redcanary.com Open in urlscan Pro
104.198.136.223  Public Scan

12 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 38

• https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 302
• https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID HTTP 307
• https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID HTTP 302
• https://attr.ml-api.io/?domain=redcanary.com&pId=7644109609258451639

Request Chain 43

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1667948572156%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fstopping-emotet-before-it-moves-laterally%252F%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true&e_ipv6=AQIb0ky8wn7fRAAAAYRZe3CEb9EepqhPRz6iJKR2zUIBRXIo3CZigwG7RPbZnd431uXsHPHYi2R-e4pkmfaPP6jYWkXYyA

125 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response redcanary.com/blog/stopping-emotet-before-it-moves-laterally/	379 KB 61 KB	571ms 182ms	Document text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash de3ccc3c52ffdabcf653efc6326df6d57b562b0621a75da4187473d293b59578 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff X-Frame-Options deny X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Tue, 08 Nov 2022 23:02:51 GMT feature-policy microphone 'none'; geolocation 'none' link <https://redcanary.com/?p=13345>; rel=shortlink referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=63072000 vary Accept-Encoding Accept-Encoding Accept-Encoding x-cache HIT: 2 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options deny x-permitted-cross-domain-policies master-only x-powered-by WP Engine x-xss-protection 1; mode=block
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.4.1/	86 KB 31 KB	68ms 20ms	Script text/javascript	2a00:1450:4001:827::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 19:57:15 GMT content-encoding gzip x-content-type-options nosniff age 11136 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30774 x-xss-protection 0 last-modified Mon, 13 May 2019 14:37:17 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 08 Nov 2023 19:57:15 GMT
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/	208 KB 69 KB	327ms 36ms	Script application/x-javascript	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 2797 etag "2d4002b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7671f04d6d2e5c85-FRA expires Wed, 09 Nov 2022 03:02:51 GMT
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/	130 KB 33 KB	66ms 26ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/highlight.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d2f545bb226e5bcc1d50af37b345d245dce63bc07aaeba2243e0f1ea87b2dcb9 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 11978467 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 33250 last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-20801" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rnPvJf%2FI1npaJRp7GiXZLnzJLHvEjNnYb0b8m5Mwz5LTv0Vgg%2BET5RNYDTYHHfBczTmKHg3T4B8SD%2FTun%2BCc98eWR0RJ4f1s8IBVROA1tTeEy9xNAMyYiaPEh%2FwM08RBezKYcOS4ksFHL651fjND72oZ"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7671f04bcaf98fdc-FRA expires Sun, 29 Oct 2023 23:02:51 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	98ms 19ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash 8a0dc0b446ca012e7e25688bec45ec66b473c1e343c0c77850df7f8be0ea18ad Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip last-modified Tue, 08 Nov 2022 16:50:29 GMT server ECS (frb/67D4) age 6471 etag "fe256c3592f3d81:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32316
GET H2	200	9416.js Show response script.crazyegg.com/pages/scripts/0096/	6 KB 2 KB	89ms 29ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0096/9416.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b944086ceb975b223f03d7c7a7564877a1034b35378ae07866771f2ab4f9cbe6 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip cf-cache-status HIT age 8259 cf-polished origSize=6088 ce-version 11.4.35 cf-bgj minify last-modified Tue, 08 Nov 2022 20:45:12 GMT server cloudflare vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 7671f04e6fa09a24-FRA
GET H2	200	js Show response www.googletagmanager.com/gtag/	211 KB 75 KB	89ms 40ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7c5287be36dd7e6c52e4fec4ccef271b138c60b315fb18dcd638dee2914b5f98 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 75902 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Tue, 08 Nov 2022 23:02:51 GMT
GET H2	200	qualified.js Show response js.qualified.com/	246 KB 71 KB	87ms 29ms	Script text/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 800cd23efea872b24ba5fafd2c2079ec163271742a9c9528d85b69b3158a7f75 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip via 1.1 spaces-router (e13668ca8eb7) strict-transport-security max-age=63072000; includeSubDomains cf-cache-status HIT x-content-type-options nosniff x-permitted-cross-domain-policies none age 15027 x-xss-protection 1; mode=block x-request-id 1616d96d-c236-97a2-84a7-69754eb3dc7f x-runtime 0.024257 referrer-policy strict-origin-when-cross-origin server cloudflare etag W/"800cd23efea872b24ba5fafd2c2079ec" x-download-options noopen vary Accept,Accept-Encoding x-frame-options SAMEORIGIN content-type text/javascript; charset=utf-8 cache-control public, max-age=14400 cf-ray 7671f04e6a7d995d-FRA expires Wed, 09 Nov 2022 03:02:51 GMT
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	3 KB 1 KB	314ms 249ms	Script application/javascript	2600:9000:21f3:3c00:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:21f3:3c00:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash d3afb61225cf41fb7e950369d6097cd1457b283b333100a0952aed1efdf62f78 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 7158aa4ac648947d564b98d9769b5b2a.cloudfront.net (CloudFront) server envoy x-amz-cf-pop FRA2-C2 etag W/"7a0c9912f0babd17cf2b2081b4f7f3f7" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id L3oSdxJ9pDljOEvqw7wUxEfNDvSJYHTQZypAPMcH-uSuCfrV6Nkh8A==
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	97 KB 29 KB	80ms 19ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash c02444f391e8655e79ff8d7d4cb69c3426c3bffbf8731a994fa23aed0f641d12 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:51 GMT Content-Encoding gzip Age 973 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1 Content-Length 29221 x-amzn-internal-status 304 Last-Modified Wed, 02 Nov 2022 19:43:37 GMT Server ECS (frb/6760) Etag "6633f9603c759c40d9b200995454f17c+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=1800
GET H/1.1	200 OK	teknkl-formsplus-1.0.5.js Show response s3-us-west-2.amazonaws.com/s.cdpn.io/250687/	41 KB 41 KB	589ms 200ms	Script application/x-js	52.92.212.176 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s3-us-west-2.amazonaws.com/s.cdpn.io/250687/teknkl-formsplus-1.0.5.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.92.212.176 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-west-2.amazonaws.com Software AmazonS3 / Resource Hash 731fcb30d45f2e35aaa139a7a964410a7c2bcdbfbb48a837c9d56dec7cc3732f Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT x-amz-version-id OjXdZ5iYdmgpgEuq0ftytCBc_PO35ThO Last-Modified Thu, 26 Apr 2018 08:20:46 GMT Server AmazonS3 x-amz-request-id 5DXG70RHBDVJZWF7 ETag "bab0c2b3523f8244564b675fe34db610" Content-Type application/x-js Cache-Control public Accept-Ranges bytes Content-Length 41617 x-amz-id-2 YOfoQi8BKokx0R3NEVN4mvBQwM8bxB4ZvX9jxcyPxQnGPfa8lvXOTERQeSKGHcslYNn0X0kxQMk=
GET H2	200	autoptimize_a58a2bf1223fa3a7dd9a56fa5b797288.js Show response redcanary.com/wp-content/cache/autoptimize/js/	288 KB 82 KB	156ms 154ms	Script application/javascript	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/js/autoptimize_a58a2bf1223fa3a7dd9a56fa5b797288.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash b69dbfe142fa59103a5112fcaf7881be5e6070d3495a8805ebe8213b552b478b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000 last-modified Fri, 04 Nov 2022 01:04:22 GMT server nginx etag W/"63646516-48010" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/	763 B 616 B	27ms 25ms	Stylesheet text/css	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.6.0/styles/default.min.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3cc36c64ef86bed21592653daac82fd7e4c364c32c8344336aa13f7dbf52c90 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 24851149 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 271 last-modified Mon, 08 Feb 2021 15:10:43 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "60215473-2fb" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gx0wnN%2BNiiGA%2BqzhRJ%2BvC%2Bs8He56WgtwEA%2BbgqGKY6gddLz63Tj3h87ZGV3xFuqDALm0IpX6XaSgOcY7%2F9%2FU2oEFZCh6X3%2BpngPq4En7lVzuEeEYU%2F5%2BBp6urx5LlSSVcdzRJLStwD4C7FSw6XkfQ1MU"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7671f04e0dc38fdc-FRA expires Sun, 29 Oct 2023 23:02:51 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	66ms 18ms	Script application/x-javascript	23.203.88.228 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.203.88.228 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-203-88-228.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 91a50850c517899e1c975079158949f7a500ddf5a7307fe36bf50092926beedc Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:51 GMT Content-Encoding gzip Last-Modified Fri, 09 Sep 2022 01:18:39 GMT Server AkamaiNetStorage ETag "92b41a298690c047b0c4602dd843cba4:1662686319.691662" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Content-Length 728
GET H2	200	gtm.js Show response www.googletagmanager.com/	264 KB 88 KB	114ms 65ms	Script application/javascript	2a00:1450:4001:827::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 84b7f052427427788cfe38325b43542eb416bda564a22819ecfd617516b5904b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 89942 x-xss-protection 0 last-modified Tue, 08 Nov 2022 22:08:45 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 08 Nov 2022 23:02:51 GMT
GET H2	200	6si.min.js Show response j.6sc.co/	30 KB 10 KB	73ms 21ms	Script application/javascript	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash aca17711b2bcab8335b7bd9c2880033b2aa69a0e9f33ce2e1a507dbb0f9cade3 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip x-content-type-options nosniff last-modified Thu, 29 Sep 2022 20:55:46 GMT server nginx/1.14.0 (Ubuntu) etag "63360652-7700" vary Accept-Encoding content-type application/javascript cache-control private, no-cache, proxy-revalidate accept-ranges bytes content-length 9869 expires Tue, 08 Nov 2022 23:02:51 GMT
