demo.backstory.chronicle.security Open in urlscan Pro
142.250.76.100 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://goo.gle/chroniclelab
Effective URL:
https://demo.backstory.chronicle.security/?warstory&authrefreshed=1
Submission: On July 09 via manual (July 9th 2024, 11:41:28 pm UTC) from NZ — Scanned from AU

Summary HTTP 42 Redirects Behaviour Indicators

Summary

This website contacted 18 IPs in 2 countries across 14 domains to perform 42 HTTP transactions. The main IP is 142.250.76.100, located in Plainview, United States and belongs to GOOGLE, US. The main domain is demo.backstory.chronicle.security.
TLS certificate: Issued by WR2 on June 13th 2024. Valid for: 3 months.

This is the only time demo.backstory.chronicle.security was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.12 67.199.248.12	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 7	142.250.76.100 142.250.76.100	15169 (GOOGLE) (GOOGLE)
3	142.251.221.74 142.251.221.74	15169 (GOOGLE) (GOOGLE)
2	172.217.24.35 172.217.24.35	15169 (GOOGLE) (GOOGLE)
1	142.251.221.72 142.251.221.72	15169 (GOOGLE) (GOOGLE)
3	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	172.217.167.106 172.217.167.106	15169 (GOOGLE) (GOOGLE)
3	172.217.167.67 172.217.167.67	15169 (GOOGLE) (GOOGLE)
1	142.250.71.78 142.250.71.78	15169 (GOOGLE) (GOOGLE)
2	199.60.103.28 199.60.103.28	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	104.16.160.168 104.16.160.168	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.75.142 104.16.75.142	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.16.110.254 104.16.110.254	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.250.66.238 142.250.66.238	15169 (GOOGLE) (GOOGLE)
2	104.16.117.116 104.16.117.116	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.139.209 104.16.139.209	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.118.116 104.16.118.116	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	172.64.153.27 172.64.153.27	13335 (CLOUDFLAR...) (CLOUDFLARENET)
42	18

1 67.199.248.12 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: cname.bitly.com

goo.gle	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.76.100 (Plainview, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: syd09s24-in-f4.1e100.net

demo.backstory.chronicle.security	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
backstory.chronicle.security	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.221.74 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.24.35 (United States)

ASN15169 (GOOGLE, US)
PTR: hkg07s23-in-f35.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.221.72 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: syd09s31-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.167.106 (United States)

ASN15169 (GOOGLE, US)
PTR: syd09s17-in-f10.1e100.net

malachitefrontend-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.167.67 (United States)

ASN15169 (GOOGLE, US)
PTR: syd15s06-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.71.78 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: syd15s17-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 199.60.103.28 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

go.chronicle.security	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.160.168 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.75.142 (None, )

ASN13335 (CLOUDFLARENET, US)

js.usemessages.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.110.254 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.66.238 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: syd15s15-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.16.117.116 (None, )

ASN13335 (CLOUDFLARENET, US)

api.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.139.209 (None, )

ASN13335 (CLOUDFLARENET, US)

js-na1.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.118.116 (None, )

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.64.153.27 (San Francisco, United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 108 malachitefrontend-pa.googleapis.com	65 KB
9	chronicle.security 1 redirects demo.backstory.chronicle.security backstory.chronicle.security — Cisco Umbrella Rank: 967713 go.chronicle.security	820 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	4 MB
3	hubspot.com api.hubspot.com — Cisco Umbrella Rank: 10228 track.hubspot.com — Cisco Umbrella Rank: 5397 app.hubspot.com Failed	3 KB
3	qualtrics.com zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com siteintercept.qualtrics.com — Cisco Umbrella Rank: 1518	27 KB
2	google.com apis.google.com — Cisco Umbrella Rank: 221	96 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 9601 forms.hscollectedforms.net — Cisco Umbrella Rank: 9815	25 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 5116	19 KB
1	hs-scripts.com js-na1.hs-scripts.com — Cisco Umbrella Rank: 14446	1 KB
1	usemessages.com js.usemessages.com — Cisco Umbrella Rank: 10882	24 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 5142	24 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 102
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 110	89 KB
1	goo.gle 1 redirects goo.gle — Cisco Umbrella Rank: 782855	294 B
42	14

	Domain	Requested by
6	malachitefrontend-pa.googleapis.com	www.gstatic.com
4	demo.backstory.chronicle.security	1 redirects demo.backstory.chronicle.security www.gstatic.com
3	fonts.gstatic.com	fonts.googleapis.com
3	backstory.chronicle.security	demo.backstory.chronicle.security
3	fonts.googleapis.com	demo.backstory.chronicle.security www.gstatic.com
2	api.hubspot.com	js.usemessages.com
2	apis.google.com	www.gstatic.com apis.google.com
2	go.chronicle.security	www.gstatic.com go.chronicle.security
2	siteintercept.qualtrics.com	zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com www.gstatic.com
2	www.gstatic.com	demo.backstory.chronicle.security www.gstatic.com
1	js.hs-banner.com	js-na1.hs-scripts.com js.hs-banner.com
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	track.hubspot.com
1	js-na1.hs-scripts.com	js.hs-analytics.net
1	js.hscollectedforms.net	go.chronicle.security
1	js.usemessages.com	go.chronicle.security
1	js.hs-analytics.net	go.chronicle.security
1	www.google-analytics.com	www.gstatic.com
1	zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com	www.gstatic.com
1	www.googletagmanager.com	www.gstatic.com
1	goo.gle	1 redirects
0	app.hubspot.com Failed	js.usemessages.com
42	22

This site contains no links.

