type
text/plain
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
XDFrame
app-abj.marketo.com/index.php/form/ Frame BD6C
2 KB
861 B
Document
General
Full URL
https://app-abj.marketo.com/index.php/form/XDFrame
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b0e6c1c112eda28bd4787e19ce4920424990b564c0fb3b828ec605d91ba4813e
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=3600
cf-cache-status
DYNAMIC
cf-ray
7347b33a3f7dbbc8-FRA
content-encoding
gzip
content-length
650
content-type
text/html; charset=utf-8
date
Tue, 02 Aug 2022 15:03:24 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
strict-transport-security
max-age=63113904
vary
Accept-Encoding
x-content-type-options
nosniff
forms_f79029b2cb.min.js
tag.demandbase.com/shared/
177 KB
57 KB
Script
General
Full URL
https://tag.demandbase.com/shared/forms_f79029b2cb.min.js
Requested by
Host: scripts.demandbase.com
URL: https://scripts.demandbase.com/MP9Jyqtx.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.17.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-17-46.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
69a12e6a2c6dff14902de0fec7a22b138a389be30d22265fa1f3c629373c295e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id
ZdfV2hyb4.f3iYT1bTpwGYnAcDBeMBIJ
content-encoding
gzip
last-modified
Mon, 07 Dec 2020 19:53:05 GMT
server
AmazonS3
age
36079
etag
W/"297f27393505134e72a57f78a067e26d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
via
1.1 0f58c45e6baa63e9e5e13528986aaf40.cloudfront.net (CloudFront)
date
Tue, 02 Aug 2022 05:02:59 GMT
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P7
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-amz-cf-id
aA7hbCYeebmYfzU569gk77fjZl9YR6w5FWjKrYQfjWaLiCHm8Q97Qg==
143852102935619
connect.facebook.net/signals/config/
293 KB
84 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/143852102935619?v=2.9.69&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
23aa8ce4a48730459e91a4b0b3a82eb7dd3c60da8c6b315a4ae4368fde1fdaba
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
85898
x-xss-protection
0
pragma
public
x-fb-debug
0S4qYhBnhPQjJy8u9nR5+nMeF0FRkU5KfMPgJWpOpzEpvTT5vDNyKow9N1Wxi0JAXAeFItKSdhgQTv0YiwojXA==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 02 Aug 2022 15:03:24 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
img
pixel.mathtag.com/event/ Frame 4CA3
43 B
550 B
Image
General
Full URL
https://pixel.mathtag.com/event/img?mt_id=1442966&mt_adid=226348&mt_exem=&mt_excl=&v1=&v2=&v3=&s1=&s2=&s3=&ord=2079536869
Requested by
Host: 4788165.fls.doubleclick.net
URL: https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
92.123.37.164 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-123-37-164.deploy.static.akamaitechnologies.com
Software
MT3 4475 c1dc35a master zrh-pixel-x1 config:1.0.0 /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://4788165.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:24 GMT
Server
MT3 4475 c1dc35a master zrh-pixel-x1 config:1.0.0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 02 Aug 2022 15:03:23 GMT
dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716
adservice.google.com/ddm/fls/z/ Frame 4CA3
42 B
494 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716
Requested by
Host: 4788165.fls.doubleclick.net
URL: https://4788165.fls.doubleclick.net/activityi;dc_pre=CL6Z_de2qPkCFcWWsgodwcoChw;src=4788165;type=sitew0;cat=proof0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=3287095527712.716?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://4788165.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/7YJ7XZCLMRHSVCXIHB5HIT/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
785 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
BTP2rshxaRFWPNdrItPYEau9DI6Y8oce
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Etag
"5816cced8568d223aa09d889f300692b"
Age
25086
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
28
Last-Modified
Wed, 06 Jul 2022 18:15:57 GMT
Server
AmazonS3
Date
Tue, 02 Aug 2022 09:08:27 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
jgYr8hi584sglUKfEcRZgp_7rjayQDhH6kKk84g5NhhIF-e4zcY1FQ==

Redirect headers

Date
Mon, 01 Aug 2022 18:40:04 GMT
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Age
73399
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
-mj7k2sWGek2wP1Rs8G-_movVvVKipF8ghaRoYhDRJ-OhBC493njkg==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
756 B
Script
General
Full URL
https://s.adroll.com/j/pre/index.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
53160
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Date
Tue, 02 Aug 2022 08:12:09 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
D3yOZ4Jyl7TxRNtZekXR05JA1gjx8TsYXl5ibyaVfN1InXKrmEHPBQ==

Redirect headers

Date
Tue, 02 Aug 2022 07:27:07 GMT
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Age
27378
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
4M6LcyEXKTrayrLdEvWR6dv036GUy102eZhTzUvs8CiXm7fZfl3m-A==
index.js
s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/
0
809 B
Script
General
Full URL
https://s.adroll.com/j/pre/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
mGigkWaQRapj.mXM4_niP5g3jkXcDpfz
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
2138
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
0
Last-Modified
Mon, 01 Aug 2022 02:16:33 GMT
Server
AmazonS3
Date
Tue, 02 Aug 2022 14:41:05 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
KOOa-LJTRNyv74c4FuybiigtbyWmkQ52IoaCff6n0PaS6-sqg5gJuQ==
d7557a63ab8c88be
pixel.sitescout.com/up/ Frame 3238
43 B
267 B
Image
General
Full URL
https://pixel.sitescout.com/up/d7557a63ab8c88be?url=retargeting&cntr_revenue=&cntr_transactionId=1827788716370&u1=&u2=&u3=&u4=&u5=&cntr_url=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software
AC1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:23 GMT
server
AC1.1
p3p
CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
cache-control
max-age=0,no-cache,no-store
content-type
image/gif
content-length
43
expires
Tue, 11 Oct 1977 12:34:56 GMT
dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=*;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evil...
adservice.google.com/ddm/fls/z/ Frame 3238
42 B
107 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=*;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/ Frame 3238
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
last-modified
Wed, 13 Apr 2022 23:25:22 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=61430
accept-ranges
bytes
content-length
3085
user-sync
cpm.convergeselect.net/
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=59&user_group=2&user_id=55bf37a7-f069-44f6-b3e2-9ebe84eb409b
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=59&user_group=2&user_id=55bf37a7-f069-44f6-b3e2-9ebe84eb409b
  • https://cpm.convergeselect.net/user-sync?dsp=328334&t=image&gdpr=&gdpr_consent=&uid=9ba72ed6-f9a0-4c29-ae6c-fb2d0820fd9b
42 B
228 B
Image
General
Full URL
https://cpm.convergeselect.net/user-sync?dsp=328334&t=image&gdpr=&gdpr_consent=&uid=9ba72ed6-f9a0-4c29-ae6c-fb2d0820fd9b
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:25 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
close
Content-Length
42

Redirect headers

Location
//cpm.convergeselect.net/user-sync?dsp=328334&t=image&gdpr=&gdpr_consent=&uid=9ba72ed6-f9a0-4c29-ae6c-fb2d0820fd9b
Date
Tue, 02 Aug 2022 15:03:25 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
activity.gif
apt.techtarget.com/activity/
43 B
324 B
Image
General
Full URL
https://apt.techtarget.com/activity/activity.gif?activityTypeId=31&cid=1268939&version=2.1.1&ref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&r=1659452604576
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
206.19.49.24 , United States, ASN17225 (ATT-CERFNET-BLOCK, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
Last-Modified
Tue, 26 Mar 2019 18:30:29 GMT
Server
Apache/2.4.6 (CentOS)
ETag
"2b-5850384023492"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=43
Content-Length
43
collect
px4.ads.linkedin.com/ Frame 3238
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2782676%26time%3D1659452604598%26url%3Dhttps%253A%252F%252Fwww.proofpoint.com%252...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQLZ8IsFlEhXdgAAAYJfFUKEwvbbQngtGJt_-036Jqas84m3hPhGMsypMCe...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQLZ8IsFlEhXdgAAAYJfFUKEwvbbQngtGJt_-036Jqas84m3hPhGMsypMCe5XpDD0W22B7W5
Requested by
Host: 10487471.fls.doubleclick.net
URL: https://10487471.fls.doubleclick.net/activityi;dc_pre=COiAgNi2qPkCFc2Zsgod3y8MDg;src=10487471;type=retar0;cat=retar0;ord=1827788716370;gtm=2wg7r0;auiddc=1659421903.1659452604;~oref=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities?
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://10487471.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 9BFFFB21CFBD446B894CA3CCB6BCE68E Ref B: FRAEDGE1511 Ref C: 2022-08-02T15:03:25Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXlQ2sPfImq0/lnD5fcSA==
x-li-fabric
prod-ltx1

Redirect headers

date
Tue, 02 Aug 2022 15:03:24 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 29D84B75FB0346F2858A82B9A95334B0 Ref B: FRAEDGE1107 Ref C: 2022-08-02T15:03:24Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2782676&time=1659452604598&url=https%3A%2F%2Fwww.proofpoint.com%2F&liSync=true&e_ipv6=AQLZ8IsFlEhXdgAAAYJfFUKEwvbbQngtGJt_-036Jqas84m3hPhGMsypMCe5XpDD0W22B7W5
x-li-proto
http/2
content-length
0
x-li-uuid
AAXlQ2sLcRX97DWayESg0A==
ga-audiences
www.google.com/ads/
42 B
63 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2257074-1&cid=1266778076.1659452604&jid=590019719&_u=YADAAEAAAAAAAC~&z=1125430352
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2257074-1&cid=1266778076.1659452604&jid=590019719&_u=YADAAEAAAAAAAC~&z=1125430352
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
7YJ7XZCLMRHSVCXIHB5HIT
d.adroll.com/consent/check/
448 B
918 B
Script
General
Full URL
https://d.adroll.com/consent/check/7YJ7XZCLMRHSVCXIHB5HIT?arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&_s=e8f6867c27c61611ffcb274086dceb05&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.111.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-111-147.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
285a94d2b2f41c7d5d08f69e1430743f8c0977cb4f5a43a9876572467693e1b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
application/javascript
content-length
448
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
getuidj
secure.adnxs.com/
11 B
708 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:24 GMT
X-Proxy-Origin
185.213.155.168; 185.213.155.168; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
38045136-31bd-460f-8da2-5a0db073d79c
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.proofpoint.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
374 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
826beb4857a8c006571a0c582619a8a7be9b263c932e4ea5f054b624a36bd45d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:24 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://www.proofpoint.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
/
ipv6.6sc.co/
20 B
257 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:294::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fe1f7ff4931ae087ad58f48a31244e177230eccdac8f5185f7d231e2967c14cd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:24 GMT
vary
Origin
content-type
text/html
access-control-allow-origin
https://www.proofpoint.com
cache-control
max-age=0, no-cache, no-store
6si-ipv6
2a03:1b20:6:f011::8e
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
20
expires
Tue, 02 Aug 2022 15:03:24 GMT
forms2.min.js
app-abj.marketo.com/js/forms2/js/ Frame BD6C
206 KB
68 KB
Script
General
Full URL
https://app-abj.marketo.com/js/forms2/js/forms2.min.js
Requested by
Host: app-abj.marketo.com
URL: https://app-abj.marketo.com/index.php/form/XDFrame
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.95.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://app-abj.marketo.com/index.php/form/XDFrame
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Tue, 14 Jun 2022 21:04:07 GMT
server
cloudflare
age
5891
etag
"2e0e88-3391f-5e16ebec83fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
cf-ray
7347b33b497bbbc8-FRA
expires
Tue, 02 Aug 2022 19:03:24 GMT
/
www.facebook.com/tr/
44 B
159 B
Image
General
Full URL
https://www.facebook.com/tr/?id=143852102935619&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&rl=&if=false&ts=1659452604723&sw=1600&sh=1200&v=2.9.69&r=stable&ec=0&o=30&fbp=fb.1.1659452604722.335547448&it=1659452604522&coo=false&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Tue, 02 Aug 2022 15:03:25 GMT
/
visitor.reactful.com/config/879986/ Frame
0
0
Preflight
General
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&hash=&referer=&user_id=&hshkgid=9ae3b0f8-477e-47f3-9d94-a712ff1ee185&cb_rtfl=_rtfl_jsonp_0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
url-params-data
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Six-Sense-Data, Custom-Vars-Data, Url-Params-Data
access-control-allow-methods
GET
access-control-allow-origin
https://www.proofpoint.com
cache-control
no-cache
content-length
0
content-type
text/javascript
date
Tue, 02 Aug 2022 15:03:25 GMT
expires
Tue, 02 Aug 2022 15:03:25 GMT
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
server
Google Frontend
x-cloud-trace-context
d21eebcc2c47450c4711310fcdfc893d
/
visitor.reactful.com/config/879986/
0
128 B
XHR
General
Full URL
https://visitor.reactful.com/config/879986/?page=%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&hash=&referer=&user_id=&hshkgid=9ae3b0f8-477e-47f3-9d94-a712ff1ee185&cb_rtfl=_rtfl_jsonp_0
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.proofpoint.com/
Url-Params-Data
e30=
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
server
Google Frontend
access-control-allow-methods
GET, OPTIONS
content-type
text/javascript
access-control-allow-origin
https://www.proofpoint.com
x-cloud-trace-context
e9a4fcc4fbdef89abb7779fe1fe62795
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
Six-Sense-Data,Custom-Vars-Data,Url-Params-Data
content-length
0
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A24%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=null&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=ipv6&q=%7B%22address%22%3A%222a03%3A1b20%3A6%3Af011%3A%3A8e%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
details
epsilon.6sense.com/v3/company/
1 KB
823 B
XHR
General
Full URL
https://epsilon.6sense.com/v3/company/details
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.147.191 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-147-191.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
94a213df30df09df66ba05d0c007b145aa49b5ee6b467bdc60bc9308b41b9c8c