GET H2	200	css fonts.googleapis.com/	7 KB 1 KB	78ms 30ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700&display=swap Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c89486a0c4b8c91529d5d3e2ce14f8501c467c13b3e571f613e1932590279bf9 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 08 Nov 2022 23:02:51 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 08 Nov 2022 23:02:51 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	0 29 B	352ms 243ms	Script application/javascript	18.135.18.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.135.18.21 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-135-18-21.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT cache-control private, max-age=600 x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/	168 KB 45 KB	320ms 211ms	Script application/javascript	18.135.18.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.135.18.21 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-135-18-21.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash 6ff2617dfab351552a5eba560038571ee65a568c6dbe2ab301235c0100f1d968 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
GET H2	404	forms.js x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/	0 0	266ms 210ms	Script application/javascript	18.135.18.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/forms.js?page_path=%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_4929514c8873a94b0c4085b130ee8ca6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.135.18.21 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-135-18-21.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff server envoy content-length 0 content-type application/javascript;charset=utf-8
GET H2	200	autoptimize_e6e2b0969bcaef3b768450b837b3122c.css redcanary.com/wp-content/cache/autoptimize/css/	3 MB 191 KB	155ms 154ms	Stylesheet text/css	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ff734e88ad0101171bfd333df8fae5735cb8f3fe2e036b968a6e5fad25c335a9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000 last-modified Fri, 04 Nov 2022 01:04:22 GMT server nginx etag W/"63646516-364442" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=31536000
GET DATA	200 OK	truncated /	64 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6dcc1490a0cc33cdeed8970677b89bbec6fa095675af198b8e923b64563c70a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	getForm Show response resource.redcanary.com/index.php/form/	9 KB 2 KB	875ms 875ms	Script application/javascript	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&callback=jQuery112406205375642906541_1667948571803&_=1667948571804 Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 445e090d11fe18b88d8635e2876282c013a0a163f499f0e5fa1e180c503f2ab8 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip cf-cache-status DYNAMIC server cloudflare vary Accept-Encoding content-type application/javascript; charset=utf-8 x-form-service-request-id fc70#184597b6e68 x-marketo-source Form Service cf-ray 7671f04e1e305c85-FRA cached false
GET H2	200	x.svg redcanary.com/wp-content/themes/redcanary/assets/img/	548 B 646 B	192ms 192ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/x.svg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash fa88de55ea55bea66f8f19898817e50b08ed956d9c288f9b52f90df76ab655d3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000 last-modified Mon, 23 Aug 2021 16:46:07 GMT server nginx etag W/"6123d0cf-224" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	source-sans-pro-v21-latin-regular.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	192ms 192ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-regular.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Thu, 02 Jun 2022 17:26:25 GMT server nginx etag "6298f2c1-32ec" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13036
GET H2	200	source-sans-pro-v21-latin-700.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	193ms 192ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-700.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Thu, 02 Jun 2022 17:26:24 GMT server nginx etag "6298f2c0-327c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12924
GET H2	200	source-sans-pro-v21-latin-300.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	192ms 192ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-300.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 122854df4f39cf922db317714c2ff0eccab27a1028c14a5aa2211f48b7e0eade Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Thu, 02 Jun 2022 17:26:22 GMT server nginx etag "6298f2be-329c" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 12956
GET H2	200	source-sans-pro-v21-latin-600.woff2 redcanary.com/wp-content/themes/redcanary/assets/fonts/	13 KB 13 KB	192ms 192ms	Font font/woff2	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-content/themes/redcanary/assets/fonts/source-sans-pro-v21-latin-600.woff2 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash bc9a16cd945457ad9463cdaed95129b01c589466978dfee3d019d9c604b2171a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Origin https://redcanary.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Thu, 02 Jun 2022 17:26:23 GMT server nginx etag "6298f2bf-32fc" vary Accept-Encoding content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 13052
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/162/	11 KB 5 KB	19ms 19ms	Script application/x-javascript	23.203.88.228 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/162/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.203.88.228 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-203-88-228.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:51 GMT Content-Encoding gzip Last-Modified Fri, 01 Jul 2022 00:59:12 GMT Server AkamaiNetStorage ETag "75daf56f6191efe42577301908659c29:1656637152.894482" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4677 Expires Thu, 16 Feb 2023 23:02:51 GMT
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/site/	9 KB 2 KB	71ms 30ms	XHR application/json	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/site/redcanary.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf09f90e40b164e2a73bb6a062334254fef046d9e153dad422381ab63cbd68cf Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:51 GMT content-encoding gzip cf-cache-status HIT age 8781 ce-version 11.4.35 content-length 2019 last-modified Tue, 08 Nov 2022 20:36:30 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7671f04eee979055-FRA
POST H/1.1	200 OK	visitWebPage 003-yru-314.mktoresp.com/webevents/	2 B 318 B	1087ms 223ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1667948571940&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1667948571939-22266&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/162/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:52 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id b1a4faa1-9ed1-4b15-b2ae-86f4bef5a688
POST H2	204	collect region1.google-analytics.com/g/	0 345 B	74ms 26ms	Ping text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.google-analytics.com/g/collect?v=2&tid=G-T3K4MTNQJN&gtm=2oeb70&_p=1975001050&cid=1190939702.1667948572&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1667948572&sct=1&seg=0&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&dt=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-T3K4MTNQJN Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	971ec4d62e2a225680add3302d9aacbb.js Show response script.crazyegg.com/pages/versioned/common-scripts/	87 KB 29 KB	28ms 27ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/versioned/common-scripts/971ec4d62e2a225680add3302d9aacbb.js Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0096/9416.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2f6dc2097f638679a6dfa22149115d95793bfc99eb3824357b53bd300dc3eeb7 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip cf-cache-status HIT last-modified Fri, 28 Oct 2022 17:50:42 GMT server cloudflare age 24754 vary Accept-Encoding content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000, s-maxage=31536000 accept-ranges bytes timing-allow-origin * cf-ray 7671f04f28b99a24-FRA content-length 29882
GET H2	200	uwt.js Show response static.ads-twitter.com/	56 KB 15 KB	85ms 27ms	Script application/javascript	146.75.116.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip last-modified Thu, 27 Oct 2022 16:56:53 GMT etag "32ad004436155ec972bc50e6238b5b67+gzip+gzip" vary Accept-Encoding,Host x-cache HIT, HIT content-type application/javascript; charset=utf-8 p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" x-tw-cdn FT cache-control no-cache accept-ranges bytes content-length 15375 x-served-by cache-iad-kjyo7100081-IAD, cache-fra-eddf8230123-FRA
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	997 B 639 B	78ms 22ms	Script application/x-javascript	2a02:26f0:3500:16::215:14a0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash bb16ee6fd17d39c404201dc8db250ddc46b29c963d4334b3952e9508eb1c4381 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip last-modified Tue, 08 Nov 2022 00:38:08 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=83955 accept-ranges bytes content-length 471
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	25 KB 8 KB	84ms 18ms	Script application/javascript	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 4b4e80032e1c164685d3ff6eb4c606785ebaebaa648d3984478b0cc8d114190b Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish last-modified Mon, 07 Nov 2022 16:45:46 GMT server snooserv nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} etag "3528fd00b652f61a266eb584d96f4fcc" vary Accept-Encoding,Origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]} content-type application/javascript cache-control public, max-age=60 accept-ranges bytes content-length 7722
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/	2 KB 2 KB	116ms 66ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1667948572043&cv=11&fst=1667948572043&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&hn=www.googleadservices.com&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&auid=1486508096.1667948572&uaw=0&rfmt=3&fmt=4 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c15ed2ba38afb6917359bcc01b51f5642f60deeba4c74913d54f9000d8fe43a2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT content-encoding br x-content-type-options nosniff server cafe content-type text/javascript; charset=UTF-8 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 915 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	95ms 46ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip date Tue, 08 Nov 2022 23:02:51 GMT last-modified Thu, 28 Jul 2022 17:32:37 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 487136C9D1A74EA1B985D1A16F7CCB20 Ref B: FRAEDGE2009 Ref C: 2022-11-08T23:02:52Z etag "80a8697a8a2d81:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 11367