Subject Issuer	Validity	Valid
misc-sni.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
upload.video.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
*.google-analytics.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
go.chronicle.security GTS CA 1P5	`2024-05-20` - `2024-08-18`	3 months	crt.sh
hs-analytics.net WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
usemessages.com E5	`2024-06-10` - `2024-09-08`	3 months	crt.sh
hscollectedforms.net E1	`2024-05-27` - `2024-08-25`	3 months	crt.sh
*.apis.google.com WR2	`2024-06-24` - `2024-09-16`	3 months	crt.sh
hubspot.com E1	`2024-05-23` - `2024-08-21`	3 months	crt.sh
hs-scripts.com E1	`2024-05-31` - `2024-08-29`	3 months	crt.sh
hs-banner.com E1	`2024-05-30` - `2024-08-28`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1
Frame ID: D21DB96BD428272EEF03B5C7F7FFC301
Requests: 25 HTTP requests in this frame

Frame: https://go.chronicle.security/hubfs/warstory/warstory_embed.html
Frame ID: 4E9FD0221477B39D37B3A3EA459EDCA5
Requests: 11 HTTP requests in this frame

Frame: https://app.hubspot.com/conversations-visitor/2567647/threads/utk/3cd12d25ed154e6b9359bdc12bf72706?uuid=7115a2586eda42158c82e691a4f1ea1e&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=&domain=go.chronicle.security&inApp53=false&messagesUtk=3cd12d25ed154e6b9359bdc12bf72706&url=https%3A%2F%2Fgo.chronicle.security%2Fhubfs%2Fwarstory%2Fwarstory_embed.html&inline=false&isFullscreen=false&globalCookieOptOut=&isFirstVisitorSession=true&isAttachmentDisabled=false&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hideScrollToButton=true
Frame ID: 4DD1572C35847E9C5F7064E8865B6C39
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Home | Google SecOps

Page URL History Show full URLs

http://goo.gle/chroniclelab HTTP 307
https://goo.gle/chroniclelab HTTP 302
https://demo.backstory.chronicle.security/?session_token=P/vKYX88Jo/3Wfbe7BYqSQ%3D%3D&warstory= HTTP 302
https://demo.backstory.chronicle.security/?warstory&authrefreshed=1 Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Page Statistics

42
Requests

90 %
HTTPS

0 %
IPv6

14
Domains

22
Subdomains

18
IPs

2
Countries

5255 kB
Transfer

19826 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://goo.gle/chroniclelab HTTP 307
https://goo.gle/chroniclelab HTTP 302
https://demo.backstory.chronicle.security/?session_token=P/vKYX88Jo/3Wfbe7BYqSQ%3D%3D&warstory= HTTP 302
https://demo.backstory.chronicle.security/?warstory&authrefreshed=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

42 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
demo.backstory.chronicle.security/
Redirect Chain

http://goo.gle/chroniclelab
https://goo.gle/chroniclelab
https://demo.backstory.chronicle.security/?session_token=P/vKYX88Jo/3Wfbe7BYqSQ%3D%3D&warstory=
https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

8 KB
3 KB

742ms
741ms

Document
text/html

142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

ESF /

Resource Hash

3dcf4edf62169b6bf94a96339ec27a3d708698e88360f3a9c7a3d3188200f9bc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tdkrkgB6PvwEuHVjYz-ewQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-tdkrkgB6PvwEuHVjYz-ewQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Tue, 09 Jul 2024 23:41:21 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000; includeSubDomains
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
content-security-policy: script-src 'report-sample' 'nonce-OyGPAlRaHFBi-VdvoFF9Qw' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
content-type: application/binary
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Tue, 09 Jul 2024 23:41:20 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000; includeSubDomains
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 210ms
106ms Stylesheet
text/css 142.251.221.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Code+Pro:400|Source+Sans+Pro:300,400,500,600,700

Requested by

Host: demo.backstory.chronicle.security
URL: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f10.1e100.net

Software

ESF /

Resource Hash

9bb18616e87dd656e5dfbe5f6590cabb37c0e2aa589f7819b4f6645223308d7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 09 Jul 2024 23:41:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 09 Jul 2024 23:41:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Jul 2024 23:41:21 GMT

GET
H2 200 m=base Show response
www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/ 10 MB
3 MB 111ms
4ms Script
text/javascript 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Requested by

Host: demo.backstory.chronicle.security
URL: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.24.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

hkg07s23-in-f35.1e100.net

Software

sffe /

Resource Hash

369ddebff56e9bba915638dc905a52a8cbcb9f893d04f95c624fbf4013891a90

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 06 Jul 2024 03:03:29 GMT
age: 333472
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000
content-length: 2676047
x-xss-protection: 0
last-modified: Mon, 01 Jul 2024 08:44:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="malachite-dev-team"
vary: Accept-Encoding, Origin
report-to: {"group":"malachite-dev-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/malachite-dev-team"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 06 Jul 2025 03:03:29 GMT

GET
H3 200 styles.css
demo.backstory.chronicle.security/ 453 KB
55 KB 288ms
287ms Stylesheet
text/css 142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://demo.backstory.chronicle.security/styles.css

Requested by

Host: demo.backstory.chronicle.security
URL: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

ESF /

Resource Hash

77290247eb7b54d245443acf515ddc09a2d1e60eda3d18062996c22d64582998

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-nKr3Y6ityDDcsfr5Ec0suA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-security-policy: script-src 'report-sample' 'nonce-nKr3Y6ityDDcsfr5Ec0suA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
content-encoding: gzip
cross-origin-resource-policy: same-site
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1
pragma: no-cache
server: ESF
cross-origin-opener-policy: same-origin
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 secops_screen_dark.gif
backstory.chronicle.security/static/app/images/ 747 KB
748 KB 18ms
8ms Image
image/gif 142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://backstory.chronicle.security/static/app/images/secops_screen_dark.gif

Requested by

Host: demo.backstory.chronicle.security
URL: https://demo.backstory.chronicle.security/?warstory&authrefreshed=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

sffe /

Resource Hash

d53cf91cb6ce51f95882ed98db1662b654844a0642f6bd284af0269502f80732

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
date: Tue, 09 Jul 2024 17:46:26 GMT
x-content-type-options: nosniff
age: 21295
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 765415
x-xss-protection: 0
last-modified: Mon, 01 Apr 2024 12:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="malachite-dev-team"
report-to: {"group":"malachite-dev-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/malachite-dev-team"}]}
content-type: image/gif
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 10 Jul 2024 17:46:26 GMT

GET
H2 200 css
fonts.googleapis.com/ 17 KB
1 KB 105ms
105ms Stylesheet
text/css 142.251.221.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,300,300italic,400italic,500,500italic,700,700italic