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
Authorization
Token cf897ce61a58c53c1861f742ebebc2622f6b0fcf
EpsilonCookie
7d17655f003a0000bc3ce9626402000026834500

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.proofpoint.com
access-control-allow-credentials
true
content-length
636
details
epsilon.6sense.com/v3/company/ Frame
0
0
Preflight
General
Full URL
https://epsilon.6sense.com/v3/company/details
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.147.191 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-124-147-191.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,epsiloncookie
Access-Control-Request-Method
GET
Origin
https://www.proofpoint.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
authorization,epsiloncookie
access-control-allow-methods
OPTIONS,GET
access-control-allow-origin
https://www.proofpoint.com
access-control-max-age
1800
date
Tue, 02 Aug 2022 15:03:24 GMT
server
nginx
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2088000008&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&ul=en-us&de=UTF-8&dt=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aDDAAEABAAAAAC~&jid=&gjid=&cid=1266778076.1659452604&tid=UA-2257074-1&_gid=814220863.1659452604&gtm=2wg7r0MGR7P8X&cd19=1266778076.1659452604&cd2=Credit%20Suisse&cd3=Financial%20Services&cd5=10%2C000%2B&cd6=%245B%2B&cd7=Bot&cd8=&cd10=Frankfurt%20am%20Main&cd11=Hesse&cd12=Germany&cd17=credit-suisse.com&z=1891222905
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 01 Aug 2022 17:42:34 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
76851
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
stylesheet_f79029b2cb.v2.css
scripts.demandbase.com/shared/
27 KB
4 KB
Stylesheet
General
Full URL
https://scripts.demandbase.com/shared/stylesheet_f79029b2cb.v2.css
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/shared/forms_f79029b2cb.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.30 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-30.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fa176af3695a7e918096d7d71a501167980482180f48dc0e4515855901b42969
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 04:19:40 GMT
content-encoding
gzip
last-modified
Mon, 07 Dec 2020 19:53:05 GMT
server
AmazonS3
age
38626
etag
W/"178916ae2031afd4e0b75797aa965718"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
csDn.NNS9VGplSm_6jcpT8H1jYl4C4Qr
via
1.1 9ab847fabb8c9edbd39cff57c2a2f4c0.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA50-C1
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
text/css; charset=UTF-8
x-amz-cf-id
ZEWw-2essQLr39JlI24dCFJBZaw2reDV6-Megevrj0C8wpkhz0vgSQ==
clarity.js
www.clarity.ms/eus-f/s/0.6.36/
52 KB
23 KB
Script
General
Full URL
https://www.clarity.ms/eus-f/s/0.6.36/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/17087961
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:27::cafe:1425 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
e8aff6a8426e2182081c0e696ff05c3b10eeb43716fe56bbc9f8b3b3069c6736

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:24 GMT
content-encoding
br
etag
"1d8a5e16a79a826"
last-modified
Wed, 01 Jun 2022 12:22:22 GMT
x-powered-by
ASP.NET
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
x-azure-ref
0vTzpYgAAAABLySB3hL0rQbt3lRQ/FSFITUlMMzBFREdFMDYwNgA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
accept-ranges
bytes
content-length
23009
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
/
www.facebook.com/tr/ Frame C22C
0
224 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://www.proofpoint.com
Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://www.proofpoint.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Tue, 02 Aug 2022 15:03:25 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
T47Y2VPPABDUBJXFROMZZM.js
s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/
Redirect Chain
  • https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insig...
  • https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
5 KB
2 KB
Script
General
Full URL
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
df82f5399e2ea4ae935baf5acad52a81785df3c210408286619d0b9e88d1f9bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
lmmYnRpm_MModzv4VHnHlOkYzttX4M9a
Content-Encoding
gzip
Etag
W/"03ac3dee9f2d8cd7fd620dd786ecbc8b"
Age
286
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Last-Modified
Mon, 06 Jun 2022 22:00:14 GMT
Server
AmazonS3
Date
Tue, 02 Aug 2022 15:00:17 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
7KVGE4kJJI4zRE5aMxda6aBaFvWaE3X-E1CYaGY3d2bglsEZgLepQQ==

Redirect headers

date
Tue, 02 Aug 2022 15:03:25 GMT
x-segment-display-name
Visitors to Unsegmented Pages
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type
p
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.20.0
x-rule
*
x-segment-eid
T47Y2VPPABDUBJXFROMZZM
location
https://s.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK/T47Y2VPPABDUBJXFROMZZM.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
YV5KYXXEJZATZCT37YRTMK
x-segment-name
*
x-advertisable-eid
7YJ7XZCLMRHSVCXIHB5HIT
x-conversion-currency
8049e2e3-70b2-472c-93ec-a93166e6fc71
https://www.proofpoint.com/
0
0
Script
General
Full URL
blob:https://www.proofpoint.com/8049e2e3-70b2-472c-93ec-a93166e6fc71
Requested by
Host: visitor.reactful.com
URL: https://visitor.reactful.com/dist/main.rtfl.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Length
0
Content-Type
text/javascript
sendrolling.js
s.adroll.com/j/
8 KB
3 KB
Script
General
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/7YJ7XZCLMRHSVCXIHB5HIT/YV5KYXXEJZATZCT37YRTMK?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pv=48954637277.48699&cookie=&adroll_s_ref=&keyw=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:be00:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e5cf82e4a17e79c80c6f17c3fff873756de944e1301fa01c1d03aba1e359669

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

X-Amz-Version-Id
wG3UJevK_dyyBSOJeVU2_V1xC3jx_aLw
Content-Encoding
gzip
Etag
W/"9f2aa6ae991d93164d9512029d813cad"
Age
61704
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Access-Control-Max-Age
600
Connection
keep-alive
Via
1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
Last-Modified
Thu, 30 Jun 2022 21:48:50 GMT
Server
AmazonS3
Date
Mon, 01 Aug 2022 22:01:38 GMT
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
FRA50-C1
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
OiB-tcjDNyoghD90cZA6SN2XM0mPWJbfzpGcfr9LY_OuPCuRh07p6Q==
389545881899618
connect.facebook.net/signals/config/
292 KB
84 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/389545881899618?v=2.9.69&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
20c38aa41958a57a405a22c8ae6eb0b15b562cc5ea78fc121a20b753171de79c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
85874
x-xss-protection
0
pragma
public
x-fb-debug
g/kcqXLh6NZq0qxB044DM6uevCvVPUohGXmFW87ApWR1IQlhgIaFk5az8FJU5IJSObpwW68rAjUJJ0FRf1ikeg==
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 02 Aug 2022 15:03:25 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
rum
r.casalemedia.com/
Redirect Chain
  • https://d.adroll.com/cm/index/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cry...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605
  • https://r.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605&C=1
43 B
1 KB
Image
General
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605&C=1
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

cf-ray
7347b34208059168-FRA
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Is-Traffic-Usersync, Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CFMCMQdZ6kOIAFbX7wFZSZkRHVGIMjbEuBtdSd16ifY3CFrs7efEjikiSe925Fa3SQMHO8jWh2oR5zWHxzX7pK4Gh5tNRBmm4i7uQWytLNZfqrCMAEfqCkZsqepiTADuXrPA"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control
no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
0

Redirect headers

cf-ray
7347b3412ad29a24-FRA
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cf-cache-status
DYNAMIC
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XaorbHsvlKYBKYR77dTXolJLaU9JqSmEgdfQqyZqbEX2RsHtRBGUKF%2FN8datJMfezM2RJfCYIiZOx3%2FpCVWaBhF%2FpRYsm09vOCMlksz%2FK64bhYmyt1rretZeW5JYNnENa3dJ7v8%2F1mBECA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location
https://r.casalemedia.com/rum?cm_dsp_id=105&external_user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expiration=1690988605&C=1
cache-control
no-cache
content-type
text/html; charset=iso-8859-1
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires
0
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://d.adroll.com/cm/n/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expires=365
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expires=365
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
8f052d4f888ae4e0626c5f819879cacd
Content-Type
image/gif

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&expires=365
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
124
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cookie-sync
sync.outbrain.com/
Redirect Chain
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-...
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
0
308 B
Image
General
Full URL
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
64.202.112.191 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
Cache-Control
no-cache
X-TraceId
3d6d3d854a0753440a26ded560d1d206
Content-Length
0

Redirect headers

location
https://sync.outbrain.com/cookie-sync?p=adroll&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
100
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...
42 B
493 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:23 GMT
cache-control
no-store, no-cache, private
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
212
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
sync
ups.analytics.yahoo.com/ups/55980/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
0
124 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-126-56-137.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.0.46 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
server
ATS/9.1.0.46
age
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://ups.analytics.yahoo.com/ups/55980/sync?_origin=1&uid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
169
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-c...
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
0
90 B
Image
General
Full URL
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
37264