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	103 KB 28 KB	70ms 22ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f896040524443394b8b1ba4fbd1de94be74378ab901e53b3b40c1323d1735143 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 08 Nov 2022 23:02:52 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27337 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug PFWTeBY+AEkg7ifOXO3F/4P0am+9TvuK8Q96eZNQlsbQ2knyYEy6jHDwGJnKG/M4RvsWDnwkg42XPRFHah+wiw== x-fb-trip-id 686109401 cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ attr.ml-api.io/ Redirect Chain https://s.ml-attr.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/getuid?https%3a%2f%2fattr.ml-api.io%2f%3fdomain%3dredcanary.com%26pId%3d%24UID https://secure.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fattr.ml-api.io%252f%253fdomain%253dredcanary.com%2526pId%253d%2524UID https://attr.ml-api.io/?domain=redcanary.com&pId=7644109609258451639	0 234 B	451ms 393ms	Image application/json	2600:9000:20c3:2000:12:3734:2a40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://attr.ml-api.io/?domain=redcanary.com&pId=7644109609258451639 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Server 2600:9000:20c3:2000:12:3734:2a40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:53 GMT via 1.1 7e5808188f3301eda7b952b4c6dfa208.cloudfront.net (CloudFront) x-amz-cf-pop MUC50-C1 x-cache Miss from cloudfront content-type application/json x-amz-cf-id XwyS_L1ai8UimF2l-_L-MOI-_tFCtSEVLfjHz6ZTWbFYresIR1BAFQ== content-length 0 apigw-requestid bTf0kgW-IAMEVXA= Redirect headers Date Tue, 08 Nov 2022 23:02:52 GMT P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Connection keep-alive X-Proxy-Origin 217.114.215.132; 217.114.215.132; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com Content-Length 0 X-XSS-Protection 0 Pragma no-cache AN-X-Request-Uuid a5d8ff85-d700-4fed-bb02-60425995107d Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type text/html; charset=utf-8 Access-Control-Allow-Origin * Location https://attr.ml-api.io/?domain=redcanary.com&pId=7644109609258451639 Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	8 KB 3 KB	21ms 20ms	Script application/x-javascript	2a02:26f0:3500:16::215:14a0 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip last-modified Mon, 24 Oct 2022 21:02:26 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=27688 accept-ranges bytes content-length 3063
GET H2	200	rp.gif alb.reddit.com/	42 B 157 B	180ms 125ms	Image image/gif	151.101.193.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1667948572135&id=t2_5kac730w&event=PageVisit&m.itemCount=&m.value=&m.valueDecimal=&m.currency=&m.transactionId=&m.customEventName=&m.products=&uuid=dbb95203-9570-4da3-bb9b-de35fc547dea&aaid=&em=&external_id=&idfa=&integration=reddit&opt_out=0&sh=1600&sw=1200&v=rdt_1967aea8 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.140 , United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT via 1.1 varnish server Varnish content-type image/gif cross-origin-resource-policy cross-origin accept-ranges bytes content-length 42 retry-after 0
GET H2	200	adsct t.co/i/	43 B 377 B	175ms 130ms	Image image/gif	104.244.42.197 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?bci=3&eci=2&event_id=73e8bb7e-4910-4df1-ad2f-6fe74dc80362&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d5befd07-0c95-40a6-a2d2-126691e7a0ba&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.197 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-response-time 108 date Tue, 08 Nov 2022 23:02:51 GMT strict-transport-security max-age=0 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id 44035e8878a8a99e cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 6b5e28061aa4feac4a06b76a8318b9f0fa814dc3d3163222f14b2468d9292376 content-length 43
GET H2	200	adsct analytics.twitter.com/i/	43 B 394 B	181ms 132ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?bci=3&eci=2&event_id=73e8bb7e-4910-4df1-ad2f-6fe74dc80362&events=%5B%5B%22pageview%22%2C%7B%7D%5D%5D&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=d5befd07-0c95-40a6-a2d2-126691e7a0ba&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tw_iframe_status=0&tw_order_quantity=0&tw_sale_amount=0&txn_id=o015g&type=javascript&version=2.3.29 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-response-time 110 date Tue, 08 Nov 2022 23:02:52 GMT strict-transport-security max-age=631138519 server tsa_o content-type image/gif;charset=utf-8 x-transaction-id bc50c49613f6a34b cache-control no-cache, no-store, max-age=0 perf 7626143928 x-connection-hash 27446e780dba49a30c5e9384dc91a3ce6886a475031c8e52d3b9621714c0cbad content-length 43
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1667948572156%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true&e_ipv6=AQIb0ky8wn7fR...	0 267 B	258ms 197ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true&e_ipv6=AQIb0ky8wn7fRAAAAYRZe3CEb9EepqhPRz6iJKR2zUIBRXIo3CZigwG7RPbZnd431uXsHPHYi2R-e4pkmfaPP6jYWkXYyA Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: 7F02DCF35DB04DABAF873DF40DF763D6 Ref B: DUS30EDGE0907 Ref C: 2022-11-08T23:02:52Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-lor1 x-li-proto http/2 content-length 0 x-li-uuid AAXs/YozjfeTMvYLJ1S35Q== Redirect headers date Tue, 08 Nov 2022 23:02:52 GMT x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: E24523FD4DE54660964FD4CCCC65DA16 Ref B: FRAEDGE1814 Ref C: 2022-11-08T23:02:52Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-lor1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1667948572156&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true&e_ipv6=AQIb0ky8wn7fRAAAAYRZe3CEb9EepqhPRz6iJKR2zUIBRXIo3CZigwG7RPbZnd431uXsHPHYi2R-e4pkmfaPP6jYWkXYyA x-li-proto http/2 content-length 0 x-li-uuid AAXs/YovYS397NjwK8WmHg==
GET H2	204	56383426.js Show response bat.bing.com/p/action/	0 117 B	121ms 119ms	Script text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/56383426.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-origin * strict-transport-security max-age=31536000; includeSubDomains; preload cache-control private,max-age=1800 date Tue, 08 Nov 2022 23:02:51 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: B63C5148AF714E3DBA051B33DA6F58BF Ref B: FRAEDGE2009 Ref C: 2022-11-08T23:02:52Z x-cache CONFIG_NOCACHE
GET H3	200	1042590016249604 Show response connect.facebook.net/signals/config/	293 KB 84 KB	94ms 72ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/1042590016249604?v=2.9.89&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c0cc8e1f6e6233323be5f77b1db868effc38ffc0eb88fa3c8c0f27db9c6f4d84 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=31536000; preload; includeSubDomains date Tue, 08 Nov 2022 23:02:52 GMT document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 x-fb-rlafr 0 x-xss-protection 0 pragma public x-fb-debug RJsCsQ2dIZx4GrFDQO7vwyALvIpbC4PEHdTbxIaIZHvdpcFBEKIoVl2yTjnM8bFkYX32sar2MequpRaYsfMrHA== cross-origin-opener-policy same-origin-allow-popups vary Accept-Encoding x-frame-options DENY content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/759876114/	42 B 548 B	79ms 32ms	Image image/gif	2a00:1450:4001:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/759876114/?random=1667948572043&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&fmt=3&is_vtc=1&random=2217490008&rmt_tld=0&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/759876114/	42 B 548 B	75ms 31ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/759876114/?random=1667948572043&cv=11&fst=1667948400000&bg=ffffff&guid=ON&async=1&gtm=2wgb70&u_w=1600&u_h=1200&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&fmt=3&is_vtc=1&random=2217490008&rmt_tld=1&ipr=y Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	295ms 201ms	XHR application/json	18.135.18.21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_4929514c8873a94b0c4085b130ee8ca6/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.135.18.21 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-135-18-21.eu-west-2.compute.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload server envoy vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://redcanary.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://api.segment.io https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
GET H2	200	/ www.facebook.com/tr/	0 185 B	368ms 20ms	Image text/plain	157.240.20.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=1042590016249604&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&rl=&if=false&ts=1667948572512&sw=1600&sh=1200&v=2.9.89&r=stable&ec=0&o=30&fbp=fb.1.1667948572511.392751270&it=1667948572178&coo=false&rqm=GET Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 157.240.20.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-frt3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains date Tue, 08 Nov 2022 23:02:52 GMT server proxygen-bolt content-type text/plain access-control-allow-origin access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 0
GET H2	200	globe-white-right.png redcanary.com/wp-content/themes/redcanary/assets/img/	259 KB 260 KB	133ms 133ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/globe-white-right.png Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Wed, 27 Feb 2019 15:51:11 GMT server nginx etag "5c76b1ef-40da2" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 265634
GET H2	200	search-btn.svg redcanary.com/wp-content/themes/redcanary/assets/img/	161 B 411 B	261ms 261ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/search-btn.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 0f57969cdf0d61b86fc25ded8a8c5058a5edd346d1845b232610a54f08d0fcb8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000 last-modified Wed, 08 Sep 2021 23:08:04 GMT server nginx etag W/"61394254-a1" vary Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	redcanary.com.json Show response script.crazyegg.com/pages/data-scripts/0096/9416/sampling/	159 B 257 B	26ms 26ms	XHR application/json	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0096/9416/sampling/redcanary.com.json?t=463319 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/971ec4d62e2a225680add3302d9aacbb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f24a0e513f2220b94fda43c5193cd7aa0b83afc0ac88a650ac5a301a1023b9b1 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip cf-cache-status HIT age 8781 ce-version 11.4.35 content-length 146 last-modified Tue, 08 Nov 2022 20:36:31 GMT server cloudflare vary Accept-Encoding content-type application/json access-control-allow-origin * access-control-expose-headers CE-Version cache-control public, max-age=300, s-maxage=1209600 accept-ranges bytes timing-allow-origin * cf-ray 7671f052aaf19055-FRA