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f10.1e100.net

Software

ESF /

Resource Hash

45d57dbba764b550f3c3e6d20fc303a516e4cc7a7d628b9d53e41d76f265163c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 09 Jul 2024 23:18:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Jul 2024 23:41:23 GMT

GET
H2 200 css
fonts.googleapis.com/ 4 KB
739 B 103ms
102ms Stylesheet
text/css 142.251.221.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Mono:400,700

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.74 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f10.1e100.net

Software

ESF /

Resource Hash

70ef2010ee0ce557292f5cdd53985b6dc8cd0e054054e86e5b36f9d881502f92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 09 Jul 2024 23:21:42 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 09 Jul 2024 23:41:23 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 252 KB
89 KB 225ms
124ms Script
application/javascript 142.251.221.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-TEFQEBSN44

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.221.72 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s31-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

3c141d5e5ff6233063f8020d1b9dd402492d382206d3852505af096056405162

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 91029
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 09 Jul 2024 23:41:23 GMT

GET
H2 200 / Show response
zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 83ms
19ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3xtrgSkXC8QQ06i

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

679b0ee4d7dc41e078d6409b78a5471e4c3426d0ba88cf7d216047654e19c4d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 189071
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"268f-WNhgDPRwcuRa4PaLH+k6dC5GLDI"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 8a0c2a1ccd4ca829-SYD

GET
H2 200 getUserPreferenceSet Show response
malachitefrontend-pa.googleapis.com/v1/ 472 KB
31 KB 397ms
396ms Fetch
application/json 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/getUserPreferenceSet?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

11c21f30dad16ddaf33a6b126abf26414ebed2d0721d424afe543003e3fa049a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://demo.backstory.chronicle.security/
Authorization: Bearer P/vKYX88Jo/3Wfbe7BYqSQ==
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
server-timing: gfet4t7; dur=391
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31552
x-xss-protection: 1

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 15 KB
15 KB 406ms
5ms Font
font/woff2 172.217.167.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400|Source+Sans+Pro:300,400,500,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s06-in-f3.1e100.net

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://demo.backstory.chronicle.security
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 13:15:40 GMT
x-content-type-options: nosniff
age: 383143
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Jul 2025 13:15:40 GMT

OPTIONS
H2 200 getUserPreferenceSet
malachitefrontend-pa.googleapis.com/v1/ Frame 0
0 1461ms
1052ms Preflight
text/html 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/getUserPreferenceSet?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://demo.backstory.chronicle.security
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 09 Jul 2024 23:41:24 GMT
server: ESF
server-timing: gfet4t7; dur=1049
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H2 200 12.f83656fbc6c9f02061b2.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 74 KB
21 KB 20ms
16ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.f83656fbc6c9f02061b2.chunk.js?Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web&Q_BRANDID=demo.backstory.chronicle.security

Requested by

Host: zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com
URL: https://zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3xtrgSkXC8QQ06i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

369a904e6a2a6cb6fef3e935c723dead810c01aa74ff7771983a06e5f3cf8f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 603210
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Jul 2024 18:09:29 GMT
server: cloudflare
etag: W/"12863-1906f7ccfa8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 8a0c2a1e9f61a829-SYD

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 453ms
101ms Fetch
text/plain 142.250.71.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-TEFQEBSN44&gtm=45je4730v873646073za200&_p=1720568483264&gcd=13l3l3l3l1&npa=0&dma=0&tag_exp=95250753&ir=1&cid=1567536284.1720568484&ul=en-au&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&dt=Home%20view&dl=%2F%3Fwarstory%3D&sid=1720568483&sct=1&seg=0&en=mc_app_opened&_fv=1&_nsi=1&_ss=1&_ee=1&ep.anonymize_ip=true&ep.page=legacy-search&ep.actionType=INITIALIZE_STORE&ep.fromPage=loading&tfd=4496&_z=fetch
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.71.78 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: syd15s17-in-f14.1e100.net
Software: Golfe2 /
Resource Hash

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 09 Jul 2024 23:41:24 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://demo.backstory.chronicle.security
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1014 B 28ms
27ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3xtrgSkXC8QQ06i&Q_CLIENTVERSION=2.10.0&Q_CLIENTTYPE=web

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d788c2fd854f3442af002d5f549aa98b2f1c09afbe77e770469b9571c98e93d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 09 Jul 2024 23:41:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
content-type: application/json
access-control-allow-origin: https://demo.backstory.chronicle.security
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 80579e09b01400f8
timing-allow-origin: *
cf-ray: 8a0c2a1eefa9a829-SYD

GET
H3 200 secops-favicon-32.png
backstory.chronicle.security/static/app/favicons/ 1 KB
1 KB 4ms
4ms Other
image/png 142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://backstory.chronicle.security/static/app/favicons/secops-favicon-32.png

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

sffe /

Resource Hash

3b9a405c583acfa295a82895477683245125ed4a376ff070ecbfa00a5a21c8d9

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
date: Tue, 09 Jul 2024 08:28:48 GMT
x-content-type-options: nosniff
age: 54755
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1047
x-xss-protection: 0
last-modified: Thu, 28 Mar 2024 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="malachite-dev-team"
report-to: {"group":"malachite-dev-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/malachite-dev-team"}]}
content-type: image/png
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 10 Jul 2024 08:28:48 GMT

GET
H3 200 warstory_embed.html Show response
go.chronicle.security/hubfs/warstory/ Frame 4E9F 2 KB
2 KB 118ms
45ms Document
text/html 199.60.103.28
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://go.chronicle.security/hubfs/warstory/warstory_embed.html

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.28 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