Redirect headers

location
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
111
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
xuid
eb2.3lift.com/
Redirect Chain
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-target...
  • https://eb2.3lift.com/xuid?mid=4714&xuid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&dongle=c85e
37 B
140 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=4714&xuid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&dongle=c85e
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

location
https://eb2.3lift.com/xuid?mid=4714&xuid=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&dongle=c85e
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
102
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
sync
x.bidswitch.net/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
43 B
220 B
Image
General
Full URL
https://x.bidswitch.net/sync?dsp_id=44&user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
18.193.145.56 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-193-145-56.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://x.bidswitch.net/sync?dsp_id=44&user_id=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
96
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
setuid
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://ib.adnxs.com/setuid?entity=172&code=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=172&code=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Server
37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 02 Aug 2022 15:03:25 GMT
X-Proxy-Origin
185.213.155.168; 185.213.155.168; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
14f543b3-5cf1-430c-98b6-ae2ef0c8b2c9
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

location
https://ib.adnxs.com/setuid?entity=172&code=YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
93
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
out
d.adroll.com/cm/l/
42 B
180 B
Image
General
Full URL
https://d.adroll.com/cm/l/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&advertisable=7YJ7XZCLMRHSVCXIHB5HIT
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.16.111.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-111-147.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.20.0
content-length
42
vary
Cookie
content-type
image/gif
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=a936ea965ec8b6ed963497c3f8cd95bf&gdpr=1&gdpr_consent=
43 B
273 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537103138&val=a936ea965ec8b6ed963497c3f8cd95bf&gdpr=1&gdpr_consent=
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537103138&val=a936ea965ec8b6ed963497c3f8cd95bf&gdpr=1&gdpr_consent=
pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
108
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=975c1b66f9208e78e25a0e268ea7333c-1659452605321&arrfrr=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptoc...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=qTbqll7Itu2WNJfD-M2Vvw
  • https://d.adroll.com/cm/g/in
42 B
538 B
Image
General
Full URL
https://d.adroll.com/cm/g/in
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Server
52.16.111.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-16-111-147.eu-west-1.compute.amazonaws.com
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:25 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
m.clarity.ms/
0
177 B
XHR
General
Full URL
https://m.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus-f/s/0.6.36/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.124.64 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Tue, 02 Aug 2022 15:03:25 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
/
www.facebook.com/tr/
44 B
91 B
Image
General
Full URL
https://www.facebook.com/tr/?id=389545881899618&ev=PageView&dl=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&rl=&if=false&ts=1659452605502&cd[segment_eid]=T47Y2VPPABDUBJXFROMZZM&sw=1600&sh=1200&v=2.9.69&r=stable&ec=0&o=29&fbp=fb.1.1659452604722.335547448&it=1659452604522&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:25 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Tue, 02 Aug 2022 15:03:25 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A25%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A24%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:25 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
core
js.driftt.com/ Frame F043
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1659452700000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
deb5165f8cb065442e1b79e56eb46b94b03d5ee540031be9578a6b8eb63588d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 02 Aug 2022 15:03:27 GMT
etag
W/"d49f33656c1d4ed049e5c473765f448f"
last-modified
Wed, 20 Jul 2022 18:38:25 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
x-amz-cf-id
Dlrr75ubd9kEM8j9K_2OtRF9Tunjnwyz7U5JOgx2W9U1QAE8RpAc1A==
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
.DpwmuSJDj6tebIsyGBtZIIbHhxqFLP.
x-cache
Hit from cloudfront
chat
js.driftt.com/core/ Frame C813
2 KB
1 KB
Document
General
Full URL
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1659452700000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
deb5165f8cb065442e1b79e56eb46b94b03d5ee540031be9578a6b8eb63588d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 02 Aug 2022 15:03:26 GMT
etag
W/"d49f33656c1d4ed049e5c473765f448f"
last-modified
Wed, 20 Jul 2022 18:38:25 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
x-amz-cf-id
qw6e4nzFs6r3NQPGwoOFRO0GqZmgZGaju0IvUPtw5SRN4gAJdf2Wfg==
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
x-amz-version-id
.DpwmuSJDj6tebIsyGBtZIIbHhxqFLP.
x-cache
RefreshHit from cloudfront
nr-1216.min.js
js-agent.newrelic.com/
38 KB
14 KB
Script
General
Full URL
https://js-agent.newrelic.com/nr-1216.min.js
Requested by
Host: www.proofpoint.com
URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id
mHHzJIqOizHibcYt0xqAszRr0gQRiNYy
content-encoding
gzip
etag
"9f533d8cd24b2c5e3b4dc886ecbd43e8"
x-amz-request-id
W2S5A87EG1C89ADE
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
14391
x-amz-id-2
c9P6myFxLLD3IyZ4P2Q59GznMAh/LL0NtRLP/qzmj57pyyLc8LBRAjUQIZZNiJ5WMagYxPOHvUs=
x-served-by
cache-hhn4071-HHN
last-modified
Thu, 14 Apr 2022 16:45:57 GMT
server
AmazonS3
x-timer
S1659452606.172184,VS0,VE0
date
Tue, 02 Aug 2022 15:03:26 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
8068
300lo.json
m.addthis.com/live/red_lojson/
90 B
250 B
Script
General
Full URL
https://m.addthis.com/live/red_lojson/300lo.json?si=62e93cbc972fdf82&bkl=0&bl=1&pdt=1073&sid=62e93cbc972fdf82&pub=&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=www.proofpoint.com&fp=us%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=0&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&colc=1659452606148&jsl=8193&uvs=62e93cbc7905f3f5000&skipb=1&callback=addthis.cbs.jsonp__138424189055740050
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1659452603674
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.47.212.127 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-47-212-127.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c2523bae2421e6b9f00fa8a16c10ce376e1fb3cd9bc687d55ba662e8f05ca5b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:26 GMT
cache-control
max-age=0, no-cache, no-store, no-transform
content-disposition
attachment; filename=1.txt
content-length
90
content-type
application/javascript;charset=utf-8
sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 7E75
0
0

sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 4FBB
71 KB
26 KB
Document
General
Full URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html
Requested by
Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js?_=1659452603674
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.47.212.127 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-47-212-127.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Referer
https://www.proofpoint.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=86313600
content-encoding
gzip
content-length
26421
content-type
text/html
date
Tue, 02 Aug 2022 15:03:26 GMT
etag
W/"5f971164-11adc"
last-modified
Mon, 26 Oct 2020 18:11:48 GMT
p3p
CP="NON ADM OUR DEV IND COM STA"
server
nginx/1.15.8
strict-transport-security
max-age=15724800; includeSubDomains
timing-allow-origin
*
vary
Accept-Encoding
x-host
s7.addthis.com
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&RedC=c.clarity.ms&MXFR=03C31C27B30A61260A890DD3B70A6F91
  • https://c.clarity.ms/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&MUID=30124BC6A04E6247140B5A32A19C6347
42 B
391 B
Image
General
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&MUID=30124BC6A04E6247140B5A32A19C6347
Protocol
H2
Server
20.234.93.27 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:26 GMT
last-modified
Thu, 28 Jul 2022 20:41:52 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"82531c78c2a2d81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 02 Aug 2022 15:03:26 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 1F1F06129C5242CABA953424B37045E3 Ref B: FRAEDGE1219 Ref C: 2022-08-02T15:03:26Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=7215851339304E759BB06E54CF648CD0&MUID=30124BC6A04E6247140B5A32A19C6347
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
0ae22ad83e
bam.nr-data.net/1/
49 B
711 B
Script
General
Full URL
https://bam.nr-data.net/1/0ae22ad83e?a=573869349&v=1216.487a282&to=bgQBYERQXBBWVBFbDldOIldCWF0NGHMXRxFYDT9aWVVXP3RYC0YTVg0PUURtfAxTUjNbBE4iDFpCQ10PW1IXH19PCAZD&rst=3414&ck=1&ref=https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&ap=703&be=544&fe=3365&dc=1048&perf=%7B%22timing%22:%7B%22of%22:1659452602772,%22n%22:0,%22f%22:0,%22dn%22:1,%22dne%22:205,%22c%22:205,%22s%22:211,%22ce%22:223,%22rq%22:223,%22rp%22:258,%22rpe%22:265,%22dl%22:260,%22di%22:1047,%22ds%22:1048,%22de%22:1076,%22dc%22:3347,%22l%22:3365,%22le%22:3389%7D,%22navigation%22:%7B%7D%7D&fp=780&fcp=1311&at=QkMWFgxKT08VVkcIGkQc&jsonp=NREUM.setToken
Requested by
Host: js-agent.newrelic.com
URL: https://js-agent.newrelic.com/nr-1216.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.241.14 Portland, United States, ASN23467 (NEWRELIC-AS-1, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:26 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
access-control-allow-credentials
true
CF-Ray
7347b3451ca09b34-FRA
runtime~main.1dc87a4c.js
js.driftt.com/core/assets/js/ Frame C813
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
161d2e4c4fd1f0ec119eeb108e12e32175414aee70ece6fd012087d3735a84cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 18:38:24 GMT
content-encoding
gzip
age
1110302
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 16:44:37 GMT
server
nginx
etag
W/"8947057c7560474c4f8e7828a9480ddc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
74Q4hERX_py.7IDHeJ5xlpyXXheunCda
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TLmR_rdvwvBpXjxtuOXuFuR8ZicJB0CIWDSCwqGhCszJV_jcotm-RQ==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame C813
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
_RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ULT68Ve7XE-fII-QOSh0No9kBGy-FAc_K8bLb4-BrzVQy-MC04qOMA==
main~493df0b3.ac3a9470.chunk.js
js.driftt.com/core/assets/js/ Frame C813
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.ac3a9470.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
cc08221e904788853f9dbae9e845e8c88e947de904dcd007c0da0c4d18acd1de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:15 GMT
server
nginx
etag
W/"ab6db2ea528099e4b4bcafc90b1f14a6"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
9qbak4s_fS3U3ItMkJp51dxjDAaDzA89
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ELiQfLAXqV7X3P7nx4wewOUbkD-ZiazL0aTNT1-opFJdJXpD6I0SAA==
47.f4a0cab7.chunk.js
js.driftt.com/core/assets/js/ Frame C813
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/47.f4a0cab7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
dd7e25fe1547c7102760792d7b920ed5a289aa0224014594f856b5ab396dc0d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"58eb1e017120f28c6eea4aa3402a2042"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ghx9KuLEsU65toAWp7tNXfQomgxjyrbm
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
eTjuo2Fewjmfz5YqtA_nFwxPUw8qIi8O_U3Vdc0D9VQk-6HwbHXriA==
22.fd21eb42.chunk.js
js.driftt.com/core/assets/js/ Frame C813
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.fd21eb42.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"cbf1bca421271b2567e00a478296192b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
B9rIJ_he3NnZfaZwCr7GvLzRmtehknn.
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
PQWWW9Qys6AYDsBT-ptbvjWtbvl6bUgLxCuEvbnf9dLurqfGDoI3-Q==
39.0cc86423.chunk.js
js.driftt.com/core/assets/js/ Frame C813
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/39.0cc86423.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"3cbfbd7bb911f7cfc3b4394f334cdb67"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
3g.L2n28pTj8AcDJTW_JUnx4I1CqyPA9
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
jnjajO68-O-_jTDKjxHK6e9YZOwlzNGWaIKkD5OrBiHqiVIgkoKfGg==
18.c13b3a33.chunk.js
js.driftt.com/core/assets/js/ Frame C813
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.c13b3a33.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
e3205178d8f4b21ab5dc10a089939e49dd276dea7b5047ef2b494ffea3b93b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"2e0e21fb7fd3dd146cc688e39d01d42e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
6bdaEoVaogjxYdNJvlFfyTO_1fTxsp6o
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ngPGX1IxVC14lc0BK8xRcoOiOfieco4ymlhViCaalWOTgQM57Iszdw==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame C813
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
GCkJ4tZ_JW3xcmjJsO05feXt7md0igxo
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
PDMhqP5YeBTUUJXpm1h7NCPOFB3gsHUT909B2GkH3xqFWGXTC1z2xA==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame C813
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
cyXTxSuCBvZx654ePqR2xs6GalDG76.D
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xrdBYm0Secr9x4MR1dbb2KZCQUgzVM6Q1_adVjrI4QnNBMV8THWAHA==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame C813
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:12 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
eWIFIo8DxLn4S25aWqEs5lrAyCB0pQZS
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
1Ky5hpCPjlt8u2_VvZGjhxW1-eeymhyCrqCCx16V0vqvxkcPR5T76w==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame C813
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:12 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
g.TAX9Ljd1CKN2hPKg7rBsCyhJ70wktS
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
INKwELRXqaOhnQYoh-ZWzn-MqGc6_DS3FtVZNQVJe0JYJ0fSMK3Vyw==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame C813
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
AZatU1G3W6aZgnPi8EiGVtSbHMH8e_3C
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
5-yy_Qy02Y6DPw9bOyGWbVaoIGxEb3RxPIc2Z-P_BCeJCDnLxZE1WA==
45.772158c8.chunk.js
js.driftt.com/core/assets/js/ Frame C813
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/45.772158c8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
af7690b10b2e4c40106b8e8ac69c9287176615a9913004666af12c98251d6ec0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"e683acc1d1d7a31204545c14f2e45dfc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Wo_uRM2rzEKAIONIW1ozWH.Ih3Zgd.66
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
hXnPF27Uj1oe5DnAYIARljuL4DdeZpfcJdlfqYo89QqzkpjOI3Hbrg==
37.9da17c94.chunk.js
js.driftt.com/core/assets/js/ Frame C813
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.9da17c94.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"e5c98ad7a7e70a1957477e33db39149c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
.1KvOWwhKDvJVSWzg49IMEkznsWNUcpl
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
OrGwEhWPMUKbKdWDi54P7Ga0_TJQT6NJVfa2tTE0pqjD8I7zqGzy0A==
28.ed383893.chunk.js
js.driftt.com/core/assets/js/ Frame C813
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.ed383893.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
8843d0dae7daa6e3bdf06e07ffb65e5b5240268203496f5946dcdda9cc0c290d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"910117b3f0a0501f693606963bfe4daf"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
W4iSCS77kEC.SSNCcLhsvI35ESlRZh_5
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
mn-pucrHapzwBDuJmMq_Br4KAmI9-vaJwwPMoNxJdeXiOptAbChp3g==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame C813
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
IYcZXStVL2CjeeCB9Www5YnCHKJfMMCs
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2gglT-6HFX6leo5ChnUMLk7W87S1QR0vbIEK7doyJByLupDZNjyYDA==
9.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame C813
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.5b0bb1c3.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"e3c43c4a3d2f4cee45cccdb6e438af66"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
hokYckg1IjTUPfKmbuCy6NNmRFmQH3VZ
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
dM1EhG1mP-qz60UZj9w7-ZqqQaug0cC98ZvNhWZlGicOaj8BsGeilQ==
9.de66fab9.chunk.js
js.driftt.com/core/assets/js/ Frame C813
70 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.de66fab9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
1e4b8d2a1a5eb9645fb77c0098d1beb8ec3f1d61b0a7c839020e011c5fc6405c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 19:59:55 GMT
content-encoding
gzip
age
2228611
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 07 Jul 2022 19:52:25 GMT
server
nginx
etag
W/"ef598b1b9b0d4c5cfa234e88c492fb54"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
xlrlond4mkcKce5GwVG63yxfBKTJMgSJ
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RpWaPMfp1yUdltV9kAg8JIAxjLBeAZ7SfdxAieNpc2DvgUYy9KOypA==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame C813
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ykspFRt4QsihJmMduj_fPY2DMuvVpMeo
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RbT-_keeK_pTGSb81z4DmFRWNlAEwqBs9Dl9BRze5hekfJQlU0_1kQ==
17.b33a6e0b.chunk.js
js.driftt.com/core/assets/js/ Frame C813
77 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.b33a6e0b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
fbb446b79860a9c66ba04749477ac274776acf05e4be0c6937a499e1e7131129
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 19:59:55 GMT
content-encoding
gzip
age
2228611
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 07 Jul 2022 19:52:21 GMT
server
nginx
etag
W/"d622c1f193e6a4565f5bd9832b23517c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
sjzd4G0YdH5FL1WzzvugcXYiMituXTPF
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LJoJ5AkhWOetPGTnHPWgg6pgBKPmUZ0UNoCM_vLKTGVIYQVuVGW4CQ==
24.8603213a.chunk.js
js.driftt.com/core/assets/js/ Frame C813
48 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.8603213a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
37c18698722c6a2e4940ee3f65d56e08ad88d779ba3be1865396ac38e91d62ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 30 Jun 2022 19:02:44 GMT
content-encoding
gzip
age
2836842
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 30 Jun 2022 18:14:23 GMT
server
nginx
etag
W/"b8776dcc5c1a3083223a0463a48e260a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
MNLYGPrRxdrdE8i61mB8AAl9xMksDWt5
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Hfle8OlOsTb3UPWXFRGw5d40EYpn_ieFPaPi6NYf3GLRPd6m3LjHMA==
15.c7451cb1.chunk.js
js.driftt.com/core/assets/js/ Frame C813
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.c7451cb1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
a16acf2285039cf9b26e23dd5819c280e41b3be57a21dc66bf7be03021eca5b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 18:38:24 GMT
content-encoding
gzip
age
1110302
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"bca1955479d71633609aba2bf98e3cdd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
D3JBaP.DPp0we9d4hquZFIGys3feQnVs
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0QYGhTM4-TDP3si3WSWIEZS4g-2Qwfy5PElJceokjOLETIyWfAI1Fw==
34.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame C813
3 KB
1 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/34.11d2b6a7.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"87532c4db85f1429fa6d759bc3332f36"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
pDgWOASMN9_NDbkmryYYC4K2HoZ50omL
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Zal_s7P7gtrE3Guoz0zMqxueZO-xLS5rMZLgfRQ5SFc3nLQIWobbRg==
34.07340d2f.chunk.js
js.driftt.com/core/assets/js/ Frame C813
3 KB
2 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/34.07340d2f.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
5949dc5ef9ac0f8cb0d210d221d6eceeca2ffad94e3600b41566f468e146ae9a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 14:14:39 GMT
content-encoding
gzip
age
3977327
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 17 Jun 2022 13:01:30 GMT
server
nginx
etag
W/"f732dfb3db72f996e1f4bc0225629a20"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
HvgZCV9LNyT7x7vVdSj885BtX9dyNytM
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
90K0lvKCW4BwmSbJEYDEEcKsii5o5Yu5YzKQ0SU2iRXpjb8dcElnZA==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame C813
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 23:25:32 GMT
content-encoding
gzip
age
3512274
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 17 Jun 2022 14:39:26 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
FXhpBdntUhclEQbRyN38j73SJPN5DG6s
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
tobq9B_4XBj6nUjifWGvpO6FDKx3q8qUXQNG0_Rzf_3LDsvV2SO4-w==
3.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame C813
7 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/3.07aa08a5.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"189aeffd571884559dababa22c66d75a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
qCJlHTNUr2HFRH6Ajng7Ce3aN.cZgspN
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
TXgDI2vsERFzu4QqwY7cToAiXapuG6NsYBMjQ9MyuO76CEc3yvRINQ==
3.00aa1009.chunk.js
js.driftt.com/core/assets/js/ Frame C813
54 KB
16 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/3.00aa1009.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
b8eef39219651c2e824894e8f8d35742e86021c1a556136fb6ffc5e1169bccbd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"b6e857285e106c4d697971a13a9e5f01"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
5X0O2ApU5vgBeUnxDu8Cb4hnMjQt6Q5W
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
RgCjRDa3b2CElOXsQCa3VuelOCBBQHcbqaLgv50Qmh8YhjnCd7yoKg==
1.2a811815.chunk.css
js.driftt.com/core/assets/css/ Frame C813
43 KB
7 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/1.2a811815.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
5c09e8bec292a5b43b6a5be55beb50de7bf16c101bf236faa43e49ce70f8c229
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Fri, 17 Jun 2022 14:14:39 GMT
content-encoding
gzip
age
3977327
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 17 Jun 2022 13:01:27 GMT
server
nginx
etag
W/"cffa309af51f35e8b5792ddf3e06a80b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
VUaHAxuPIr8zCHoCffr5ySO3Had_qiEc
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
xIz_t4sNoLsnfe_57qBQurm6W_fmnbAxPIBFCER-rhZsULkRuxrQ9A==
1.f0c05bdf.chunk.js
js.driftt.com/core/assets/js/ Frame C813
73 KB
25 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/1.f0c05bdf.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
09410642edee2a495d333f89ddf4c4a09dc9218c93de7d4d7d981117fe9d56b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 30 Jun 2022 19:02:44 GMT
content-encoding
gzip
age
2836842
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 30 Jun 2022 18:14:21 GMT
server
nginx
etag
W/"97f33a213b4ee5c284a67db4791de6fa"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
0D6bsqEtygBehCY0YETmhhunXna8dEK1
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
kAG3OF00S5SZoMsZBpJiUul-tdDlojdGlpbKayVsRg-V5JeV38y5ww==
32.52060f2d.chunk.css
js.driftt.com/core/assets/css/ Frame C813
12 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/32.52060f2d.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"b63021470083bdc161ef4dda2e4912c3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
D63PtXL5bP.wpWr.uBaG9A4P_yKmwfSx
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
i2uxPbYlm8aXQKjva9xupYk5kolAvSM6HgOt5R4MwzFDrLehJXhvrA==
32.339f8363.chunk.js
js.driftt.com/core/assets/js/ Frame C813
11 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/32.339f8363.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
88d623d347bc1d092c1d546f62ac989acddceb46ca869c4b48adb62e229daee5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1659452603037
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 30 Jun 2022 19:02:44 GMT
content-encoding
gzip
age
2836842
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 30 Jun 2022 18:14:23 GMT
server
nginx
etag
W/"566a10802a29d81a470d77eb56b23265"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
M0iCQaZ.gGkZ8Ke.B5BxYnub2OI8YHSv
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
su-9wUkMPPOwW-_9Ij4svvkWNFWdar3dMTJt15ob81KEHaBjoJHFdw==
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A26%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A25%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:26 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
m.clarity.ms/
0
48 B
XHR
General
Full URL
https://m.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus-f/s/0.6.36/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.124.64 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Tue, 02 Aug 2022 15:03:26 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
runtime~main.1dc87a4c.js
js.driftt.com/core/assets/js/ Frame F043
6 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
161d2e4c4fd1f0ec119eeb108e12e32175414aee70ece6fd012087d3735a84cb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 18:38:24 GMT
content-encoding
gzip
age
1110303
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 16:44:37 GMT
server
nginx
etag
W/"8947057c7560474c4f8e7828a9480ddc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
74Q4hERX_py.7IDHeJ5xlpyXXheunCda
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
VPlp_vzc_9DfCtoBjA845y5pcpoOJBzWUJ7UItT4I_r1HwLQkBKjrg==
8.611ead2e.chunk.js
js.driftt.com/core/assets/js/ Frame F043
35 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/8.611ead2e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"6aa29962f34a8e117268142c7cc1cc3d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
_RZ1GDjUm5KuW3ooz6jLFMyJffaKXq96
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
99_bA0GjRPl2OFBJuCVwYifN8fcENg5u7ImfbPxemhP-klHQmaE6sQ==
main~493df0b3.ac3a9470.chunk.js
js.driftt.com/core/assets/js/ Frame F043
7 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/main~493df0b3.ac3a9470.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
cc08221e904788853f9dbae9e845e8c88e947de904dcd007c0da0c4d18acd1de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
Origin
https://js.driftt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:15 GMT
server
nginx
etag
W/"ab6db2ea528099e4b4bcafc90b1f14a6"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
9qbak4s_fS3U3ItMkJp51dxjDAaDzA89
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fNx-4LZ553BabyOHUH5qafuQa2QrY5P1Y8x6nZY9-x-qcxtOyN2H8w==
47.f4a0cab7.chunk.js
js.driftt.com/core/assets/js/ Frame F043
47 KB
14 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/47.f4a0cab7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
dd7e25fe1547c7102760792d7b920ed5a289aa0224014594f856b5ab396dc0d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"58eb1e017120f28c6eea4aa3402a2042"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ghx9KuLEsU65toAWp7tNXfQomgxjyrbm
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vb1SpEjIuDNEsZeqBzeRc7wNx22zQ7n0Fc5ENtAvesy_MX_Z5EiIcg==
22.fd21eb42.chunk.js
js.driftt.com/core/assets/js/ Frame F043