GET H2	200	ipv cdn.bizible.com/m/	43 B 327 B	20ms 19ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=77c2d2b5363247bce3738a9f31986ebf&_biz_s=7a01aa&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1667948571901&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&_biz_n=0&a=redcanary.com&rnd=411794&cdn_o=a&_biz_z=1667948572580 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT last-modified Wed, 02 Nov 2022 14:12:17 GMT server ECS (frb/6760) age 550241 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 204 B	35ms 19ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=77c2d2b5363247bce3738a9f31986ebf&_biz_s=7a01aa&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1667948572582&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&a=redcanary.com&rnd=289132&cdn_o=a&_biz_z=1667948572582 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT last-modified Thu, 03 Nov 2022 23:58:36 GMT server ECS (frb/67C2) age 428656 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H/1.1	200 OK	widget_iframe.644279d1635fd969e87af94a98bd232b.html Show response platform.twitter.com/widgets/ Frame D965	320 KB 104 KB	19ms 19ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.644279d1635fd969e87af94a98bd232b.html?origin=https%3A%2F%2Fredcanary.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6762) / Resource Hash 8c0531412c543b9bd978e29acb8f5cf330db9891115d1e9924519d9a675b7b74 Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 520923 Cache-Control public, max-age=315360000 Content-Encoding gzip Content-Length 105445 Content-Type text/html; charset=utf-8 Date Tue, 08 Nov 2022 23:02:52 GMT Etag "50d73c0b4a4c7e4697b9c6ac6f1ecd75+gzip" Last-Modified Wed, 02 Nov 2022 19:36:59 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (frb/6762) Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1 Vary Accept-Encoding X-Cache HIT x-tw-cdn VZ
GET H2	204	0 bat.bing.com/action/	0 175 B	47ms 47ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=56383426&tm=gtm002&Ver=2&mid=d459a104-ddf3-4393-a49c-2c0c11bdd2ad&sid=793ef6005fb911edae34712a39199a11&vid=793f2b205fb911ed97b5afbb270f01ec&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&p=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&r=&lt=1745&evt=pageLoad&sv=1&rn=220308 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload date Tue, 08 Nov 2022 23:02:51 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 8FE12ED966CE4A93B1B651D3D8D65C1A Ref B: FRAEDGE2009 Ref C: 2022-11-08T23:02:52Z x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	healthcheck Show response pagestates-tracking.crazyegg.com/ Frame 744F	19 B 462 B	83ms 19ms	XHR application/json	143.204.89.72 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://pagestates-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/971ec4d62e2a225680add3302d9aacbb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.89.72 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-89-72.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Fri, 30 Sep 2022 16:18:54 GMT via 1.1 5721f7035c3fc934bd3f96dbb04ba1e4.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 age 3393839 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id R9_WfccNalMOuDG4jhsZ9e6-YZCxBpJ42XEjLq24Z-YtNnH7pkmZgA==
GET H2	200	healthcheck Show response assets-tracking.crazyegg.com/ Frame 744F	19 B 460 B	79ms 19ms	XHR application/json	13.224.189.10 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://assets-tracking.crazyegg.com/healthcheck Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/971ec4d62e2a225680add3302d9aacbb.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.189.10 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-189-10.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Mon, 31 Oct 2022 08:40:59 GMT via 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 age 742914 x-cache Hit from cloudfront content-length 19 last-modified Fri, 08 Jul 2022 22:25:51 GMT server AmazonS3 etag "d06f04fccf68d0b228a5923187ce1afd" access-control-max-age 31536000 access-control-allow-methods GET, HEAD content-type application/json access-control-allow-origin * access-control-expose-headers Access-Control-Allow-Origin accept-ranges bytes x-amz-cf-id oE3A_mIuejcu_LZ3J_zYCNh6RBJeVPkPFFsxsFARYe_7bPb6iYFMhQ==
GET H2	200	FW_CTA.png redcanary.com/wp-content/uploads/2021/12/	10 KB 10 KB	145ms 144ms	Image image/png	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2021/12/FW_CTA.png Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 189ad7a7020dd6c9ea981356dd3984efa36851e4eead327f5c94110e139d08c2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Tue, 21 Dec 2021 02:58:51 GMT server nginx etag "61c142eb-286e" vary Accept-Encoding content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 10350
GET H2	200	cta-background.jpg redcanary.com/wp-content/uploads/2018/12/	7 KB 7 KB	147ms 146ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash ecf6782eee74878f85da64d073a0707c4965f712d7eec6926ea4c9151228e100 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Mon, 09 Nov 2020 21:51:33 GMT server nginx etag "5fa9b9e5-1a18" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 6680
GET H2	200	Threat-Detection-975x975.jpg redcanary.com/wp-content/uploads/2019/02/	49 KB 49 KB	169ms 168ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/02/Threat-Detection-975x975.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 178d367fb74e2bc5485d53669b13f93b3384cfae0e6a16427c6a33895490153f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Mon, 09 Nov 2020 21:41:25 GMT server nginx etag "5fa9b785-c451" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 50257
GET H2	200	Brian-Donohue.jpg redcanary.com/wp-content/uploads/2019/02/	19 KB 19 KB	173ms 172ms	Image image/jpeg	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/uploads/2019/02/Brian-Donohue.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 819a9261cf87ff4ca13e08fbbb3e84e7827ea409869fc3d87b75bd8224bbd41d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests strict-transport-security max-age=63072000 last-modified Mon, 09 Nov 2020 21:47:50 GMT server nginx etag "5fa9b906-4ad4" vary Accept-Encoding content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes content-length 19156
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	29 B 993 B	25ms 19ms	XHR application/json	37.252.171.53 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 6cb76bc8ad85c046a4d2681e42590cab3930350b823e8b543ec81e727ddecf65 Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Pragma no-cache Date Tue, 08 Nov 2022 23:02:52 GMT AN-X-Request-Uuid 8902654b-e4d7-40d6-a340-56805d90887b Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 217.114.215.132; 217.114.215.132; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com Content-Length 29 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	27ms 26ms	XHR text/html	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 280 B	73ms 21ms	XHR text/html	2a02:26f0:1700:18c::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:18c::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 68f15b518df520f9c378bbfc39d4683fdd6dc1ba5085a98b9c72c2b3e2e8a1ac Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:1010:3:1011:1fbb:28ba:8ffd server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 36 expires Tue, 08 Nov 2022 23:02:52 GMT
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	29 B 993 B	43ms 19ms	XHR application/json	37.252.171.53 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.21.3 / Resource Hash 6cb76bc8ad85c046a4d2681e42590cab3930350b823e8b543ec81e727ddecf65 Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Pragma no-cache Date Tue, 08 Nov 2022 23:02:52 GMT AN-X-Request-Uuid dc5315ec-3fad-4289-9304-dcce4b0fd2e0 Server nginx/1.21.3 Accept-CH Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness Content-Type application/json; charset=utf-8 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://redcanary.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive X-Proxy-Origin 217.114.215.132; 217.114.215.132; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com Content-Length 29 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	26ms 25ms	XHR text/html	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 280 B	70ms 21ms	XHR text/html	2a02:26f0:1700:18c::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:18c::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 68f15b518df520f9c378bbfc39d4683fdd6dc1ba5085a98b9c72c2b3e2e8a1ac Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:1010:3:1011:1fbb:28ba:8ffd server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 36 expires Tue, 08 Nov 2022 23:02:52 GMT
GET BLOB	200 OK	278af887-c16a-43af-b6c1-b2b4e0666d60 https://redcanary.com/	45 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/278af887-c16a-43af-b6c1-b2b4e0666d60 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash e8f74416e7bc7051dbd2c0b2dec8cdb9a5ba4b36f88ba1b65c3e7dd7447b4090 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Length 45 Content-Type text/javascript
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 527 B	137ms 137ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=77c2d2b5363247bce3738a9f31986ebf&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.11.03&a=redcanary.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash aadc89a2636bc0081026ea05d0ff240d873d580e142dd8289c5f4e22c3b1141c Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip server ECS (frb/6711) etag B63C9F81 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type text/javascript; charset=utf-8 cache-control private, must-revalidate, max-age=21600 content-length 219
GET H2	200	settings Show response syndication.twitter.com/ Frame D965	914 B 696 B	181ms 135ms	Fetch application/json	104.244.42.8 TWITTER
General Check archive.org Show headers Download Go to Full URL https://syndication.twitter.com/settings?session_id=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets/widget_iframe.644279d1635fd969e87af94a98bd232b.html?origin=https%3A%2F%2Fredcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.8 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash 66c1aff8564f0c727747c0a2f1ac6f5a215100fb599807bacecf6b23b1a6a975 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-response-time 117 date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip strict-transport-security max-age=631138519 last-modified Tue, 08 Nov 2022 23:02:52 GMT server tsa_o vary Origin content-type application/json; charset=utf-8 access-control-allow-origin https://platform.twitter.com x-transaction-id 39bb7cee3878e693 cache-control must-revalidate, max-age=600 access-control-allow-credentials true perf 7626143928 x-connection-hash ef4af5b10e08de121373a30e6302a4038ffe755e2c1a270a091d3e16f3bd045b content-length 375
GET H2	200	u cdn.bizible.com/m/	43 B 121 B	20ms 19ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1667948571939-22266&_biz_u=77c2d2b5363247bce3738a9f31986ebf&_biz_s=7a01aa&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1667948572583&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&_biz_n=1&a=redcanary.com&rnd=622988&cdn_o=a&_biz_z=1667948572727 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:52 GMT last-modified Fri, 04 Nov 2022 00:00:40 GMT server ECS (frb/6776) age 428532 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" content-type Image/GIF cache-control no-cache, no-store accept-ranges bytes content-length 43 expires -1