7ba9d2920048ac8ca77b96e52744f87fac655374d0df2f4fbf640435cbc8faa3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://demo.backstory.chronicle.security/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-methods: GET
access-control-allow-origin: *
age: 1543252
alt-svc: h3=":443"; ma=86400
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
cache-tag: F-9437296517,FD-9437296893,P-2567647,FLS-ALL
cf-cache-status: HIT
cf-ray: 8a0c2a299cd35739-SYD
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html
date: Tue, 09 Jul 2024 23:41:25 GMT
edge-cache-tag: F-9437296517,FD-9437296893,P-2567647,FLS-ALL
etag: W/"bdea57ad693aeca4c2b604bda5ec949e"
last-modified: Wed, 08 May 2019 16:52:59 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHQHvGk8ERsfEGinjrPtWKcISF4prDeTUByp%2Fxl%2B7vhFM9jVTBJ55oa06Y3FqZwoYG4WJ1xywE2sA5Q4xwkG0RdFYZZCzl6Wi8io6LuJSYdvEAPCK3h8gPR6cD5uhM6ASzv3%2FDdPTA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
vary: Accept-Encoding
via: 1.1 cf0406bc67043378998de4d2ebe1b638.cloudfront.net (CloudFront)
x-amz-cf-id: YXGaqv06pFB2QFn2yvM9s4CRP6gubLtnmU3gYRDGiRi4f8Y6gMfyvw==
x-amz-cf-pop: LAX50-P3
x-amz-id-2: ePDLtX1ZDWbZ2H6jc9Sw0Vg9d0Jw7iTgN9wWrZQhCxFMo/Mpw7xbfORibUQkO7Yq4yx7DWDn4cM=
x-amz-meta-cache-tag: F-9437296517,FD-9437296893,P-2567647,FLS-ALL
x-amz-request-id: RPTKQ32WYF4YBVSD
x-amz-version-id: kGk0Ungd6U48OWlY0RppRGWVUrz7vB42
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3

GET
H2 200 m=leg Show response
www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/exm=base/ed=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/ 6 MB
1 MB 5ms
4ms Script
text/javascript 172.217.24.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/exm=base/ed=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=leg

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.24.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

hkg07s23-in-f35.1e100.net

Software

sffe /

Resource Hash

9ce8a9898f81f2817ddc34c3a252e3158f6604efbe2a9fa49e057185e686b4cc

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 05 Jul 2024 23:22:12 GMT
age: 346753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000
content-length: 1434253
x-xss-protection: 0
last-modified: Mon, 01 Jul 2024 08:44:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="malachite-dev-team"
vary: Accept-Encoding, Origin
report-to: {"group":"malachite-dev-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/malachite-dev-team"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 05 Jul 2025 23:22:12 GMT

GET
H3 200 embed_bin.js Show response
go.chronicle.security/hubfs/warstory/ Frame 4E9F 17 KB
7 KB 32ms
31ms Script
application/javascript 199.60.103.28
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://go.chronicle.security/hubfs/warstory/embed_bin.js

Requested by

Host: go.chronicle.security
URL: https://go.chronicle.security/hubfs/warstory/warstory_embed.html

Protocol

Security

QUIC, , AES_128_GCM

Server

199.60.103.28 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e5671ac01524232eb88463c7c994f00f791a47e67ae2d05cdea06beeb4aa3c69

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://go.chronicle.security/hubfs/warstory/warstory_embed.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:25 GMT
strict-transport-security: max-age=31536000
via: 1.1 cb712125c0a106eae5fd0f1f475a2270.cloudfront.net (CloudFront)
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-amz-meta-cache-tag: F-9502267873,FD-9437296893,P-2567647,FLS-ALL
content-security-policy: upgrade-insecure-requests
age: 1543252
x-amz-cf-pop: SFO53-P1
x-amz-request-id: CZYGTF8RKZ2891D7
content-encoding: br
edge-cache-tag: F-9502267873,FD-9437296893,P-2567647,FLS-ALL
cache-tag: F-9502267873,FD-9437296893,P-2567647,FLS-ALL
x-amz-version-id: PAvv5VQP02dpMi8oDiVQW51grbqdf3Ld
x-cache: Miss from cloudfront
x-hs-cf-lambda: us-east-1.EnforceAclForReads 3
alt-svc: h3=":443"; ma=86400
x-amz-id-2: yC249o8BUcXzmG0ywzYKIhrzfQlnfU4mdzidRypByC5kWgpmtzc7LREIEoG/r3H30G9DQ2dugUk=
last-modified: Wed, 08 May 2019 16:52:40 GMT
server: cloudflare
etag: W/"be1602732eb964360da04a303fcd4bfb"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=53b2VNtvqjvla3FdGLGKtQTXEqzMcscwQQFP6QL9Fe2gUBcOqguLvx%2BRYnvtCrCGugxbAnDL8mlTIbpfq%2FVo1oYS4Wu0GoBZrNOZrpjqUGiUQS21R8FSLHb6DwgJ47JyeZ%2BS4Obiig%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: s-maxage=2592000, max-age=1209600, stale-while-revalidate=900
cf-ray: 8a0c2a29fd6c5739-SYD
timing-allow-origin: d8fk70yj6xfhx.cloudfront.net
x-amz-cf-id: NNIOFC5ZosxVgvIStbLQXhMYSS2Tao06VgBD1hLT77-WAOaR4GuxKg==
x-hs-cf-lambda-enforce: us-east-1.EnforceAclForReads 3

GET
H2 200 2567647.js Show response
js.hs-analytics.net/analytics/1549251900000/ Frame 4E9F 67 KB
24 KB 561ms
248ms Script
text/javascript 104.16.160.168
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1549251900000/2567647.js
Requested by: Host: go.chronicle.security
URL: https://go.chronicle.security/hubfs/warstory/warstory_embed.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.160.168 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 005dd39746670e977b5eff644b1afe7b1c2f0bf13e8e9bb36a87675b44ccfbca

Request headers

Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:25 GMT
x-amz-version-id: null
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: MA2KF4KQ3DXEMPC2
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: c7ceea36-b0bf-4be5-8e91-0f5b1433f6d8
x-envoy-upstream-service-time: 54
x-amz-id-2: Z42rIVbJLeAa36ea3XBEp/cYQIP1/kOju/+FqjE5MPJPE/ziT67diR7rTqeaENruDdSzIDhwLUY=
x-evy-trace-listener: listener_https
x-request-id: c7ceea36-b0bf-4be5-8e91-0f5b1433f6d8
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 09 Jul 2024 17:52:14 GMT
server: cloudflare
etag: W/"78cd733ebd328200d124ac3669ba502b"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-w85d2
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8a0c2a2bfd26572c-SYD
expires: Tue, 09 Jul 2024 23:46:25 GMT