44 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/22.fd21eb42.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"cbf1bca421271b2567e00a478296192b"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
B9rIJ_he3NnZfaZwCr7GvLzRmtehknn.
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
EoA1W9EsMqTHopU9B7BGYnFkuVXcLHhmSxvcCmy26KAg9CkfaJPUwA==
39.0cc86423.chunk.js
js.driftt.com/core/assets/js/ Frame F043
25 KB
8 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/39.0cc86423.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"3cbfbd7bb911f7cfc3b4394f334cdb67"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
3g.L2n28pTj8AcDJTW_JUnx4I1CqyPA9
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
MnKwp6zhwA5BjeaGwUHIgXUVcR-T55I8GNj-MNnBCQKgn3ZqSLyjZQ==
18.c13b3a33.chunk.js
js.driftt.com/core/assets/js/ Frame F043
16 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/18.c13b3a33.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
e3205178d8f4b21ab5dc10a089939e49dd276dea7b5047ef2b494ffea3b93b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"2e0e21fb7fd3dd146cc688e39d01d42e"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
6bdaEoVaogjxYdNJvlFfyTO_1fTxsp6o
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
HVv_WQRqCJtNSmBoVR27Yyus0y7k1oNXdTRWv_9f1-ia2hhHYKnQbw==
20.8c21ea18.chunk.js
js.driftt.com/core/assets/js/ Frame F043
74 KB
23 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/20.8c21ea18.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"6d77a76055d81227033363af2f18caf8"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
GCkJ4tZ_JW3xcmjJsO05feXt7md0igxo
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
LWiOUktJwFajDTlxNkDFX9k8wajAJUv2hPEMGnOWIzBezrhJD87JxA==
25.8f107198.chunk.js
js.driftt.com/core/assets/js/ Frame F043
59 KB
19 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/25.8f107198.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"e2511c69e5bdc03467952abaccdb5383"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
cyXTxSuCBvZx654ePqR2xs6GalDG76.D
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
uZxgzr2OZQoSZSdTv_6erJaCqJNywTdFLylS0NvkBRDJVxhQTQoBxA==
13.3e86f1f6.chunk.js
js.driftt.com/core/assets/js/ Frame F043
91 KB
28 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/13.3e86f1f6.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:12 GMT
server
nginx
etag
W/"fdee1a560ca08e3d3702e14d8f1f0b82"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
eWIFIo8DxLn4S25aWqEs5lrAyCB0pQZS
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
0fHsj6JUGuy4c-jeZ_bJn1FUHRhBA7MATqpop2qqofaV9LJN_hUN0Q==
11.639238ba.chunk.js
js.driftt.com/core/assets/js/ Frame F043
23 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/11.639238ba.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:12 GMT
server
nginx
etag
W/"4049f38c00add1738dc4806148ff8829"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
g.TAX9Ljd1CKN2hPKg7rBsCyhJ70wktS
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
zdEuGEd7_zm9XGu6ok7zi0AIGOHeojIPPhfQChEPlszHUw3fGZcBDA==
16.fde6fa28.chunk.js
js.driftt.com/core/assets/js/ Frame F043
62 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/16.fde6fa28.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"90795af8c950a50300cf801b300db7ab"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
AZatU1G3W6aZgnPi8EiGVtSbHMH8e_3C
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
3eUD9_QWpeNQWgCjSSoN7_xjUunVt0x6WBPcEqyzzoPxhefgP0S8ow==
45.772158c8.chunk.js
js.driftt.com/core/assets/js/ Frame F043
105 KB
34 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/45.772158c8.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
af7690b10b2e4c40106b8e8ac69c9287176615a9913004666af12c98251d6ec0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"e683acc1d1d7a31204545c14f2e45dfc"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Wo_uRM2rzEKAIONIW1ozWH.Ih3Zgd.66
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2Euym4X1RPPZfvIcmav4QvvPWdOcdNBCdoj8J1_SvyWpN3RN4IrDzQ==
37.9da17c94.chunk.js
js.driftt.com/core/assets/js/ Frame F043
12 KB
4 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/37.9da17c94.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:14 GMT
server
nginx
etag
W/"e5c98ad7a7e70a1957477e33db39149c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
.1KvOWwhKDvJVSWzg49IMEkznsWNUcpl
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
pF8R62j3jBsyhgSf3Ibi_O6atPyJCR__bPEkQ1VII6vwnFhdYagY4Q==
28.ed383893.chunk.js
js.driftt.com/core/assets/js/ Frame F043
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/28.ed383893.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
8843d0dae7daa6e3bdf06e07ffb65e5b5240268203496f5946dcdda9cc0c290d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"910117b3f0a0501f693606963bfe4daf"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
W4iSCS77kEC.SSNCcLhsvI35ESlRZh_5
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
Kd7EzuK62f0PzFQIuSbE0ADEEec07fCN3y3fg3ckjz4rPJfKGno_UA==
21.b8c41db9.chunk.js
js.driftt.com/core/assets/js/ Frame F043
17 KB
7 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/21.b8c41db9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"65e5c965272e021ae33ff8bc39565ef5"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
IYcZXStVL2CjeeCB9Www5YnCHKJfMMCs
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
DG05EkWswKSk_iCFCNPx3_llJ7dyljZfG2o2_Mjwfhg7zYozzGoW1A==
9.5b0bb1c3.chunk.css
js.driftt.com/core/assets/css/ Frame F043
11 KB
3 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/9.5b0bb1c3.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
content-encoding
gzip
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"e3c43c4a3d2f4cee45cccdb6e438af66"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
hokYckg1IjTUPfKmbuCy6NNmRFmQH3VZ
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
vJP9Hy3oNDgpLL4TW8zYDrALtDyqkNnEox-5iPZSHp2LG3Tqm_evcw==
9.de66fab9.chunk.js
js.driftt.com/core/assets/js/ Frame F043
70 KB
22 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/9.de66fab9.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
1e4b8d2a1a5eb9645fb77c0098d1beb8ec3f1d61b0a7c839020e011c5fc6405c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 19:59:55 GMT
content-encoding
gzip
age
2228612
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 07 Jul 2022 19:52:25 GMT
server
nginx
etag
W/"ef598b1b9b0d4c5cfa234e88c492fb54"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
xlrlond4mkcKce5GwVG63yxfBKTJMgSJ
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
H1QrwPM9zwAcn29X9OxmgtOJGM8z9jHB2LPVsXgVmYEbdC7wA5Z8-A==
17.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame F043
24 B
667 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/17.22abfce0.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:49 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
age
4647818
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
24
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
"0c5dad92482d9a7c7c253510f5082465"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
ykspFRt4QsihJmMduj_fPY2DMuvVpMeo
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ATiiLzyRiND5YvZnhDEGafP3nmt23KP6shH5PrQqzYa3J4JwoEVWtA==
17.b33a6e0b.chunk.js
js.driftt.com/core/assets/js/ Frame F043
77 KB
20 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/17.b33a6e0b.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
fbb446b79860a9c66ba04749477ac274776acf05e4be0c6937a499e1e7131129
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 07 Jul 2022 19:59:55 GMT
content-encoding
gzip
age
2228612
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 07 Jul 2022 19:52:21 GMT
server
nginx
etag
W/"d622c1f193e6a4565f5bd9832b23517c"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
sjzd4G0YdH5FL1WzzvugcXYiMituXTPF
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
OFaYgewfjmOIooexdyQKURHvF4XZVf0gN3aNly-ECmFk6V4KJdXXYw==
24.8603213a.chunk.js
js.driftt.com/core/assets/js/ Frame F043
48 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/24.8603213a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
37c18698722c6a2e4940ee3f65d56e08ad88d779ba3be1865396ac38e91d62ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 30 Jun 2022 19:02:44 GMT
content-encoding
gzip
age
2836843
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 30 Jun 2022 18:14:23 GMT
server
nginx
etag
W/"b8776dcc5c1a3083223a0463a48e260a"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
MNLYGPrRxdrdE8i61mB8AAl9xMksDWt5
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
gqyGUpYWAQf_82HIVCDV5UgbebHgB_i3BJF03dJ85JiDTjYe_not5g==
15.c7451cb1.chunk.js
js.driftt.com/core/assets/js/ Frame F043
40 KB
13 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/15.c7451cb1.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
a16acf2285039cf9b26e23dd5819c280e41b3be57a21dc66bf7be03021eca5b4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 18:38:24 GMT
content-encoding
gzip
age
1110303
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"bca1955479d71633609aba2bf98e3cdd"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
D3JBaP.DPp0we9d4hquZFIGys3feQnVs
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
2Hz3L7bNmNnfsiIybNhYZoAc4sX2j-YJPYZk-7kIjhkGlnNvyAwtpg==
0.0b2ebd4a.chunk.js
js.driftt.com/core/assets/js/ Frame F043
9 KB
3 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/0.0b2ebd4a.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 22 Jun 2022 23:25:32 GMT
content-encoding
gzip
age
3512275
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Fri, 17 Jun 2022 14:39:26 GMT
server
nginx
etag
W/"c5efcdc9e465604f32cf24af10fd6c13"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
FXhpBdntUhclEQbRyN38j73SJPN5DG6s
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
E8FevUARaWiUfwguptJmYVrG-QOo3iH6FQXtJn72pAqOnJ03pTsByw==
26.a5fa75d7.chunk.js
js.driftt.com/core/assets/js/ Frame F043
33 KB
10 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/26.a5fa75d7.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
72d52dcf32b1f0357fdb9688cb7d59dd429ed01f5bf3098825191ba7e244927c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647817
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:13 GMT
server
nginx
etag
W/"07c533e32590bc52ac1b137167ac3d81"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
Om6KhJpoRUYTr7Om8uqiUaVuwIdIX9mR
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
KomkOGrK6OcXNeCr6L3pGBFwEN7cAatSF1v73R_oklP0vMr1ajiUrg==
27.c667535c.chunk.css
js.driftt.com/core/assets/css/ Frame F043
8 KB
2 KB
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/27.c667535c.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
8b7be87db71855fe47b30e1a60953e25a0e6a832e4ff3fefa682cf74d9e66cf0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 09 Jun 2022 19:59:50 GMT
content-encoding
gzip
age
4647816
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 09 Jun 2022 14:58:11 GMT
server
nginx
etag
W/"5d56f3a89744b768e05433ac1e2f7935"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
xlq0zBG2KT_EHoSQ.8VBH19dO.kmmlfU
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
ba8ZyELMNU90k9WdXjzggnCoNs08iPE1Azx873RJhFEQngqMPToq3w==
27.795499fe.chunk.js
js.driftt.com/core/assets/js/ Frame F043
12 KB
5 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/27.795499fe.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
cbd1fd9e5454ee302f349f7a91241a8e37f4daf59dfbbfb26d8c76d4ec49fac9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Thu, 30 Jun 2022 19:02:44 GMT
content-encoding
gzip
age
2836843
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Thu, 30 Jun 2022 18:14:23 GMT
server
nginx
etag
W/"5277c592e20a97f12101fb9221e1083d"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
m7G6eGFZsSIOgQehhjNZaVndQOLVU8F2
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
fw41djMH07PwXSjHRHCCr_DMXWQVJJotKGlwZOAfMvdjkft5iwZM6A==
19.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame F043
365 B
1009 B
Stylesheet
General
Full URL
https://js.driftt.com/core/assets/css/19.c695453b.chunk.css
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 08 Jun 2022 08:38:41 GMT
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
age
4775086
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
365
last-modified
Fri, 22 Apr 2022 20:24:53 GMT
server
nginx
etag
"06b2963b029c0824382815165bfea73e"
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
L3VGtilyy25ajd6juXICRdarj04czsmC
access-control-allow-origin
*
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
accept-ranges
bytes
content-type
text/css
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
nRZOPW8fwc2qlYxANaJjjzC2U_ajtYKLvkoSfJfKByKbr2ZnfNNN9w==
19.ecb8868e.chunk.js
js.driftt.com/core/assets/js/ Frame F043
87 KB
24 KB
Script
General
Full URL
https://js.driftt.com/core/assets/js/19.ecb8868e.chunk.js
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.1dc87a4c.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.91 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-91.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
cc6d6e78796fdb307f12b0d106259901087bf4bdd693a149f2ebc83cdaf1ecb8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://js.driftt.com/core?embedId=5dfsgn7m2kst&region=US&forceShow=false&skipCampaigns=false&sessionId=07e67ae4-d949-4ccd-9bd9-b16eefd5266e&sessionStarted=1659452606.121&campaignRefreshToken=f4e381be-3e6e-4d6b-af34-79ecd6d03b52&hideController=false&pageLoadStartTime=1659452603037&mode=CHAT&driftEnableLog=false&secureIframe=false
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 18:38:25 GMT
content-encoding
gzip
age
1110302
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
*
last-modified
Wed, 20 Jul 2022 16:44:35 GMT
server
nginx
etag
W/"332c765e55f58368caaae470b43949ca"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
x-amz-version-id
HdbdVi1.gbgr7_W0CUMXFLUjYdP.ZHwR
via
1.1 80c1ad5f9352d00b95a9da73eb6b6be4.cloudfront.net (CloudFront)
cache-control
max-age=31536000
access-control-allow-credentials
true
x-amz-cf-pop
FRA50-C1
content-type
application/javascript; charset=utf-8
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
lEnrL-IZHBeAy__Wx7gfTFG2G4poGnmIEu8254nLiSTOKI27m-yEnw==
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame F043
25 B
123 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/47.f4a0cab7.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 02 Aug 2022 15:03:27 GMT
server
istio-envoy
requestid
a093d68912d31ec9
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
16
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/widget/init/v2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Tue, 02 Aug 2022 15:03:27 GMT
requestid
driftaf41a04415e8ff9688082586733
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame F043
177 B
275 B
XHR
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/47.f4a0cab7.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
fa8c32e4cf3d3e6a515ed02bcb7c24c87a1371ff8b888ca12332e4da8e4c5e65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 02 Aug 2022 15:03:27 GMT
server
istio-envoy
requestid
8297fd710ad64334
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
2
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
177
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
ping
bootstrap.api.drift.com/widget_bootstrap/ Frame
0
0
Preflight
General
Full URL
https://bootstrap.api.drift.com/widget_bootstrap/ping
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.113.164 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-113-164.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Tue, 02 Aug 2022 15:03:27 GMT
requestid
driftc9dbba94205bedb337ed744b56a
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
1
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A26%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:27 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
ip.json
api.company-target.com/api/v2/
444 B
948 B
Fetch
General
Full URL
https://api.company-target.com/api/v2/ip.json?key=79a80d0e3f65c8809c2d2c9dda90c2b5&page=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&page_title=Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US&referrer=
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/include/1659452700000/5dfsgn7m2kst.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.101 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-101.fra50.r.cloudfront.net
Software
nginx /
Resource Hash
45a3e44c1347d274cfbf71f7b942211eb9fd780c397150c4be62df62adfed0df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Tue, 02 Aug 2022 15:03:28 GMT
identification-source
CENTRAL
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
request-id
de15a698-43a9-4958-8e3f-a2b0b6c64cac
content-encoding
gzip
pragma
no-cache
access-control-allow-origin
https://www.proofpoint.com
server
nginx
access-control-max-age
7200
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json;charset=utf-8
via
1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
access-control-expose-headers
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
api-version
v2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
58s_K4ku-b2yWh2NuVmm9hJFbE1GZxsN_1i5peQQmLQFUAGv90radg==
expires
Mon, 01 Aug 2022 15:03:28 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A27%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:28 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
m.clarity.ms/
0
48 B
XHR
General
Full URL
https://m.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus-f/s/0.6.36/clarity.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.124.64 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.proofpoint.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-origin
https://www.proofpoint.com
date
Tue, 02 Aug 2022 15:03:28 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A28%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:29 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame F043
25 B
89 B
XHR
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Requested by
Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/47.f4a0cab7.chunk.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json, text/plain, */*
Referer
https://js.driftt.com/
Authorization
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 02 Aug 2022 15:03:30 GMT
server
istio-envoy
requestid
d7c151c9b59293a3
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-max-age
1209600
access-control-allow-credentials
true
x-envoy-upstream-service-time
11
strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length
25
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
bulk
metrics.api.drift.com/monitoring/metrics/event2/ Frame
0
0
Preflight
General
Full URL
https://metrics.api.drift.com/monitoring/metrics/event2/bulk
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.94.218.138 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-94-218-138.compute-1.amazonaws.com
Software
istio-envoy /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://js.driftt.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-allow-origin
*
access-control-expose-headers
X-Results-Total-Count,X-Page-Info
access-control-max-age
1209600
allow
POST,OPTIONS
content-length
13
content-type
text/plain
date
Tue, 02 Aug 2022 15:03:30 GMT
requestid
drifta8808184c66bf21d48e8916226c
server
istio-envoy
strict-transport-security
max-age=31536000; includeSubDomains
x-envoy-upstream-service-time
0
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=76d4adecd2340b300ba5d4296ecef89d&svisitor=7d17655f003a0000bc3ce9626402000026834500&session=05b408cf-a39c-4d80-89a9-721eb92f5260&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2002%20Aug%202022%2015%3A03%3A29%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226007%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Buy%2C%20Sell%2C%20Steal%2C%20EvilNum%20Targets%20Cryptocurrency%2C%20Forex%2C%20Commodities%20%7C%20Proofpoint%20US%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.proofpoint.com%2Fus%2Fblog%2Fthreat-insight%2Fbuy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities&pageViewId=0b91eea5-bc3e-4fe7-8662-281f273ba6ad&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.103.80.163 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-103-80-163.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.proofpoint.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 02 Aug 2022 15:03:30 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
s7.addthis.com
URL
https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Verdicts & Comments Add Verdict or Comment