GET H2	200	forms2.css resource.redcanary.com/js/forms2/css/	13 KB 3 KB	36ms 36ms	Stylesheet text/css	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 2797 etag "2d4004c-3437-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7671f0540f045c85-FRA content-length 2623 expires Wed, 09 Nov 2022 03:02:52 GMT
GET H2	200	forms2-theme-plain.css resource.redcanary.com/js/forms2/css/	828 B 346 B	37ms 36ms	Stylesheet text/css	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/css/forms2-theme-plain.css Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value Strict-Transport-Security max-age=63113904 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-encoding gzip x-content-type-options nosniff strict-transport-security max-age=63113904 cf-cache-status HIT age 2797 content-length 246 last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare etag "2d400a5-33c-5ea394834ab40" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 7671f0540f065c85-FRA expires Wed, 09 Nov 2022 03:02:52 GMT
GET H2	200	clock Show response tracking.crazyegg.com/ Frame 744F	29 B 136 B	156ms 53ms	XHR text/plain	54.171.52.164 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tracking.crazyegg.com/clock?t=1667948572803 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/versioned/common-scripts/971ec4d62e2a225680add3302d9aacbb.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.171.52.164 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-171-52-164.eu-west-1.compute.amazonaws.com Software awselb/2.0 / Resource Hash fcdfa4a872d48f838cf44bce85bea987bc7268d1a8ee5306e1d41afae6a8af35 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-origin * date Tue, 08 Nov 2022 23:02:52 GMT cache-control no-store server awselb/2.0 content-length 29 content-type text/plain
GET H2	200	button-right-arrow-white.svg redcanary.com/wp-content/themes/redcanary/assets/img/	350 B 539 B	245ms 244ms	Image image/svg+xml	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg Requested by Host: redcanary.com URL: https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / Resource Hash 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/wp-content/cache/autoptimize/css/autoptimize_e6e2b0969bcaef3b768450b837b3122c.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:52 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000 last-modified Wed, 27 Feb 2019 15:51:05 GMT server nginx etag W/"5c76b1e9-15e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000
GET H2	200	XDFrame Show response resource.redcanary.com/index.php/form/ Frame 2416	2 KB 761 B	202ms 201ms	Document text/html	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/index.php/form/XDFrame Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b12ee272c79786bc266207f27c98ed219d2090d0d605e9c7a9e71f2add176fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=3600 cf-cache-status DYNAMIC cf-ray 7671f054a8315c85-FRA content-encoding gzip content-type text/html; charset=utf-8 date Tue, 08 Nov 2022 23:02:53 GMT server cloudflare vary Accept-Encoding x-content-type-options nosniff
POST H2	200	admin-ajax.php Show response redcanary.com/wp-admin/	0 593 B	984ms 983ms	XHR text/html	104.198.136.223 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://redcanary.com/wp-admin/admin-ajax.php Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.198.136.223 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 223.136.198.104.bc.googleusercontent.com Software nginx / WP Engine Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000 X-Content-Type-Options nosniff, nosniff X-Frame-Options SAMEORIGIN, deny X-Xss-Protection 1; mode=block Request headers Accept */* Referer https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ X-Requested-With XMLHttpRequest accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Tue, 08 Nov 2022 23:02:53 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff, nosniff strict-transport-security max-age=63072000 x-permitted-cross-domain-policies master-only x-powered-by WP Engine content-length 0 x-xss-protection 1; mode=block referrer-policy strict-origin-when-cross-origin, strict-origin-when-cross-origin server nginx vary X-NR-SAMPLE-PERCENT x-frame-options SAMEORIGIN, deny content-type text/html; charset=UTF-8 access-control-allow-origin https://redcanary.com cache-control no-cache, must-revalidate, max-age=0, no-store access-control-allow-credentials true feature-policy microphone 'none'; geolocation 'none' x-robots-tag noindex expires Wed, 11 Jan 1984 05:00:00 GMT
GET H/1.1	200 OK	tweet.495a42551da1e5c4c5171224e18a5a07.js Show response platform.twitter.com/js/	7 KB 3 KB	20ms 20ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/js/tweet.495a42551da1e5c4c5171224e18a5a07.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6795) / Resource Hash 251feee5dacd7cd6acb23ff9f266b3a4a5407369b24a56b97dc041ccf918adc6 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:52 GMT Content-Encoding gzip Age 520923 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1 Content-Length 2619 Last-Modified Wed, 02 Nov 2022 19:36:52 GMT Server ECS (frb/6795) Etag "090b14bdcf073940eb641311b50eb08d+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	Tweet.html Show response platform.twitter.com/embed/ Frame 00D1	345 B 920 B	19ms 19ms	Document text/html	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6723) / Resource Hash cf56fd75d5f405fba1fcc9c05b4ef79e8302b89b0713df0ee04a94101438682b Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 130 Cache-Control public, max-age=1800 Content-Length 345 Content-Type text/html; charset=utf-8 Date Tue, 08 Nov 2022 23:02:52 GMT Etag "d5091670b69b1b059fef0bd7d29c6ea2" Last-Modified Wed, 02 Nov 2022 22:16:39 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (frb/6723) Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 X-Cache HIT x-amzn-internal-status 304 x-tw-cdn VZ
GET BLOB	200 OK	46a566a4-684d-4514-bc3b-b5cadc55049f https://redcanary.com/	260 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://redcanary.com/46a566a4-684d-4514-bc3b-b5cadc55049f Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash b7626f1796c3a4c3caf10457fdfbed67866a0e7f2bbbb96cbc2f4eebb789a8dd Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Content-Length 260 Content-Type text/javascript
GET H/1.1	200 OK	embed.runtime.485c27f9e5e27d54d810.js Show response platform.twitter.com/embed/ Frame 00D1	9 KB 5 KB	20ms 19ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67E0) / Resource Hash 071087359b845d56806fca70c2b49b0b095dba96a7b0d69f6c68dd11cc987d72 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520923 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1 Content-Length 4194 Last-Modified Wed, 02 Nov 2022 22:16:38 GMT Server ECS (frb/67E0) Etag "ad6866429f67a17b67a1a2c2074558da+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	embed.7796.9998e0c1f229690b022c.js Show response platform.twitter.com/embed/ Frame 00D1	537 KB 174 KB	40ms 19ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.7796.9998e0c1f229690b022c.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6713) / Resource Hash 99d9e1fcf64e5dd3fa0ad7d443dd7b0aafd4ac0272b976462483a67dda181c89 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520924 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 177569 Last-Modified Wed, 02 Nov 2022 22:16:38 GMT Server ECS (frb/6713) Etag "91d4ffc30ea3fdac95031ed78df9342d+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	embed.Tweet.9322608e67b7ed28d6a5.js Show response platform.twitter.com/embed/ Frame 00D1	18 KB 7 KB	71ms 18ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.Tweet.9322608e67b7ed28d6a5.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6772) / Resource Hash 08ff36db5cfc952e7a10ec2b66266c32b160ade4121358b4b127473a537c0e72 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520924 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 6810 Last-Modified Wed, 02 Nov 2022 22:16:38 GMT Server ECS (frb/6772) Etag "3e76826422814815e69455c94a8a55ee+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
POST H3	200	/ Show response www.facebook.com/tr/ Frame 25A7	0 18 B	40ms 19ms	Document text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://redcanary.com Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://redcanary.com alt-svc h3=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Tue, 08 Nov 2022 23:02:53 GMT priority u=0 server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H/1.1	200 OK	embed.749.467388cca0b3fe9c3291.js Show response platform.twitter.com/embed/ Frame 00D1	19 KB 7 KB	19ms 18ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.749.467388cca0b3fe9c3291.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67F2) / Resource Hash afe2c4d44f6a91b4d2ecbaf61d91e90f61cf159467b4a3fac9e51ed9b1e2920d Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520924 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 6789 Last-Modified Wed, 02 Nov 2022 22:16:39 GMT Server ECS (frb/67F2) Etag "d3483b9c737e990765e6ba56d01154a3+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	embed.ondemand.i18n.en-js.ea32e1258edb3fea6260.js Show response platform.twitter.com/embed/ Frame 00D1	4 KB 2 KB	20ms 19ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.ondemand.i18n.en-js.ea32e1258edb3fea6260.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6724) / Resource Hash d1c0a4cad147f203a808aac602d7206b03cd903c025c887f53042f09b87c2f80 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520924 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 1519 Last-Modified Wed, 02 Nov 2022 22:16:38 GMT Server ECS (frb/6724) Etag "9b4625539e420d3aa9e7164c41134250+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	embed.ondemand.horizon-web.i18n.en-js.280e583b60141e6974ff.js Show response platform.twitter.com/embed/ Frame 00D1	36 KB 12 KB	20ms 20ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.ondemand.horizon-web.i18n.en-js.280e583b60141e6974ff.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/668C) / Resource Hash be14f9fbd4d1cf53e45577613f25071c17cd66a5c14c9b6ab5f08d067e9ce36b Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520922 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 11370 Last-Modified Wed, 02 Nov 2022 22:16:39 GMT Server ECS (frb/668C) Etag "7e00685696fb67fc183a52902e1e0152+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H2	200	forms2.min.js Show response resource.redcanary.com/js/forms2/js/ Frame 2416	208 KB 69 KB	33ms 32ms	Script application/x-javascript	104.17.71.206 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://resource.redcanary.com/js/forms2/js/forms2.min.js Requested by Host: resource.redcanary.com URL: https://resource.redcanary.com/index.php/form/XDFrame Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.71.206 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0694124dd8cf871b521cf06ce0b2419ebbe18d3f45658b50c4b038b647fbc849 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://resource.redcanary.com/index.php/form/XDFrame User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:53 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Tue, 04 Oct 2022 18:03:49 GMT server cloudflare age 2799 etag "2d4002b-33e51-5ea394834ab40" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 cf-ray 7671f0565a8f5c85-FRA expires Wed, 09 Nov 2022 03:02:53 GMT