GET
H2 200 conversations-embed.js Show response
js.usemessages.com/ Frame 4E9F 85 KB
24 KB 332ms
13ms Script
application/javascript 104.16.75.142
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.usemessages.com/conversations-embed.js

Requested by

Host: go.chronicle.security
URL: https://go.chronicle.security/hubfs/warstory/warstory_embed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.75.142 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

753b5d77684b20581dddd43b3a944bca93a44da9e6dee0c8232ca6ed8a40ead5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:25 GMT
x-amz-version-id: yFTRQFC1g6ZpuTIoktepwBCyrzt6F_8h
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 6b29c936420d116b13807604a0e67044.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 417
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.16706/bundles/project.js&cfRay=8a0c1ff3f973a838-SYD
x-cache: Hit from cloudfront
x-hubspot-correlation-id: e8c1b59e-06e8-4958-b22b-57d29261647e
cache-tag: staticjsapp-conversations-embed-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 3
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: e8c1b59e-06e8-4958-b22b-57d29261647e
last-modified: Fri, 21 Jun 2024 14:34:54 UTC
server: cloudflare
etag: W/"d5ed42fdc505d7812288ee600abec355"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-wf75s
cf-ray: 8a0c2a2bfcdea97d-SYD
x-amz-cf-id: tk1Fc6BdDR4PerhI50F6c1m3J-x2psVyPMY74GJ3MzCJvD5Ziok5nQ==
x-hs-target-asset: conversations-embed/static-1.16706/bundles/project.js

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ Frame 4E9F 69 KB
24 KB 567ms
248ms Script
application/javascript 104.16.110.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: go.chronicle.security
URL: https://go.chronicle.security/hubfs/warstory/warstory_embed.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.110.254 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.chronicle.security/
Origin: https://go.chronicle.security
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:26 GMT
x-amz-version-id: WQne3xdBhaNpu67z_dXMAVxQ_qJQQf8W
content-encoding: gzip
x-content-type-options: nosniff
via: 1.1 06c1d28e93bdae8f6401a12c10b2f570.cloudfront.net (CloudFront)
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: dd4a7aff-28b1-43f1-9b6d-3c3620ba38d4
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.503/bundles/project.js&cfRay=8a0c2a2bf8d5a7f6-SYD
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: dd4a7aff-28b1-43f1-9b6d-3c3620ba38d4
last-modified: Wed, 15 May 2024 14:34:44 UTC
server: cloudflare
etag: W/"7d377a186677c174f204d466b8fa5fdb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-qfdc9
cf-ray: 8a0c2a2bf8d5a7f6-SYD
x-amz-cf-id: JlWIEZMBAfGNrgCGV2bSE5xsw59hqUa3qojz0A1dnptqhHxHfspocQ==
x-hs-target-asset: collected-forms-embed-js/static-1.503/bundles/project.js

GET
H2 200 auth.js Show response
apis.google.com/js/ 15 KB
6 KB 459ms
101ms Script
text/javascript 142.250.66.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/auth.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s15-in-f14.1e100.net

Software

sffe /

Resource Hash

118efd87f0fdc13c7b2c3e4c78dd1cdeff067358c9cc05fa51e1c5e86897fa66

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 09 Jul 2024 23:41:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5919
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "0f905e8621db4253"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 09 Jul 2024 23:41:26 GMT

OPTIONS
H3 200 listIngestionStats
malachitefrontend-pa.googleapis.com/v1/ Frame 0
0 970ms
970ms Preflight
text/html 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/listIngestionStats?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://demo.backstory.chronicle.security
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 09 Jul 2024 23:41:26 GMT
server: ESF
server-timing: gfet4t7; dur=967
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

OPTIONS
H3 200 listCustomerStats
malachitefrontend-pa.googleapis.com/v1/ Frame 0
0 1058ms
1057ms Preflight
text/html 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/listCustomerStats?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Accept: */*
Access-Control-Request-Headers: authorization
Access-Control-Request-Method: GET
Origin: https://demo.backstory.chronicle.security
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: authorization
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 09 Jul 2024 23:41:27 GMT
server: ESF
server-timing: gfet4t7; dur=1054
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1

GET
H3 200 getUserPreferenceSet Show response
malachitefrontend-pa.googleapis.com/v1/ 472 KB
31 KB 1284ms
1284ms Fetch
application/json 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/getUserPreferenceSet?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

11c21f30dad16ddaf33a6b126abf26414ebed2d0721d424afe543003e3fa049a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://demo.backstory.chronicle.security/
Authorization: Bearer P/vKYX88Jo/3Wfbe7BYqSQ==
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
server-timing: gfet4t7; dur=1279
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31552
x-xss-protection: 1

GET
H3 200 listIngestionStats Show response
malachitefrontend-pa.googleapis.com/v1/ 52 B
95 B 251ms
250ms Fetch
application/json 172.217.167.106
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://malachitefrontend-pa.googleapis.com/v1/listIngestionStats?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.167.106 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s17-in-f10.1e100.net

Software

ESF /

Resource Hash

96ade562dc72efa7bca30f837a9b3f362fb926681cd50a2d860f300f53b6040d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://demo.backstory.chronicle.security/
Authorization: Bearer P/vKYX88Jo/3Wfbe7BYqSQ==
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://demo.backstory.chronicle.security
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
server-timing: gfet4t7; dur=246
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69
x-xss-protection: 1

GET listCustomerStats
malachitefrontend-pa.googleapis.com/v1/ 0
0

GET
H3 200 secops_dark_logo.svg
backstory.chronicle.security/static/app/images/ 13 KB
4 KB 5ms
5ms Image
image/svg+xml 142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://backstory.chronicle.security/static/app/images/secops_dark_logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

sffe /

Resource Hash

5c6ba4d467b4f756068eb7fc36ceb70d1928c5f6382dec35cf10f3659eac55e2

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/malachite-dev-team
content-encoding: br
x-content-type-options: nosniff
date: Tue, 09 Jul 2024 23:05:48 GMT
age: 2138
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4560
x-xss-protection: 0
last-modified: Wed, 05 Jun 2024 08:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="malachite-dev-team"
vary: Accept-Encoding
report-to: {"group":"malachite-dev-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/malachite-dev-team"}]}
content-type: image/svg+xml
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 10 Jul 2024 23:05:48 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
15 KB 6ms
4ms Font
font/woff2 172.217.167.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400|Source+Sans+Pro:300,400,500,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s06-in-f3.1e100.net