238 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| dataLayer object| google_tag_manager object| google_optimize object| NREUM object| newrelic function| __nr_require object| Modernizr object| MktoForms2 function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_tag_data object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments function| once function| ownKeys function| _objectSpread function| _defineProperty function| _ function| jQuery undefined| $ object| Backbone object| drupalSettings object| Drupal object| picturefillCFG function| picturefill object| tabbable object| Cookies object| geoip2 object| MunchkinTracker function| _toConsumableArray function| _nonIterableSpread function| _unsupportedIterableToArray function| _iterableToArray function| _arrayWithoutHoles function| _arrayLikeToArray function| BaseClass object| webpackJsonp object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| FontAwesomeConfig object| ___FONT_AWESOME___ boolean| VimeoPlayerResizeEmbeds_ function| subscribeToMarketoFormEvent object| addthis_config object| addthis_share function| postscribe object| google_tag_manager_external string| GoogleAnalyticsObject function| ga function| twq function| hj object| _hjSettings object| vimeoGAJS string| _linkedin_partner_id object| _linkedin_data_partner_ids object| _vwo_code number| settings_timer number| _vwo_settings_timer object| _rctfl string| axel number| a function| drift undefined| driftt function| fbq function| _fbq object| techtargetic function| lintrk function| processEpsilonData string| epsilonName boolean| enabled function| callback number| version object| _6si string| adroll_adv_id string| adroll_pix_id boolean| __adroll_loaded function| __extends object| Demandbase object| __db function| DBSegment function| google_trackConversion object| GooglebQhCsO function| onYouTubeIframeAPIReady object| gaGlobal boolean| _already_called_lintrk function| UET function| UET_init function| UET_push object| ueto_7440207108 object| uetq object| twttr object| gaplugins object| gaData object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules function| atwpjp string| _atd function| _euc function| _duc object| _atc string| _atr object| addthis function| emdot object| _ate object| _adr object| addthis_conf function| addthis_open function| addthis_close function| addthis_sendto undefined| b number| _vwo_j_e string| _vwo_mt string| _vwo_tm object| vwo_iehack_queue function| addCaptchaScript object| jQuery112408172436084607198 number| timer_e string| adroll_sid object| adroll object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks undefined| adroll_tpc_callback object| m object| __adroll_consent_data object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_16__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked function| _rtfl_jsonp_0 boolean| _storagePopulated object| adroll_exp_list function| dbAsyncInit function| Sizzle function| db_hook_init function| db_hook_all_hit function| db_hook_response function| db_hook_no_id function| db_hook_attr function| db_hook_before_parse function| db_hook_after_parse object| jQuery1121004494899042232858 boolean| __@@##MUH function| clarity boolean| __adroll_consent boolean| __adroll_consent_is_gdpr string| __adroll_consent_user_country string| __adroll_consent_adv_country number| adroll_lex33_called object| adroll_currency object| adroll_conversion_value object| adroll_conversion_value_in_dollars string| adroll_seg_eid boolean| adroll_sendrolling_cross_device object| adroll_form_fields string| adroll_rule_type function| __adroll_idem0 object| drift_event_listeners string| drift_display_mode string| drift_campaign_refresh number| drift_page_view_started number| drift_session_started string| drift_session_id object| oattr