GET H/1.1	200 OK	messenger Show response app.qualified.com/w/1/bAEbi2aHVysBKzuy/ Frame D14E	5 KB 2 KB	797ms 128ms	Document text/html	54.85.120.177 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Requested by Host: js.qualified.com URL: https://js.qualified.com/qualified.js?token=bAEbi2aHVysBKzuy Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 54.85.120.177 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-85-120-177.compute-1.amazonaws.com Software nginx / Resource Hash 7cef4f3bcc990c897fa7858927b4e335a68e6eadbc1df42cf8339a44769417ba Security Headers Name Value Content-Security-Policy Strict-Transport-Security max-age=63072000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://redcanary.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control max-age=0, private, must-revalidate Content-Encoding gzip Content-Length 1675 Content-Security-Policy Content-Type text/html; charset=utf-8 Date Tue, 08 Nov 2022 23:02:53 GMT Etag W/"7cef4f3bcc990c897fa7858927b4e335" Link <https://assets.qualified.com/packs/css/6-a58ace62.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-98566b26.chunk.css>; rel=preload; as=style; nopush Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=63072000; includeSubDomains Vary Accept-Encoding Via 1.1 spaces-router (e13668ca8eb7) X-Content-Type-Options nosniff X-Download-Options noopen X-Permitted-Cross-Domain-Policies none X-Request-Id 1e602ab0-0b54-bee1-9f87-9a277827ac74 X-Runtime 0.021070 X-Xss-Protection 1; mode=block
GET H/1.1	200 OK	embed.8734.99512c4cbfe74f88ce1b.js Show response platform.twitter.com/embed/ Frame 00D1	218 KB 67 KB	20ms 19ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.8734.99512c4cbfe74f88ce1b.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/674C) / Resource Hash 556f28efe495b17574cb3c7a36dddcec82956d74b532119cf2e0eaf51361e0cf Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520923 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 68244 Last-Modified Wed, 02 Nov 2022 22:16:39 GMT Server ECS (frb/674C) Etag "9f88284fca343c40329bd4316da52c58+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H/1.1	200 OK	embed.ondemand.Tweet.729f47795b687a372bb8.js Show response platform.twitter.com/embed/ Frame 00D1	80 KB 19 KB	20ms 20ms	Script application/javascript	2606:2800:234:59:254c:406:2366:268c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/embed/embed.ondemand.Tweet.729f47795b687a372bb8.js Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.runtime.485c27f9e5e27d54d810.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C0) / Resource Hash 1f1c7c3e4898ad34e94dce4f061d61e853a040acc68fe495bb4f1df010031dd6 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/embed/Tweet.html?creatorScreenName=redcanary&dnt=true&embedId=twitter-widget-0&features=eyJ0ZndfdGltZWxpbmVfbGlzdCI6eyJidWNrZXQiOlsibGlua3RyLmVlIiwidHIuZWUiLCJ0ZXJyYS5jb20uYnIiLCJ3d3cubGlua3RyLmVlIiwid3d3LnRyLmVlIiwid3d3LnRlcnJhLmNvbS5iciJdLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2hvcml6b25fdGltZWxpbmVfMTIwMzQiOnsiYnVja2V0IjoidHJlYXRtZW50IiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9lZGl0X2JhY2tlbmQiOnsiYnVja2V0Ijoib24iLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X3JlZnNyY19zZXNzaW9uIjp7ImJ1Y2tldCI6Im9uIiwidmVyc2lvbiI6bnVsbH0sInRmd19jaGluX3BpbGxzXzE0NzQxIjp7ImJ1Y2tldCI6ImNvbG9yX2ljb25zIiwidmVyc2lvbiI6bnVsbH0sInRmd190d2VldF9yZXN1bHRfbWlncmF0aW9uXzEzOTc5Ijp7ImJ1Y2tldCI6InR3ZWV0X3Jlc3VsdCIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2Vuc2l0aXZlX21lZGlhX2ludGVyc3RpdGlhbF8xMzk2MyI6eyJidWNrZXQiOiJpbnRlcnN0aXRpYWwiLCJ2ZXJzaW9uIjpudWxsfSwidGZ3X2V4cGVyaW1lbnRzX2Nvb2tpZV9leHBpcmF0aW9uIjp7ImJ1Y2tldCI6MTIwOTYwMCwidmVyc2lvbiI6bnVsbH0sInRmd19kdXBsaWNhdGVfc2NyaWJlc190b19zZXR0aW5ncyI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdmlkZW9faGxzX2R5bmFtaWNfbWFuaWZlc3RzXzE1MDgyIjp7ImJ1Y2tldCI6InRydWVfYml0cmF0ZSIsInZlcnNpb24iOm51bGx9LCJ0Zndfc2hvd19ibHVlX3ZlcmlmaWVkX2JhZGdlIjp7ImJ1Y2tldCI6Im9mZiIsInZlcnNpb24iOm51bGx9LCJ0ZndfdHdlZXRfZWRpdF9mcm9udGVuZCI6eyJidWNrZXQiOiJvbiIsInZlcnNpb24iOm51bGx9fQ%3D%3D&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&sessionId=8a3324bcdcb2e748896fe02835a300b0ef7d3a9b&siteScreenName=redcanary&theme=light&widgetsVersion=a3525f077c700%3A1667415560940&width=500px User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:53 GMT Content-Encoding gzip Age 520922 X-Cache HIT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server-Timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 Content-Length 18399 Last-Modified Wed, 02 Nov 2022 22:16:39 GMT Server ECS (frb/67C0) Etag "f746145cf62856ee8c49dce22284232f+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * x-tw-cdn VZ Cache-Control public, max-age=315360000
GET H2	200	tweet-result Show response cdn.syndication.twimg.com/ Frame 00D1	3 KB 2 KB	772ms 182ms	XHR application/json	2606:2800:134:1a0d:1429:742:782:b6 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.syndication.twimg.com/tweet-result?features=tfw_timeline_list%3Alinktr.ee%2Ctr.ee%2Cterra.com.br%2Cwww.linktr.ee%2Cwww.tr.ee%2Cwww.terra.com.br%3Btfw_horizon_timeline_12034%3Atreatment%3Btfw_tweet_edit_backend%3Aon%3Btfw_refsrc_session%3Aon%3Btfw_chin_pills_14741%3Acolor_icons%3Btfw_tweet_result_migration_13979%3Atweet_result%3Btfw_sensitive_media_interstitial_13963%3Ainterstitial%3Btfw_experiments_cookie_expiration%3A1209600%3Btfw_duplicate_scribes_to_settings%3Aon%3Btfw_video_hls_dynamic_manifests_15082%3Atrue_bitrate%3Btfw_show_blue_verified_badge%3Aoff%3Btfw_tweet_edit_frontend%3Aon&id=1080570556620124160&lang=en Requested by Host: platform.twitter.com URL: https://platform.twitter.com/embed/embed.7796.9998e0c1f229690b022c.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software tsa_f / Express Resource Hash 1c7f18ab041f0497264a073257fbea2a3a65ac4b2623eba89809bcf2bdbb49c9 Security Headers Name Value Content-Security-Policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers content-security-policy connect-src 'self'; default-src 'self'; frame-src 'self'; font-src 'self'; form-action 'self'; img-src 'self'; media-src 'self'; object-src 'none'; script-src 'self'; style-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5RXE%3D%3D%3D&ro=false content-encoding gzip x-content-type-options nosniff date Tue, 08 Nov 2022 23:02:53 GMT strict-transport-security max-age=631138519 x-powered-by Express server-timing x-cache;desc= ,x-tw-cdn;desc=VZ,edge;dur=163 x-xss-protection 0 x-response-time 149 server tsa_f etag W/"aea-HBzL5xBjaBBO9U30hhGt4/22OxU" vary Origin, Accept-Encoding access-control-allow-methods GET content-type application/json; charset=utf-8 access-control-allow-origin https://platform.twitter.com x-transaction-id 037a4c6c4eff66c5 cache-control must-revalidate, max-age=60 access-control-allow-credentials true perf 7626143928 x-connection-hash c1415e8e6d82a6daa22d8b0a1f9e688a3c03554cdc2d94d335d35fadacb18ee8 x-frame-options SAMEORIGIN x-tw-cdn VZ, VZ access-contol-allow-origin platform.twitter.com
GET H2	200	6-a58ace62.chunk.css assets.qualified.com/packs/css/ Frame D14E	35 KB 7 KB	62ms 52ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/6-a58ace62.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a07ba6298a82984a8c4fe8b19c118b16c7fdeb8e60519738e6c91e02f496fc6 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id hCcjQQiSsrpBIdMch6ZvArn_XtNYNj6H content-encoding gzip cf-cache-status HIT last-modified Tue, 08 Nov 2022 18:39:39 GMT server cloudflare x-amz-request-id MZ5T3BE8AQZW0WS5 age 1263 etag W/"02e82a000181a6edf9321b244dc6ce82" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7671f05b7cae995d-FRA x-amz-id-2 lEYo3NH2z0dm8tdrjHBIn3XvXHyiDYKrU7TaVNm+VRrXIA3Jihfa5jh4r/p1EF4eD2Px9UVeZbw= expires Wed, 09 Nov 2022 03:02:54 GMT
GET H2	200	messenger-98566b26.chunk.css assets.qualified.com/packs/css/widget/sandboxed/ Frame D14E	5 KB 1 KB	50ms 40ms	Stylesheet text/css	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/css/widget/sandboxed/messenger-98566b26.chunk.css Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6ec35ab99388f6afab345622a22772619b83b7d63705d98df3c404da782fcabb Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id xC1sqzJUwa7MAob0.O62dZo8Fike._4F content-encoding gzip cf-cache-status HIT last-modified Tue, 08 Nov 2022 18:39:39 GMT server cloudflare x-amz-request-id MZ5VNZC4YG2SGY76 age 1263 etag W/"22d5f23e695250d3c5a5b1e76a015c5e" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 cf-ray 7671f05b7cac995d-FRA x-amz-id-2 coSGXEU8Yw64mrx3jbnA9Yc6MmiqiLRp83UoQbXx5q4qkXCF7vfPWWWKiXDbpmZuoV5Hak8z+TI= expires Wed, 09 Nov 2022 03:02:54 GMT
GET H2	200	messenger~runtime-7fcb8205ed8226fccaa3.js Show response assets.qualified.com/packs/js/widget/sandboxed/ Frame D14E	2 KB 1 KB	45ms 43ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-7fcb8205ed8226fccaa3.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9a1ba8ea5041d0f98ffe6c3406773ce140b173797976b09dcf72aaaf31ead9c Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id 0WzxM2nHZr7nJde29pipByCRH0H8aKbu content-encoding gzip cf-cache-status HIT last-modified Mon, 07 Nov 2022 22:18:42 GMT server cloudflare x-amz-request-id WXSKEW76AMK53F8F age 1996 etag W/"86a2cd1fe39b1ac3ecd60d9af90f523e" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7671f05b7cb2995d-FRA x-amz-id-2 tev24tc+ecQC1GmWQCTorsuvKuUOknP6LwXdWtti1+B9zSpjMI4XzlxSgaxFiiWNdcxml18ho5s= expires Wed, 09 Nov 2022 03:02:54 GMT
GET H2	200	6-eaae7bcf3adfa3c0f675.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/ Frame D14E	1 MB 409 KB	50ms 48ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/6-eaae7bcf3adfa3c0f675.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 486cb78abbf2d226ff1b7b363f3e96034a3d668686ef4a968b70e07acbb34ae6 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id 7mmzszJKh6KS6XGvoQKIK2Hgab9dJG5c content-encoding gzip cf-cache-status HIT last-modified Mon, 07 Nov 2022 22:18:42 GMT server cloudflare x-amz-request-id WXSHN3NPX76NSG6X age 2097 etag W/"4857a8bc5ea58d74ac7eaa44cbaf776a" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7671f05b7cb1995d-FRA x-amz-id-2 CUuZdNDHKMBLWFZ1uWE2h67crpLQKlcLVF81ntlvpJSfyoINj4uWRfKK0+fLn6zt7L9CPRM6ElE= expires Wed, 09 Nov 2022 03:02:54 GMT