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://demo.backstory.chronicle.security
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 01:27:13 GMT
x-content-type-options: nosniff
age: 425653
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 05 Jul 2025 01:27:13 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ 14 KB
14 KB 7ms
6ms Font
font/woff2 172.217.167.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Code+Pro:400|Source+Sans+Pro:300,400,500,600,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.167.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s06-in-f3.1e100.net

Software

sffe /

Resource Hash

0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://demo.backstory.chronicle.security
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 03 Jul 2024 21:47:57 GMT
x-content-type-options: nosniff
age: 525209
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14712
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 03 Jul 2025 21:47:57 GMT

OPTIONS
H2 200 public
api.hubspot.com/livechat-public/v1/message/ Frame 0
0 544ms
233ms Preflight
text/plain 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubspot.com/livechat-public/v1/message/public?portalId=2567647&conversations-embed=static-1.16706&mobile=false&messagesUtk=3cd12d25ed154e6b9359bdc12bf72706&traceId=3cd12d25ed154e6b9359bdc12bf72706&referrer=https%3A%2F%2Fdemo.backstory.chronicle.security%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: x-hubspot-messages-uri
Access-Control-Request-Method: GET
Origin: https://go.chronicle.security
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: false
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin: https://go.chronicle.security
allow: HEAD,GET,OPTIONS
cf-cache-status: DYNAMIC
cf-ray: 8a0c2a316965a86a-SYD
content-length: 18
content-type: text/plain; charset=utf-8
date: Tue, 09 Jul 2024 23:41:26 GMT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gRi7RhmK6uW99na34XBGJT%2BufY2pfYGm09PeUfBah6tXbpcKdfKj9SvhGskt35ouhC1wgsedjK%2Fk2QDLwJqxLzuLEdOWfKzmCtcx2ChTmLjYDahzk2anGsNnQUYg63nbAw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: origin, Accept-Encoding
x-content-type-options: nosniff
x-envoy-upstream-service-time: 2
x-evy-trace-listener: listener_https
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-route-service-name: envoyset-translator
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-zb9w4
x-evy-trace-virtual-host: all
x-hubspot-correlation-id: 8576f47c-0db4-46e9-971d-8c190c1612a5
x-request-id: 8576f47c-0db4-46e9-971d-8c190c1612a5

GET
H2 200 public Show response
api.hubspot.com/livechat-public/v1/message/ Frame 4E9F 3 KB
2 KB 297ms
297ms XHR
application/json 104.16.117.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: js.usemessages.com
URL: https://js.usemessages.com/conversations-embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.117.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

51aeb050ec511a0b006d9bcea3fdc3b15fceb2f31cd55dd20f4e607f754632de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.chronicle.security/
X-HubSpot-Messages-Uri: https://go.chronicle.security/hubfs/warstory/warstory_embed.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a547a707-3298-4495-b9b6-819cde1dd242
x-envoy-upstream-service-time: 38
content-length: 1405
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a547a707-3298-4495-b9b6-819cde1dd242
server: cloudflare
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://go.chronicle.security
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-l5zck
cache-control: no-cache, no-store, no-transform, must-revalidate, max-age=0
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oJQveNo6wWVm315bTDHARP8ti%2Fd%2BPH3WhRNdgtXgyYn1qkqvwxBEN2me%2FjlPgfyUiJXLJU8bMfKHmZdRNwGn0qSZwdR4EOVFKEAINvaZna3rCAu5FHNO%2FXqJtFvaQtqnow%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8a0c2a32ea7ca86a-SYD
access-control-allow-headers: Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri

GET
H2 200 2567647.js Show response
js-na1.hs-scripts.com/ Frame 4E9F 2 KB
1 KB 337ms
19ms Script
application/javascript 104.16.139.209
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js-na1.hs-scripts.com/2567647.js

Requested by

Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1549251900000/2567647.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.139.209 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b036b61ed3d758b755922bf9da90bab824db0de247acfd9ac0ae58c020504a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-hubspot-correlation-id: 131209f0-afc3-41c6-9271-aa826ea7c6ca
x-evy-trace-route-service-name: envoyset-translator
cf-polished: origSize=1997
age: 722
x-envoy-upstream-service-time: 23
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 131209f0-afc3-41c6-9271-aa826ea7c6ca
cf-bgj: minify
last-modified: Tue, 09 Jul 2024 23:29:24 GMT
server: cloudflare
access-control-max-age: 3600
vary: origin, Accept-Encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: https://go.chronicle.security
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-7dd59b876-hbzqf
x-evy-trace-virtual-host: all
access-control-allow-credentials: true
cf-ray: 8a0c2a319db1a826-SYD

GET
H2 200 __ptq.gif
track.hubspot.com/ Frame 4E9F 45 B
1 KB 573ms
257ms Image
image/gif 104.16.118.116
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-au&bfp=3640867636&v=1.1&a=2567647&r=https%3A%2F%2Fdemo.backstory.chronicle.security%2F&pu=https%3A%2F%2Fgo.chronicle.security%2Fhubfs%2Fwarstory%2Fwarstory_embed.html&t=warstory&cts=1720568486333&vi=7bac4b09cc34613652bb18bdb8bb8f42&nc=true&ce=false&cc=0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.118.116 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: a4460e7e-2696-4dea-92c6-7670fcca0c1f
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 9
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: a4460e7e-2696-4dea-92c6-7670fcca0c1f
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=445sZoo5YnUbIaNFJ22tkyuzH6iebsMNsA0aPB7FJX%2BIh7Dp5nO8nuP8src5LHXucFv2nZY%2F%2FlhHwv4rN2JdZSFNiX%2BBoKOxwIlw%2BvZvGgZXE5XvT9uS%2BhBQXO2AlNVptUHB"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-756b8c8b56-nxqrk
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8a0c2a319bb6a7f9-SYD
x-robots-tag: none