78 Cookies

Domain/Path Name / Value
www.proofpoint.com/us/blog/threat-insight Name: hide_lang_switcher
Value: 1
.proofpoint.com/ Name: visid_incap_177663
Value: 06MAvPgyRqyLwpWAjN/Bgro86WIAAAAAQUIPAAAAAACdQgOEXAEj4vxhyQd1ypoK
.proofpoint.com/ Name: incap_ses_877_177663
Value: atZNQVvuLD4ooFLRhrsrDLo86WIAAAAAt7fT674R5ig6kvP9NkW30w==
.app-abj.marketo.com/ Name: __cf_bm
Value: kbaw4cOjfLpnJX4qo.H1jfkTVwTG0WftGV.k5MUss78-1659452603-0-AXcpHN8IywspfSeGa+geKG6X+brbBo/9t0XEktxAtlrLJ065qZ3khO2U+4kIX7ITrrmyy09vB14gKP/5wonUCGQ=
.proofpoint.com/ Name: _mkto_trk
Value: id:309-RHV-619&token:_mch-proofpoint.com-1659452603721-69287
.proofpoint.com/ Name: _gcl_au
Value: 1.1.1659421903.1659452604
.bing.com/ Name: MUID
Value: 30124BC6A04E6247140B5A32A19C6347
.proofpoint.com/ Name: _ga_B1V8SZE3GL
Value: GS1.1.1659452604.1.0.1659452604.0
.proofpoint.com/ Name: _uetsid
Value: 41727f50127411edb35667ab7257b730
.proofpoint.com/ Name: _uetvid
Value: 4172a7d0127411ed8abcbdb7e4159cbb
.doubleclick.net/ Name: IDE
Value: AHWqTUnuV33SaS33QZ_Sn4IZSjbjJ2rdUSQFqddtapuKF6knn3xZ-iCVxvkChW5A
.proofpoint.com/ Name: _ga
Value: GA1.2.1266778076.1659452604
.proofpoint.com/ Name: _gid
Value: GA1.2.814220863.1659452604
.proofpoint.com/ Name: _gat_UA-2257074-1
Value: 1
.proofpoint.com/ Name: _vwo_uuid_v2
Value: D8C333896BF9A1AA591147053DB178082|f1f52251f8cca7dcb1d4c8d03d918dc0
ads.avct.cloud/ Name: uuid
Value: 55bf37a7-f069-44f6-b3e2-9ebe84eb409b
.techtarget.com/ Name: __cf_bm
Value: fW3SQQ9Epa7bzhFagdAsmSDED_yvzGU6Aaa5Gw3sxyM-1659452604-0-AUY9553eXm+cFRuBJ0c/JPViPHyttvqsDtRV/NLG1OmveAOTLwobEKSQG7V3FUihQ2MqgveITniTc7BMgEY38Ig=
.6sc.co/ Name: 6suuid
Value: 7d17655f003a0000bc3ce9626402000026834500
.proofpoint.com/ Name: _fbp
Value: fb.1.1659452604722.335547448
tracking.g2crowd.com/ Name: _session_id
Value: f50e693a5f926e1fc22204e1cac79dcf
.g2crowd.com/ Name: __cf_bm
Value: xjTiZ51jCNcARGstNcOIq3feXNqpT6eUY2SoK2sHax8-1659452604-0-AYGYzSZnRpLkHUz3/xvFQbtlI+qhsovLJ9Xofl1kfZLCtq/wOWJ/i/mWS/+krUchrEQxl6l8FSzKW+/UF5GmRHs=
.www.proofpoint.com/ Name: _rtfl_s_handshake_guid
Value: 9ae3b0f8-477e-47f3-9d94-a712ff1ee185
.mathtag.com/ Name: uuid
Value: b3d962e9-3cbc-4200-9aee-7a9988bb2bd3
www.proofpoint.com/ Name: _an_uid
Value: 0
www.proofpoint.com/ Name: _gd_visitor
Value: a95f4628-f72b-4a3c-8993-e7705277eb60
www.proofpoint.com/ Name: _gd_session
Value: 05b408cf-a39c-4d80-89a9-721eb92f5260
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
www.proofpoint.com/ Name: _gd_svisitor
Value: 7d17655f003a0000bc3ce9626402000026834500
.linkedin.com/ Name: UserMatchHistory
Value: AQIZ8lyzlilM6wAAAYJfFUFTkKj3ZotqBOiq9fUJS6rpO4vx6EftnADxiZulxkKZP3x8WvyNgbCmQQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKko7Au7AnE5AAAAYJfFUFTucImtmmLT1HZQpwi3y6R-17bg6asSfumKDns_f103zCt0wXtu5VatjbljDYsQw
.linkedin.com/ Name: bcookie
Value: "v=2&d4b75e93-5a2c-401d-866c-f8b263110b75"
.linkedin.com/ Name: lidc
Value: "b=TGST09:s=T:r=T:a=T:p=T:g=2351:u=1:x=1:i=1659452604:t=1659539004:v=2:sig=AQFdmH3PbM13JutBDIbtWaTDdi9akFLW"
.bidr.io/ Name: bito
Value: AACjlU7F0nkAABBzS8j6LA
.bidr.io/ Name: bitoIsSecure
Value: ok
.adnxs.com/ Name: uuid2
Value: 9006202609544540301
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.t.co/ Name: muc_ads
Value: f5465ad6-2864-414b-a496-1c152301ed4e
.twitter.com/ Name: personalization_id
Value: "v1_DOqPri8p1WWKgFho0ADoug=="
.www.linkedin.com/ Name: bscookie
Value: "v=1&202208021503246bd7d378-4e9a-47b2-81fa-c16573fc531fAQEYuatNCgvzo6C4kN2LNubCGOLmuIs4"
.company-target.com/ Name: tuuid
Value: bd66856f-68fe-4e2f-8aca-f89f101c3267
.company-target.com/ Name: tuuid_lu
Value: 1659452605
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTk0NTI2MDU7MjswMjHBclQ2uQGfBwDYegldg7c1+H474QF56x5ntllHidttBA==
.proofpoint.com/ Name: _hjSessionUser_1456002
Value: eyJpZCI6ImIzNmQxMzgxLTZmMDctNTczMy1hNTFkLTRmYTNhMTllOTgxZiIsImNyZWF0ZWQiOjE2NTk0NTI2MDUxNDUsImV4aXN0aW5nIjpmYWxzZX0=
.proofpoint.com/ Name: _hjFirstSeen
Value: 1
www.proofpoint.com/ Name: _hjIncludedInSessionSample
Value: 0
.proofpoint.com/ Name: _hjSession_1456002
Value: eyJpZCI6IjY4ODljMTUyLTA0OGQtNGE4YS04ZmFkLTg1MDY4MjY2NDhkNCIsImNyZWF0ZWQiOjE2NTk0NTI2MDUxNzUsImluU2FtcGxlIjpmYWxzZX0=
.proofpoint.com/ Name: _hjAbsoluteSessionInProgress
Value: 0
www.clarity.ms/ Name: CLID
Value: 429bace5b8fa46a298c3169e9a295094.20220802.20230802
.bidswitch.net/ Name: tuuid
Value: 9ba72ed6-f9a0-4c29-ae6c-fb2d0820fd9b
.bidswitch.net/ Name: c
Value: 1659452605
.bidswitch.net/ Name: tuuid_lu
Value: 1659452605
.www.proofpoint.com/ Name: __adroll_fpc
Value: 975c1b66f9208e78e25a0e268ea7333c-1659452605321
.proofpoint.com/ Name: _clck
Value: 7jcnl8|1|f3o|0
.www.proofpoint.com/ Name: __ar_v4
Value: %7C7YJ7XZCLMRHSVCXIHB5HIT%3A20220801%3A1%7CYV5KYXXEJZATZCT37YRTMK%3A20220801%3A1%7CT47Y2VPPABDUBJXFROMZZM%3A20220801%3A1
gwmtracking.com/ Name: kwsu
Value: 62e93cbdc37c5e072e6a4f7f
.adnxs.com/ Name: anj
Value: dTM7k!M4/rD>6NRF']wIg2In=j(hdu!]tbPl@/@8$-^=$U_hs4K-UITAKH?wYl`97^A[<-@+2_R`_TO1X[)$uR9=?f!vLiJJ!Gpcwem7P=sJSA.gLHHXs6>J@EKW>
.pubmatic.com/ Name: KRTBCOOKIE_10
Value: 22808-YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY&KRTB&22883-YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
.pubmatic.com/ Name: PugT
Value: 1659452603
.casalemedia.com/ Name: CMID
Value: Yuk8vfpguIwLUtK8VTSQIwAA
.casalemedia.com/ Name: CMPS
Value: 5140
d.adroll.com/ Name: __adroll
Value: a936ea965ec8b6ed963497c3f8cd95bf-g_1659452605-a_1659452605
.adroll.com/ Name: __adroll_shared
Value: a936ea965ec8b6ed963497c3f8cd95bf-g_1659452605-a_1659452605
.casalemedia.com/ Name: CMTS
Value: 1199
.casalemedia.com/ Name: CMPRO
Value: 1122
.casalemedia.com/ Name: CMST
Value: Yuk8vWLpPL0A
.casalemedia.com/ Name: CMRUM3
Value: 6962e93cbd2760YTkzNmVhOTY1ZWM4YjZlZDk2MzQ5N2MzZjhjZDk1YmY
.proofpoint.com/ Name: _clsk
Value: khnrh5|1659452606004|1|1|m.clarity.ms/collect
.outbrain.com/ Name: obuid
Value: e13b0ab3-dc02-411d-a467-01d1b890a3ea
www.proofpoint.com/ Name: drift_campaign_refresh
Value: f4e381be-3e6e-4d6b-af34-79ecd6d03b52
www.proofpoint.com/ Name: __atuvc
Value: 1%7C31
www.proofpoint.com/ Name: __atuvs
Value: 62e93cbc7905f3f5000
.addthis.com/ Name: uvc
Value: 1%7C31
.c.bing.com/ Name: SRM_B
Value: 30124BC6A04E6247140B5A32A19C6347
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 30124BC6A04E6247140B5A32A19C6347
.c.clarity.ms/ Name: ANONCHK
Value: 0
.addthis.com/ Name: loc
Value: MDAwMDBFVURFQlkyMjkzMTkwMTAwNTAwMDBDSA==
.nr-data.net/ Name: JSESSIONID
Value: 5405733424e240b8