GET H2	200	messenger-b56e4c985286d2e75af6.chunk.js Show response assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame D14E	647 KB 151 KB	57ms 56ms	Script application/javascript	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-b56e4c985286d2e75af6.chunk.js Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b01674a5b46c0e5e862d03e98cdf694b4ac399b63f79786057be0ab0c18decbd Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id CfwHtuG5Vm5VqIhQOLC7Fr6OVGjH4My7 content-encoding gzip cf-cache-status HIT last-modified Mon, 07 Nov 2022 22:18:42 GMT server cloudflare x-amz-request-id 2BDWNQWTK7FSDRJV age 2097 etag W/"ab59855f27f321430a00b87ebae741b3" vary Accept-Encoding content-type application/javascript cache-control public, max-age=14400 cf-ray 7671f05bbd0e995d-FRA x-amz-id-2 CK+JlFp0xRklRnG0SqZIWWQx4olu73425x2tRhWu065ITM1BjGb9lcjj9dmJE+BTqS9518WHmiw= expires Wed, 09 Nov 2022 03:02:54 GMT
GET H2	200	Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame D14E	97 KB 97 KB	73ms 25ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-c8ba52b05a9ef10f47584d08ece2ec5c.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d612f1212b452af07f1a5defb2b672e76a91f7139e7499fa48bb9b2b985c22d6 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id .XKosrKvaIbSC3QrNAexxw0a3kgaC8fP cf-cache-status HIT x-amz-request-id G58K1A7RDZWKJYAK age 4315399 content-length 98868 x-amz-id-2 8673LPEd3IXgFynrZtYHDnGOxk7IMgNqymHeX2A8MAwzJt5L+F1hlfaoZayuSVlMHgXk6Fdx6gs= last-modified Tue, 20 Sep 2022 00:17:43 GMT server cloudflare etag "dc131113894217b5031000575d9de002" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7671f05bbc8b693d-FRA expires Thu, 09 Nov 2023 05:02:54 GMT
GET H2	200	Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 assets.qualified.com/packs/media/fonts/inter/ Frame D14E	103 KB 104 KB	95ms 47ms	Font font/woff2	2606:4700::6812:1105 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-b5f0f109bc88052d4000c58ca615671d.woff2 Requested by Host: app.qualified.com URL: https://app.qualified.com/w/1/bAEbi2aHVysBKzuy/messenger?uuid=50004369-1420-42dd-a9a5-d4dca7fb2022 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1105 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 152261291c938aa5aad6a56d52b47ffcb893d1c0387e76d7f270a7382ff786d5 Request headers Referer https://app.qualified.com/ Origin https://app.qualified.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-amz-version-id nJnuwm4azXwKcjC6X9Kp5fi_4AKiM930 cf-cache-status HIT x-amz-request-id G58QESBR92JK6MK4 age 4315399 content-length 105804 x-amz-id-2 96kcUE/dRLviwfhegAxw8L24AhbvCXDBi/pO/RvKeUg/mt//a/c+nDz92oLkrPcFvLclZpFxkfk= last-modified Tue, 20 Sep 2022 00:17:43 GMT server cloudflare etag "007ad31a53f4ab3f58ee74f2308482ce" access-control-max-age 3600 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control public, max-age=31557600 accept-ranges bytes cf-ray 7671f05bbc8c693d-FRA expires Thu, 09 Nov 2023 05:02:54 GMT
GET H2	200	embeds syndication.twitter.com/i/jot/ Frame 00D1	43 B 150 B	133ms 132ms	Image image/gif	104.244.42.8 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1667948574085%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22results%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22rufous-eol%22%2C%22client_version%22%3A%22a3525f077c700%3A1667415560940%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22redcanary%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22redcanary%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ced6f3ad5aeac%3A1667415540863%22%2C%22item_ids%22%3A%5B%221080570556620124160%22%5D%2C%22item_details%22%3A%7B%221080570556620124160%22%3A%7B%22item_type%22%3A0%7D%7D%7D&dnt=1 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.8 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-response-time 114 date Tue, 08 Nov 2022 23:02:53 GMT strict-transport-security max-age=631138519 last-modified Tue, 08 Nov 2022 23:02:54 GMT server tsa_o vary Origin content-type image/gif x-transaction-id fa0b7fe6d9480701 cache-control must-revalidate, max-age=600 perf 7626143928 x-connection-hash ef4af5b10e08de121373a30e6302a4038ffe755e2c1a270a091d3e16f3bd045b content-length 43
GET H2	200	Hy0NY3gv_normal.jpg pbs.twimg.com/profile_images/665837116778123264/ Frame 00D1	2 KB 2 KB	20ms 19ms	Image image/jpeg	2606:2800:134:1a0d:1429:742:782:b6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://pbs.twimg.com/profile_images/665837116778123264/Hy0NY3gv_normal.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6760) / Resource Hash d58a0a3b652774af1de7b5769dbe4c544d9d1727ffa298a10324e2aa0d60eb75 Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT strict-transport-security max-age=631138519 x-content-type-options nosniff age 161459 x-cache HIT server-timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=1 content-length 1959 x-response-time 109 surrogate-key profile_images profile_images/bucket/7 profile_images/665837116778123264 last-modified Sun, 15 Nov 2015 10:19:53 GMT server ECS (frb/6760) x-tw-cdn VZ, VZ content-type image/jpeg access-control-allow-origin * x-transaction-id d7a50be95cb30dbe access-control-expose-headers Content-Length cache-control max-age=604800, must-revalidate perf 7626143928 x-connection-hash 8e05770fbe33c0f6ff1d90bb8dda16317938a1a3d50788d87c92877e53538959 accept-ranges bytes timing-allow-origin https://twitter.com, https://mobile.twitter.com
GET H2	200	QmhaLtY7_normal.jpg pbs.twimg.com/profile_images/1008441625251545091/ Frame 00D1	2 KB 2 KB	21ms 21ms	Image image/jpeg	2606:2800:134:1a0d:1429:742:782:b6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://pbs.twimg.com/profile_images/1008441625251545091/QmhaLtY7_normal.jpg Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67E0) / Resource Hash 2ae09643cca3634520aa2b5820ca0b87a2ff890c2986228f63fe7695b04e21e2 Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT strict-transport-security max-age=631138519 x-content-type-options nosniff age 231841 x-cache HIT server-timing x-cache;desc= HIT,x-tw-cdn;desc=VZ,edge;dur=2 content-length 2187 x-response-time 115 surrogate-key profile_images profile_images/bucket/3 profile_images/1008441625251545091 last-modified Sun, 17 Jun 2018 20:07:54 GMT server ECS (frb/67E0) x-tw-cdn VZ, VZ content-type image/jpeg access-control-allow-origin * x-transaction-id f528e3bed8f266d9 access-control-expose-headers Content-Length cache-control max-age=604800, must-revalidate perf 7626143928 x-connection-hash 4b772c56d4da839bad85070be923cea32d090f3098a94800bc388ff5ab08923f accept-ranges bytes timing-allow-origin https://twitter.com, https://mobile.twitter.com
GET H2	200	Dv71KcwW0AAM7ZI pbs.twimg.com/media/ Frame 00D1	14 KB 14 KB	317ms 317ms	Image image/jpeg	2606:2800:134:1a0d:1429:742:782:b6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://pbs.twimg.com/media/Dv71KcwW0AAM7ZI?format=jpg&name=240x240 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6738) / Resource Hash 7b9ec0f745e41fb5a3cfca839abbe262c08c56733acb299ac9dfac133967420b Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT strict-transport-security max-age=631138519 x-content-type-options nosniff age 0 x-cache MISS server-timing x-cache;desc= MISS,x-tw-cdn;desc=VZ,edge;dur=299 content-length 13846 x-response-time 264 surrogate-key media media/bucket/7 media/1080570520482009088 last-modified Wed, 02 Jan 2019 21:02:22 GMT server ECS (frb/6738) x-tw-cdn VZ, VZ content-type image/jpeg access-control-allow-origin * x-transaction-id bf2620e35cf1ec65 access-control-expose-headers Content-Length cache-control max-age=604800, must-revalidate perf 7626143928 x-connection-hash 828b0b1ce7959226e8c6e18d0f0f2ef880cdc1c44b5993b2956c108ddec53668 accept-ranges bytes timing-allow-origin https://twitter.com, https://mobile.twitter.com
GET H2	200	Dv71KcwW0AAM7ZI pbs.twimg.com/media/ Frame 00D1	56 KB 57 KB	31ms 30ms	Image image/jpeg	2606:2800:134:1a0d:1429:742:782:b6 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://pbs.twimg.com/media/Dv71KcwW0AAM7ZI?format=jpg&name=small Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6738) / Resource Hash 89377c8d253c2467c1828fed1c5ab9216623b5d35270c71ecdc6d288d3d52f9f Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT strict-transport-security max-age=631138519 x-content-type-options nosniff age 29482 x-cache MISS server-timing x-cache;desc= ,x-tw-cdn;desc=VZ,edge;dur=12 content-length 57824 x-response-time 357 surrogate-key media media/bucket/7 media/1080570520482009088 last-modified Wed, 02 Jan 2019 21:02:22 GMT server ECS (frb/6738) x-tw-cdn VZ, VZ content-type image/jpeg access-control-allow-origin * x-transaction-id 6e4be92eda3a892c access-control-expose-headers Content-Length cache-control max-age=604800, must-revalidate perf 7626143928 x-connection-hash 50811881df792187d0f0497795495371328e7b0daea175b7999b4a304aa206d1 accept-ranges bytes timing-allow-origin https://twitter.com, https://mobile.twitter.com
POST H/1.1	200 OK	/ Show response sentry.io/api/1332833/envelope/ Frame D14E	2 B 407 B	519ms 128ms	Fetch application/json	35.188.42.15 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1 Requested by Host: assets.qualified.com URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/6-eaae7bcf3adfa3c0f675.chunk.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 35.188.42.15 Council Bluffs, United States, ASN15169 (GOOGLE, US), Reverse DNS 15.42.188.35.bc.googleusercontent.com Software nginx / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer https://app.qualified.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Tue, 08 Nov 2022 23:02:54 GMT Strict-Transport-Security max-age=31536000; includeSubDomains; preload Server nginx vary Origin Content-Type application/json access-control-allow-origin https://app.qualified.com access-control-expose-headers retry-after, x-sentry-error, x-sentry-rate-limits x-envoy-upstream-service-time 1 Connection keep-alive Content-Length 2
GET H2	200	/ Show response c.6sc.co/	7 B 200 B	22ms 21ms	XHR text/html	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT access-control-max-age 86400 access-control-allow-methods GET,POST content-type text/html access-control-allow-origin https://redcanary.com access-control-allow-credentials true access-control-allow-headers * content-length 7