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ Frame 4E9F 135 B
458 B 232ms
231ms XHR
application/json 104.16.110.254
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=2567647&utk=7bac4b09cc34613652bb18bdb8bb8f42

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.110.254 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ca0a6b70e1dc9195db0fd470c712873afe57c3f8eaefc768e426c9efde90ba5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:26 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 268141e3-1f52-43a9-9b0b-266403778bed
x-envoy-upstream-service-time: 8
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 268141e3-1f52-43a9-9b0b-266403778bed
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://go.chronicle.security
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-65f7f7c749-8zszv
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8a0c2a2fae9ea7f6-SYD

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.IKZeRvoAYNY.O/m=auth/rt=j/sv=1/d=1/ed=1/am=AAAQ/rs=AHpOoo-SMWTzMRJrTty6iE5dL_aWGYOnuw/ 261 KB
90 KB 5ms
4ms Script
text/javascript 142.250.66.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.IKZeRvoAYNY.O/m=auth/rt=j/sv=1/d=1/ed=1/am=AAAQ/rs=AHpOoo-SMWTzMRJrTty6iE5dL_aWGYOnuw/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/auth.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.66.238 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s15-in-f14.1e100.net

Software

sffe /

Resource Hash

ac5821672e9c71053e18fa5dc9146ea24308675ccd6e725b39d61e0fd5b1e44c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demo.backstory.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 10:25:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393339
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 91488
x-xss-protection: 0
last-modified: Thu, 06 Jun 2024 15:21:04 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 05 Jul 2025 10:25:47 GMT

GET
H2 200 2567647.js Show response
js.hs-banner.com/ Frame 4E9F 62 KB
19 KB 574ms
260ms Script
text/javascript 172.64.153.27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/2567647.js
Requested by: Host: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/2567647.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.153.27 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9259aedb1c93aaf67b28adb979f222ca72c364df85bb80823d00a06a89169e20

Request headers

Referer: https://go.chronicle.security/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 23:41:27 GMT
x-amz-version-id: hGiyi7OfUGboXPAw8BKjPtAFtrH31K3y
content-encoding: gzip
cf-cache-status: REVALIDATED
x-amz-request-id: MYYRF0TTH3T2AW1X
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: dd3587b6-48be-4bf8-b444-af06a3275a58
x-envoy-upstream-service-time: 61
x-amz-id-2: BUxGnYQioPSwZ43Du93pvv61UWBmPpyEQtwaZH41JQX3QG5DdznHG42UXMfP39Kelz7KXMRTNJ8=
x-evy-trace-listener: listener_https
x-request-id: dd3587b6-48be-4bf8-b444-af06a3275a58
x-evy-trace-route-configuration: listener_https/all
last-modified: Fri, 29 Mar 2024 16:22:27 GMT
server: cloudflare
etag: W/"15f2299e9429ee270b475859eb7388c2"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: https://go.chronicle.security
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-7bfb89fbf6-zmwrp
vary: origin, Accept-Encoding
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8a0c2a33af3a7e42-SYD
expires: Tue, 09 Jul 2024 23:46:27 GMT

GET 3cd12d25ed154e6b9359bdc12bf72706
app.hubspot.com/conversations-visitor/2567647/threads/utk/ Frame 4DD1 0
0

OPTIONS view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 0
0

POST view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame 4E9F 0
0

POST
H3 204 jserror Show response
demo.backstory.chronicle.security/ 0
21 B 428ms
426ms XHR
text/html 142.250.76.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://demo.backstory.chronicle.security/jserror?script=https%3A%2F%2Fdemo.backstory.chronicle.security%2F%3Fwarstory%3D&error=Failed%20to%20fetch%20for%20url%20https%3A%2F%2Fmalachitefrontend-pa.googleapis.com%2Fv1%2FlistCustomerStats%3F%2524prettyPrint%3Dfalse%26key%3DAIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w&line=Not%20available

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/malachite/_/js/k=malachite.sc.en_US.KoT5VniOhcY.2018.O/am=GAY/d=1/rs=AB5NQxmKLwlaHq3uYVw_zjgU5ocVxOfNOw/m=base

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.76.100 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd09s24-in-f4.1e100.net

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KqW9wSrw54HH_s2hSfLJfg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Referer: https://demo.backstory.chronicle.security/?warstory=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 09 Jul 2024 23:41:27 GMT
content-security-policy: script-src 'report-sample' 'nonce-KqW9wSrw54HH_s2hSfLJfg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
x-content-type-options: nosniff
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1
expires: Mon, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: malachitefrontend-pa.googleapis.com
URL: https://malachitefrontend-pa.googleapis.com/v1/listCustomerStats?%24prettyPrint=false&key=AIzaSyA3DVrglZedU61_wXFR6dcq0U1cyWcmN1w

Domain: app.hubspot.com
URL: https://app.hubspot.com/conversations-visitor/2567647/threads/utk/3cd12d25ed154e6b9359bdc12bf72706?uuid=7115a2586eda42158c82e691a4f1ea1e&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=&domain=go.chronicle.security&inApp53=false&messagesUtk=3cd12d25ed154e6b9359bdc12bf72706&url=https%3A%2F%2Fgo.chronicle.security%2Fhubfs%2Fwarstory%2Fwarstory_embed.html&inline=false&isFullscreen=false&globalCookieOptOut=&isFirstVisitorSession=true&isAttachmentDisabled=false&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hideScrollToButton=true

Domain: js.hs-banner.com
URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Domain: js.hs-banner.com
URL: https://js.hs-banner.com/cookie-banner-public/v1/activity/view