4 Console Messages

Source Level URL
Text
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities(Line 956)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities(Line 956)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://munchkin.marketo.net/munchkin.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://geoip-js.com/geoip/v2.1/country/me?referrer=https%3A%2F%2Fwww.proofpoint.com
Message:
Failed to load resource: the server responded with a status of 402 ()
network error URL: https://id.rlcdn.com/464526.gif
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10487471.fls.doubleclick.net
309-rhv-619.mktoresp.com
4788165.fls.doubleclick.net
ad.doubleclick.net
ads.avct.cloud
ads.avocet.io
adservice.google.com
analytics.twitter.com
api.company-target.com
app-abj.marketo.com
apt.techtarget.com
attr.ml-api.io
b.6sc.co
bam.nr-data.net
bat.bing.com
bootstrap.api.drift.com
c.6sc.co
c.bing.com
c.clarity.ms
cm.g.doubleclick.net
connect.facebook.net
cpm.convergeselect.net
d.adroll.com
data.adxcel-ec2.com
dev.visualwebsiteoptimizer.com
dsum-sec.casalemedia.com
eb2.3lift.com
epsilon.6sense.com
fonts.googleapis.com
geoip-js.com
googleads.g.doubleclick.net
gwmtracking.com
ib.adnxs.com
id.rlcdn.com
image2.pubmatic.com
ipv6.6sc.co
j.6sc.co
js-agent.newrelic.com
js.driftt.com
m.addthis.com
m.clarity.ms
match.prod.bidr.io
metrics.api.drift.com
munchkin.marketo.net
pixel.mathtag.com
pixel.rubiconproject.com
pixel.sitescout.com
px.ads.linkedin.com
px4.ads.linkedin.com
r.casalemedia.com
region1.google-analytics.com
s.adroll.com
s.ml-attr.com
s7.addthis.com
script.hotjar.com
scripts.demandbase.com
secure.adnxs.com
secure.chip2gift.com
segments.company-target.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
stats.g.doubleclick.net
sync.outbrain.com
sync.taboola.com
t.co
tag.demandbase.com
track.accountinsight.cloud
tracking.g2crowd.com
trk.techtarget.com
ups.analytics.yahoo.com
us-u.openx.net
vars.hotjar.com
visitor.reactful.com
www.clarity.ms
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
www.linkedin.com
www.proofpoint.com
x.bidswitch.net
z.moatads.com
s7.addthis.com
104.103.80.163
104.16.95.80
104.18.18.126
104.18.19.126
104.244.42.133
104.244.42.67
108.138.17.46
13.107.42.14
13.248.245.213
141.226.228.48
142.250.185.130
142.250.185.226
142.250.186.38
142.250.186.70
143.204.89.101
143.204.89.27
143.204.89.30
143.204.89.5
143.204.89.91
151.101.66.137
158.255.109.19
162.247.241.14
18.193.145.56
18.66.139.80
185.64.189.110
192.28.144.124
199.232.188.157
20.120.124.64
20.234.93.27
2001:4860:4802:32::36
206.19.49.24
216.200.122.11
23.205.237.4
23.47.209.169
23.47.212.127
2600:9000:2156:5000:12:3734:2a40:93a1
2600:9000:2156:be00:6:9280:1080:93a1
2606:4700:4400::6812:2437
2606:4700:4400::6812:264a
2606:4700:4400::ac40:91d9
2620:1ec:21::14
2620:1ec:27::cafe:1425
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:801::2003
2a00:1450:4001:803::2004
2a00:1450:4001:806::200e
2a00:1450:4001:812::2002
2a00:1450:4001:829::2013
2a00:1450:4001:82b::2008
2a00:1450:4001:82b::200a
2a00:1450:4001:82b::200e
2a00:1450:400c:c00::9b
2a02:26f0:3500:16::215:14a0
2a02:26f0:6c00:294::1c91
2a02:e980:107::cf
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f107:83:face:b00c:0:25de
3.124.147.191
3.126.56.137
3.94.218.138
34.193.113.164
34.96.102.137
35.244.159.8
35.244.174.68
37.252.172.37
37.252.173.62
51.11.20.152
52.16.111.147
52.17.151.21
52.209.232.242
52.222.214.106
52.45.183.32
64.202.112.191
66.155.71.150
68.67.153.60
69.173.144.139
77.245.57.72
92.123.37.164
02840352581026aad3291a8357da6876c93b0e6d8aec9532bbc1a42f82bca1c5
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
084390577243b6986d5564d152916a37a3124305e11b2817d0c2eabc863e081b
09410642edee2a495d333f89ddf4c4a09dc9218c93de7d4d7d981117fe9d56b9
0d98648e4d3caf7339c64a2d5b068f8278e5b6a5efa81927820f443dca146e9a
0e41e449d2997692fc3631d239e51c964577b35502ee9e138eead4a960682806
0e5cf82e4a17e79c80c6f17c3fff873756de944e1301fa01c1d03aba1e359669
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
161d2e4c4fd1f0ec119eeb108e12e32175414aee70ece6fd012087d3735a84cb
168ebd89f3a9ffb66f609bdf01034cb2dd90af136676fde9193abb2ac0e517f4
169654a2040e9f83c46d4cd65600c3dc9db6db042904c22cc97645fb4323c362
17dc16f203a20131a9dfccce83ed74af83cb9da328011181ca745b7f3a883d08
19473eebfb0672867a4438e2a015de79fded34b9f5ae5598bade57eb01cf0563
1e4b8d2a1a5eb9645fb77c0098d1beb8ec3f1d61b0a7c839020e011c5fc6405c
1ee51b94d3a3346cbfb9f77ae1e629353494a22d41986fcf197aeae7ff530d70
20c38aa41958a57a405a22c8ae6eb0b15b562cc5ea78fc121a20b753171de79c
23aa8ce4a48730459e91a4b0b3a82eb7dd3c60da8c6b315a4ae4368fde1fdaba
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
27fc02705fe7e895aeec26f7ec3e645e4544c4561f7ce7cfbdb6502e99e942cb
285a94d2b2f41c7d5d08f69e1430743f8c0977cb4f5a43a9876572467693e1b6
28806cdf54095cc97e3db450f02e04f8a086b8dac6aea8f58c4dd4e720c2c1cc
2c8f585f6eb6a9e8760ab07a76ea5e5c4d0b55631ed86d393e345594242e939e
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
332a6273af6fdc033f936b6754b3c8af335763469fe94ac2fc3246273d4c63e0
345a7f619e726c9ed21fa1e83646623f3491056eb1c9e0f3af797c42d38255c1
37c18698722c6a2e4940ee3f65d56e08ad88d779ba3be1865396ac38e91d62ba
3b534eeaf216d2e54730d1c9bb15344f4b78712e6c781d31555585c51651e989
3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1
3dae93a05edd9dcfc1864b87178a31e0bfa93e1a9b1c486c6e9cbf73cae87862
412497348d5be70ad308a8bb163dcc6ff003612444770261c12fc20ccdf92990
45a3e44c1347d274cfbf71f7b942211eb9fd780c397150c4be62df62adfed0df
46959f0ff8db28a2e76b7bcd57953ead9ec578260c21cad5c5354a46f7890cf7
4845e9f0ab8138835df66e6fb4d2f369f72c93c65b45cd8e545055e0382d08b4
4a15153e4eba73495ca558c997c11f0643c4d449f116d955b5018cfa8eee924e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4c858ea92bdc30e89d30d477c30228c47b19648e1539829bb2303a176f0c23dd
4d71e28edcd31a762462d68b69b58c84965188c5f19c64f9d55fe0520e33985d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f3fc31f17996bdcd89a0b6358ef30b10a4d5b8e436dcd786082965f868f3bd8
52dc24c0429ea6ccc5b579a6da8bb79bf41e471fe5108a62009f3c2e195551c0
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5949dc5ef9ac0f8cb0d210d221d6eceeca2ffad94e3600b41566f468e146ae9a
5c09e8bec292a5b43b6a5be55beb50de7bf16c101bf236faa43e49ce70f8c229
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5dbe6afdce11b34fe60f255161e8625e1cc78f7a7f680c5f620b1a603872de0d
605c623db27ca02d226abbcc2f0343c286414c3b7c2f2bc4aa1c9623247d4164
643284a0eca0e88605a52952545149695d41d4a6f057d897bedf92a24e32c573
653a656337923a87f3a33f0cbcbb38bc4ba3b4c20b3f9b74cc8636f15394525a
68bf74082f8a4c49d604ea4c599e861b5dd032b1497a75231b74ca1b20853dcb
6907f421de451fd5e7f962c48d39191bd7d86390df35df8b416d3ca0eb558436
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75
69a12e6a2c6dff14902de0fec7a22b138a389be30d22265fa1f3c629373c295e
6c93a2e253cf1b83c4549ee38234134aa07f3b0293815375c49c9d4576986db1
6caa3674bca088112c5370c516f7d89127be1c22b9a658adc3ceeca0d254ebd1
6e7ac0dc584f9886aca10766fd4cca5cbc7b252b9d66799999e9cb87063dd7ca
6f973e7d75a7e6f6e59708f19631c8890034db5debb4d04f189deb53c114e708
709f47c65b7ca90f38a9600316852b29ddacc258b9ad1599e8ed966d5edb331f
72d52dcf32b1f0357fdb9688cb7d59dd429ed01f5bf3098825191ba7e244927c
73abcdba8b61ea9513c74192393cecce485ae1243f56c1cde5d61cd95650279b
785386e38e422ac73429f53fc111599e675d9a02d75b3320c6c85d7df42fd232
78c1118165ba1620bd91cc6f96c1cd99fa9469a9382f73f313c8e556d0fdaa9d
7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d
7ce23bb169d56e3dc218181172c5d318dc16526e035b539e038f605a893ea551
7fe9c49bb2fa7df0e7f30f29e2cf5dc5856a6a94e24020cd71b15806418e2509
8052a6fb6e64307417bdc20498d493634e5dd08188191d36dc64cd9672165e5a
81e6b4ec22135fd2056e29456e32539e21876266ab0bf8438b87117f70c0f827
826beb4857a8c006571a0c582619a8a7be9b263c932e4ea5f054b624a36bd45d
82e7f496b33db55afa55d97294c0eed6f50ec46281b3778f6e2123f8ba7bcb32
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
862bae5c822d87db86d0b893f474177ca1d9a51309354f12cc0ab85cd9bd9cf7
8843d0dae7daa6e3bdf06e07ffb65e5b5240268203496f5946dcdda9cc0c290d
88b3102f2889489e2db30d672885b580d0275e944baacebc652c90ce2263d7ab
88d623d347bc1d092c1d546f62ac989acddceb46ca869c4b48adb62e229daee5
8b7be87db71855fe47b30e1a60953e25a0e6a832e4ff3fefa682cf74d9e66cf0
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
914ae362937120d900bb5c5d95c70f3957fa2270c308925e4a72ad56446911cb
91c379a7d8ec04aeeb162ea6d8069ad9fe872cec0d8a56f8861b02c494a6e0f2
93fa8b2f6e13b1ac02946cf42cebafaa637e07feb93b926eace76fd5128df564
94a213df30df09df66ba05d0c007b145aa49b5ee6b467bdc60bc9308b41b9c8c
94a96a4fc313fe6dfba290ed6bc0e802eaab40810e59032a06f6774553b1c6ae
950c9b43bb82d94e66d52b2ec81ee6f2d71c378c3aaf0108c50c03d70b735173
9732077979c7e132e29da395c2788f43f6dd4ab3020b0c0c539744be21339507
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b7b5d56054f5bab6ea5dfd9472ceb900f406a8a35a3df5b17b606521a411a35
9db9265f8119cc29e3011eb69fb5d9bfb6b2b715890351480ac0904059af7f02
9df0c15923f76778de529c7e5131028841cb6891ca460d779c92e499005ee0d0
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a16acf2285039cf9b26e23dd5819c280e41b3be57a21dc66bf7be03021eca5b4
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
abc6c562c5e759ee6f1e642cc6a864ed683e537c85e28c497f16a123c1873dcd
ac5000602bb127a5a07be117df96c48667d2e2a9fb1bb33d5ebb7c50e4480a88
ac6c1d1d9bed9485e3df5bd93b225dc77f7c738580ac4824a9ae2d4b124bfbe5
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403
ae57d5e97bf1a0db8777b7531cd32cb09ee6f07bed183bb880469cc20f355086
af7690b10b2e4c40106b8e8ac69c9287176615a9913004666af12c98251d6ec0
afd7a9d5cc383d276f5d55d3465f9b32bf8b26c604d938445e9b1e8d82c776db
b0e6c1c112eda28bd4787e19ce4920424990b564c0fb3b828ec605d91ba4813e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3b810fd46e7aad5b789896519011ab5366b39dbb19a5663c53525f756e89bfb
b7ece1df6a5a51eadf5fb7af7b7cb9108529f79787f95aee6682867a62e8fc6c
b84595cc8461bb6e8376fe94f0dd23d6657172103b03653534089c5992b058a1
b8eef39219651c2e824894e8f8d35742e86021c1a556136fb6ffc5e1169bccbd
b91234b576455d66e12dd661a2539eb2418a831078ecef9ebc7f4bbd4e580d9c
ba95ed077caa1b5b8b0938c45e2223e486f179f659a64bcc4d6ea3d240235734
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc58857f15c8adbf1889d31dad903f9330f95fd6e96fa214e23d4566dae1831d
bd25bde9fc4427cd6f3babcb8f888fe6174ca48881c103e243d4c6f83f30aab6
c0269ba28d9ec51948de3000f364e6890e8a369ab832b4deb572415845a39712
c2253ae47d13653a1decea3c2f7ddddeb6b25a99f9bc1842634633d071c618e4
c2523bae2421e6b9f00fa8a16c10ce376e1fb3cd9bc687d55ba662e8f05ca5b0
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c501de88fbb90a445f1754a529bc772e7047071bf653c8c3f0330f7bb736d140
c505cf7b6472ef7ea667490958e05773c64d1c2a40ab13eebd8bbf8dc38b598c
c8de55874475c175335f0c6fc79e975cc9325630e3641389c18ae7ae5ab9a981
cbd1fd9e5454ee302f349f7a91241a8e37f4daf59dfbbfb26d8c76d4ec49fac9
cc08221e904788853f9dbae9e845e8c88e947de904dcd007c0da0c4d18acd1de
cc6d6e78796fdb307f12b0d106259901087bf4bdd693a149f2ebc83cdaf1ecb8
cea918e6af14ac3645e0e33b30cb802820aed3e549defbd618be220c31546625
cef5e7a8bbafdc0187cc3bd50db0417a3ed578deec09d93fe306bddf30a9ba43
d0777c7ce21d13f06a66f06728ecdd7e77186499b44c26858a2bbc13ce4a0f2d
d1c6032b67262b3855f2ae2702f0497cf50f3caf6ce5211641f1756ee3a4332b
d269dd13dcc6c4d29d137133b556725572600bcb4c7ca33c769a1a287d27e699
d2e0e9a38aa60d2231663b6339b14b27ab27f31b4a42e41f74008378529487a6
da9b29cad35666ad35df54fc721ff8d0838660640456185a86521e6c506b81cd
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd7e25fe1547c7102760792d7b920ed5a289aa0224014594f856b5ab396dc0d6
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
deb5165f8cb065442e1b79e56eb46b94b03d5ee540031be9578a6b8eb63588d2
df82f5399e2ea4ae935baf5acad52a81785df3c210408286619d0b9e88d1f9bf
e0b6d26489191155d30162f050cf2a964afb8cf054e3f59e7f710942a9a12293
e3205178d8f4b21ab5dc10a089939e49dd276dea7b5047ef2b494ffea3b93b19
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fab69734b09f71257e38bc41703c3794bce4f28abe5c62544a9e411f3076aa
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
e8aff6a8426e2182081c0e696ff05c3b10eeb43716fe56bbc9f8b3b3069c6736
e9b3c1ef5622bc620a5c1d364aa9fbec2c9d6230bb5f6ab825825db09dd71f6a
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
ee5a89c890a44194abb029cd7e5116ab93e76956a61e5168753090f7d666c038
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f156ae940f7e272f1319e3a835871f632bc4275105f4882685a3435d7ed4e3fb
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f6ed28e5e26ebba4c6c19329aea432fba0c64c0f9fbfb321d4105072d2541363
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
fa176af3695a7e918096d7d71a501167980482180f48dc0e4515855901b42969
fa8c32e4cf3d3e6a515ed02bcb7c24c87a1371ff8b888ca12332e4da8e4c5e65
fa8d00de4d9acf49fccb202f273ba09102e673a8d46bdb520d6bc9b5e740cbcd
fab816e037c0f67ab424c67234af03471c66a13357d6e187ecb238a2eac62a04
fbb446b79860a9c66ba04749477ac274776acf05e4be0c6937a499e1e7131129
fe1f7ff4931ae087ad58f48a31244e177230eccdac8f5185f7d231e2967c14cd
fe5f2a40422e9a55187b3204161cbce1ba1d03a2eb4fa971bd10451562fed99a