GET H2	200	/ Show response ipv6.6sc.co/	36 B 280 B	21ms 20ms	XHR text/html	2a02:26f0:1700:18c::1c91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:1700:18c::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 68f15b518df520f9c378bbfc39d4683fdd6dc1ba5085a98b9c72c2b3e2e8a1ac Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:54 GMT vary Origin content-type text/html access-control-allow-origin https://redcanary.com cache-control max-age=0, no-cache, no-store 6si-ipv6 2001:1b60:1010:3:1011:1fbb:28ba:8ffd server-timing cdn-cache; desc=HIT, edge; dur=1 content-length 36 expires Tue, 08 Nov 2022 23:02:54 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	257ms 257ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ce5c529d-06c3-4d6c-8298-f75a6299b404&session=20f3873c-e29f-4bda-8765-da5c437cf927&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A51%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&pageViewId=9507e8fb-6e6d-4003-8af9-c4f05b653c97&an_uid=7644109609258451639 Requested by Host: redcanary.com URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	optimize.js Show response www.google-analytics.com/gtm/	129 KB 47 KB	78ms 32ms	Script application/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/optimize.js?id=GTM-KJTKFT3 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fe02e17004a05c3c1ce19277d4f70414fec141e7f810c98db6dfc5668f961bd6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 47974 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Tue, 08 Nov 2022 23:02:54 GMT
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 494 B	258ms 258ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ce5c529d-06c3-4d6c-8298-f75a6299b404&session=20f3873c-e29f-4bda-8765-da5c437cf927&event=ipv6&q=%7B%22address%22%3A%222001%3A1b60%3A1010%3A3%3A1011%3A1fbb%3A28ba%3A8ffd%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&pageViewId=9507e8fb-6e6d-4003-8af9-c4f05b653c97&an_uid=7644109609258451639 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu) etag "60bb2e15-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	embeds syndication.twitter.com/i/jot/ Frame 00D1	43 B 96 B	127ms 127ms	Image image/gif	104.244.42.8 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://syndication.twitter.com/i/jot/embeds?l=%7B%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1667948574328%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22tweet%22%2C%22action%22%3A%22FCP%22%2C%22component%22%3A%22performance%22%2C%22section%22%3A%22main%22%7D%2C%22context%22%3A%22rufous-eol%22%2C%22client_version%22%3A%22a3525f077c700%3A1667415560940%22%2C%22dnt%22%3Atrue%2C%22widget_id%22%3A%22twitter-widget-0%22%2C%22widget_origin%22%3A%22https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F%22%2C%22widget_frame%22%3A%22false%22%2C%22widget_partner%22%3A%22%22%2C%22widget_site_screen_name%22%3A%22redcanary%22%2C%22widget_site_user_id%22%3A%22%22%2C%22widget_creator_screen_name%22%3A%22redcanary%22%2C%22widget_creator_user_id%22%3A%22%22%2C%22widget_iframe_version%22%3A%22ced6f3ad5aeac%3A1667415540863%22%2C%22item_ids%22%3A%5B%221080570556620124160%22%5D%2C%22item_details%22%3A%7B%221080570556620124160%22%3A%7B%22item_type%22%3A0%7D%7D%2C%22duration_ms%22%3A1351.0999999046326%7D&dnt=1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.8 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://platform.twitter.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers x-response-time 108 date Tue, 08 Nov 2022 23:02:53 GMT strict-transport-security max-age=631138519 last-modified Tue, 08 Nov 2022 23:02:54 GMT server tsa_o vary Origin content-type image/gif x-transaction-id e89e93dcb9bbd1c1 cache-control must-revalidate, max-age=600 perf 7626143928 x-connection-hash ef4af5b10e08de121373a30e6302a4038ffe755e2c1a270a091d3e16f3bd045b content-length 43
GET H3	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	57ms 18ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Tue, 08 Nov 2022 21:15:54 GMT last-modified Tue, 27 Sep 2022 22:01:05 GMT server Golfe2 age 6420 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20039 expires Tue, 08 Nov 2022 23:15:54 GMT
GET H2	200	details Show response epsilon.6sense.com/v3/company/	574 B 473 B	63ms 23ms	XHR application/json	52.59.125.199 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.59.125.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-59-125-199.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash d61a7de6fc1f8ddd3baaf012c2b03d0c7319d3d21f25251b3c490b1e7894e98e Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 Authorization Token 5056c3929c3198270386ced81b434006bcef81be User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:54 GMT content-encoding gzip server nginx vary Accept-Encoding content-type application/json access-control-allow-origin https://redcanary.com access-control-allow-credentials true content-length 290
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	74ms 23ms	Preflight	52.59.125.199 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.59.125.199 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-59-125-199.eu-central-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://redcanary.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization access-control-allow-methods OPTIONS,GET access-control-allow-origin https://redcanary.com access-control-max-age 1800 date Tue, 08 Nov 2022 23:02:54 GMT server nginx
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	25ms 25ms	XHR text/plain	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j98&a=1975001050&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&ul=en-us&de=UTF-8&dt=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABQAAAACAAI~&jid=251403852&gjid=1831842449&cid=1190939702.1667948572&tid=UA-52702906-1&_gid=557118325.1667948574&_r=1&gtm=2wgb70PXWC8JW&cd18=null&z=1291759083 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 440 B	83ms 27ms	XHR text/plain	2a00:1450:400c:c02::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j98&tid=UA-52702906-1&cid=1190939702.1667948572&jid=251403852&gjid=1831842449&_gid=557118325.1667948574&_u=YADAAEAAQAAAACAAI~&z=1293913181 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c02::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://redcanary.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://redcanary.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.com/ads/	42 B 63 B	71ms 32ms	Image image/gif	2a00:1450:4001:80f::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-52702906-1&cid=1190939702.1667948572&jid=251403852&_u=YADAAEAAQAAAACAAI~&z=914613805 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	73ms 31ms	Image image/gif	2a00:1450:4001:831::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j98&tid=UA-52702906-1&cid=1190939702.1667948572&jid=251403852&_u=YADAAEAAQAAAACAAI~&z=914613805 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers pragma no-cache date Tue, 08 Nov 2022 23:02:54 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame D14E	13 KB 13 KB	397ms 145ms	Image image/png	52.216.205.182 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/d23c0c4e194430380ef64982f7fd6ecf318cd5881017bc61dec0ef8955cc0079.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.205.182 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 9a586f0b3e8add35ad17a2eec2cee97cbe175f48d7c47e34492dd973aa0f8381 Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:56 GMT Last-Modified Thu, 20 Oct 2022 23:47:27 GMT Server AmazonS3 x-amz-request-id QCV3KDC2AMJS65PT ETag "fd481ec600c1b3fad6f9e29aa732a946" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 12932 x-amz-id-2 Z1gZeKwMzOW1WYF7TEC/vNhwYXl6y+FuSiyc+Fna+gyc9G6taBD4PNcEvi4rYQ+zd+WfY9NBEV8=
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	272ms 272ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ce5c529d-06c3-4d6c-8298-f75a6299b404&session=20f3873c-e29f-4bda-8765-da5c437cf927&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A51%20GMT%22%2C%22timeSpent%22%3A%223371%22%2C%22totalTimeSpent%22%3A%223371%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&pageViewId=9507e8fb-6e6d-4003-8af9-c4f05b653c97&an_uid=7644109609258451639 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:55 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png qualified-production.s3.us-east-1.amazonaws.com/uploads/ Frame D14E	13 KB 13 KB	126ms 126ms	Image image/png	52.216.205.182 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://qualified-production.s3.us-east-1.amazonaws.com/uploads/b34302d7d25df402909dab75f43c994eaa9697d42e982abeee77e1d6cb8e2697.png Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.216.205.182 Ashburn, United States, ASN16509 (AMAZON-02, US), Reverse DNS s3-us-east-1-r-w.amazonaws.com Software AmazonS3 / Resource Hash 00bbc66153e493c73e6ee4448a25fac555d74e1fd957f6f804754ff27bb9884f Request headers accept-language de-DE,de;q=0.9 Referer https://app.qualified.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers Date Tue, 08 Nov 2022 23:02:56 GMT Last-Modified Thu, 20 Oct 2022 23:48:08 GMT Server AmazonS3 x-amz-request-id QCVC97RKGKQSAX8C ETag "7797b96a7f999ac42de528bede3329af" Content-Type image/png Cache-Control Cache-Control: public, max-age=31536000 Accept-Ranges bytes Content-Length 13099 x-amz-id-2 s6oFwlHCjdHquPZiPt99fZssJSk3MowrKEGbn5wXpYIQR1Ykq5M8gjy1OwdAaCcBNtH+EFiY/1E=
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 493 B	257ms 256ms	Image image/gif	184.24.7.242 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ce5c529d-06c3-4d6c-8298-f75a6299b404&session=20f3873c-e29f-4bda-8765-da5c437cf927&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A55%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224372%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&pageViewId=9507e8fb-6e6d-4003-8af9-c4f05b653c97&an_uid=7644109609258451639 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 184.24.7.242 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a184-24-7-242.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://redcanary.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36 Response headers date Tue, 08 Nov 2022 23:02:56 GMT x-content-type-options nosniff content-length 43 pragma no-cache last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu) etag "5e502810-2b" access-control-max-age 86400 access-control-allow-methods GET,POST content-type image/gif access-control-allow-origin cache-control private, no-cache, no-cache=Set-Cookie, proxy-revalidate access-control-allow-credentials true accept-ranges bytes access-control-allow-headers * expires Wed, 19 Apr 2000 11:43:00 GMT
GET		img.gif b.6sc.co/v1/beacon/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

b.6sc.co

URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=null&visitor=ce5c529d-06c3-4d6c-8298-f75a6299b404&session=20f3873c-e29f-4bda-8765-da5c437cf927&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2008%20Nov%202022%2023%3A02%3A56%20GMT%22%2C%22timeSpent%22%3A%221003%22%2C%22totalTimeSpent%22%3A%225375%22%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&pageViewId=9507e8fb-6e6d-4003-8af9-c4f05b653c97&an_uid=7644109609258451639