Verdicts & Comments Add Verdict or Comment

12806 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.goo.gle/	1970-01-21 02:15:20	Name: _bit Value: o69nFj-bdaf9c15877a6c01f6-00A
.demo.backstory.chronicle.security/	1969-12-31 23:59:59	Name: MALACHITE_SESSION Value: P/vKYX88Jo/3Wfbe7BYqSQ==
.chronicle.security/	1970-01-21 07:32:08	Name: _ga Value: GA1.1.1567536284.1720568484
.go.chronicle.security/	1970-01-20 21:56:10	Name: __cf_bm Value: Il0.tXxKYCJ4TLvQfh30TZ3syGfEqBSrmzuZWPJEewE-1720568485-1.0.1.1-xN_EL9N478vYURQyl6jlh44nLSfQNmqpi290R0sm._ePlpRH3PQxyhKq8VPYOn79roS3YxEzmPRUZxuU3YyOag
.go.chronicle.security/	1969-12-31 23:59:59	Name: __cfruid Value: 6f3e7d4c4f0b354c0c36d4dd4c11569850570dca-1720568485
.chronicle.security/	1970-01-21 07:32:08	Name: _ga_TEFQEBSN44 Value: GS1.1.1720568483.1.1.1720568485.0.0.0
.hubspot.com/	1970-01-20 21:56:10	Name: __cf_bm Value: qEo0pHZS6gxKPQb7T7HUlKf9_T.kQvtxFEmrDE5pv_M-1720568486-1.0.1.1-s3v1bSlphx63rKP4Y3n26z01nj5Kys7gdU9ItdkLaZuJqShumxQThki3BYQS4wf78dm3athMxR5OLxEPMDYzcg
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: uCfUcotiF7NiGa5BsTSTFpWDTIQONN_7jhnJPXM8D40-1720568486905-0.0.1.1-604800000

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-tdkrkgB6PvwEuHVjYz-ewQ' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri /cspreport
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.hubspot.com
apis.google.com
app.hubspot.com
backstory.chronicle.security
demo.backstory.chronicle.security
fonts.googleapis.com
fonts.gstatic.com
forms.hscollectedforms.net
go.chronicle.security
goo.gle
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hscollectedforms.net
js.usemessages.com
malachitefrontend-pa.googleapis.com
siteintercept.qualtrics.com
track.hubspot.com
www.google-analytics.com
www.googletagmanager.com
www.gstatic.com
zn3xtrgskxc8qq06i-google.siteintercept.qualtrics.com
app.hubspot.com
js.hs-banner.com
malachitefrontend-pa.googleapis.com
104.16.110.254
104.16.117.116
104.16.118.116
104.16.139.209
104.16.160.168
104.16.75.142
104.17.208.240
142.250.66.238
142.250.71.78
142.250.76.100
142.251.221.72
142.251.221.74
172.217.167.106
172.217.167.67
172.217.24.35
172.64.153.27
199.60.103.28
67.199.248.12
005dd39746670e977b5eff644b1afe7b1c2f0bf13e8e9bb36a87675b44ccfbca
0d0a6262c545e8bbc895116e5afb22579c468d7abb77e378f377d6fed57c1dce
118efd87f0fdc13c7b2c3e4c78dd1cdeff067358c9cc05fa51e1c5e86897fa66
11c21f30dad16ddaf33a6b126abf26414ebed2d0721d424afe543003e3fa049a
369a904e6a2a6cb6fef3e935c723dead810c01aa74ff7771983a06e5f3cf8f39
369ddebff56e9bba915638dc905a52a8cbcb9f893d04f95c624fbf4013891a90
3b9a405c583acfa295a82895477683245125ed4a376ff070ecbfa00a5a21c8d9
3c141d5e5ff6233063f8020d1b9dd402492d382206d3852505af096056405162
3dcf4edf62169b6bf94a96339ec27a3d708698e88360f3a9c7a3d3188200f9bc
45d57dbba764b550f3c3e6d20fc303a516e4cc7a7d628b9d53e41d76f265163c
51aeb050ec511a0b006d9bcea3fdc3b15fceb2f31cd55dd20f4e607f754632de
53a3dc763a0bd679523a77f5610e4ab27231fe6763d7089c1c92966daa1663f7
5c6ba4d467b4f756068eb7fc36ceb70d1928c5f6382dec35cf10f3659eac55e2
679b0ee4d7dc41e078d6409b78a5471e4c3426d0ba88cf7d216047654e19c4d5
70ef2010ee0ce557292f5cdd53985b6dc8cd0e054054e86e5b36f9d881502f92
753b5d77684b20581dddd43b3a944bca93a44da9e6dee0c8232ca6ed8a40ead5
77290247eb7b54d245443acf515ddc09a2d1e60eda3d18062996c22d64582998
7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762
7ba9d2920048ac8ca77b96e52744f87fac655374d0df2f4fbf640435cbc8faa3
8ca0a6b70e1dc9195db0fd470c712873afe57c3f8eaefc768e426c9efde90ba5
9259aedb1c93aaf67b28adb979f222ca72c364df85bb80823d00a06a89169e20
96ade562dc72efa7bca30f837a9b3f362fb926681cd50a2d860f300f53b6040d
9bb18616e87dd656e5dfbe5f6590cabb37c0e2aa589f7819b4f6645223308d7f
9ce8a9898f81f2817ddc34c3a252e3158f6604efbe2a9fa49e057185e686b4cc
ac5821672e9c71053e18fa5dc9146ea24308675ccd6e725b39d61e0fd5b1e44c
b036b61ed3d758b755922bf9da90bab824db0de247acfd9ac0ae58c020504a13
ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9
d53cf91cb6ce51f95882ed98db1662b654844a0642f6bd284af0269502f80732
d788c2fd854f3442af002d5f549aa98b2f1c09afbe77e770469b9571c98e93d8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5671ac01524232eb88463c7c994f00f791a47e67ae2d05cdea06beeb4aa3c69

demo.backstory.chronicle.security Open in urlscan Pro 142.250.76.100 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

42 Requests

90 %HTTPS

0 %IPv6

14 Domains

22 Subdomains

18 IPs

2 Countries

5255 kBTransfer

19826 kBSize

8 Cookies

0 Outgoing links

Page URL History

Redirected requests

42 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

demo.backstory.chronicle.security Open in urlscan Pro
142.250.76.100 Public Scan

Screenshot
Live screenshot

Full Image

42
Requests

90 %
HTTPS

0 %
IPv6

14
Domains

22
Subdomains

18
IPs

2
Countries

5255 kB
Transfer

19826 kB
Size

8
Cookies

42 HTTP transactions
0 data transactions