redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Submission: On October 22 via api (October 22nd 2020, 7:45:18 pm UTC) from US

Summary HTTP 102 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 31 IPs in 6 countries across 26 domains to perform 102 HTTP transactions. The main IP is 104.198.136.223, located in United States and belongs to GOOGLE, US. The main domain is redcanary.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 7th 2020. Valid for: 3 months.

This is the only time redcanary.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
7 37	104.198.136.223 104.198.136.223	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81e::200a	15169 (GOOGLE) (GOOGLE)
5	68.232.35.12 68.232.35.12	15133 (EDGECAST) (EDGECAST)
5	104.16.93.80 104.16.93.80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
2	52.85.32.38 52.85.32.38	16509 (AMAZON-02) (AMAZON-02)
2	104.109.95.62 104.109.95.62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
5	104.111.239.158 104.111.239.158	16625 (AKAMAI-AS) (AKAMAI-AS)
3	104.108.67.47 104.108.67.47	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2	2a02:26f0:10c... 2a02:26f0:10c:582::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	172.217.23.162 172.217.23.162	15169 (GOOGLE) (GOOGLE)
1	185.33.221.87 185.33.221.87	29990 (ASN-APPNEX) (ASN-APPNEX)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
2	52.29.125.201 52.29.125.201	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE)
5	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:803::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
5	192.28.147.37 192.28.147.37	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c04::9b	15169 (GOOGLE) (GOOGLE)
102	31

37 104.198.136.223 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: 223.136.198.104.bc.googleusercontent.com

redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.redcanary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 68.232.35.12 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.16.93.80 (United States)

ASN13335 (CLOUDFLARENET, US)

app-sj28.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.85.32.38 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-32-38.ham50.r.cloudfront.net

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.109.95.62 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-95-62.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.239.158 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-158.deploy.static.akamaitechnologies.com

sjrtp8-cdn.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtp-static.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.108.67.47 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-67-47.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:10c:582::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s22-in-f162.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.221.87 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

003-yru-314.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.29.125.201 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-125-201.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 192.28.147.37 (United States)

ASN15224 (OMNITURE, US)

sjrtp8.marketo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	redcanary.com 7 redirects redcanary.com www.redcanary.com	3 MB
15	marketo.com app-sj28.marketo.com sjrtp8-cdn.marketo.com rtp-static.marketo.com sjrtp8.marketo.com	195 KB
5	facebook.com www.facebook.com	689 B
5	twitter.com platform.twitter.com analytics.twitter.com	32 KB
4	google-analytics.com www.google-analytics.com	72 KB
4	facebook.net connect.facebook.net	165 KB
4	gstatic.com fonts.gstatic.com	52 KB
4	bizible.com cdn.bizible.com	34 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	2 KB
3	6sc.co j.6sc.co c.6sc.co b.6sc.co	8 KB
3	crazyegg.com script.crazyegg.com	35 KB
3	googleapis.com ajax.googleapis.com fonts.googleapis.com	32 KB
2	google.de www.google.de	1 KB
2	google.com www.google.com	759 B
2	doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net	2 KB
2	6sense.com epsilon.6sense.com	284 B
2	licdn.com snap.licdn.com	3 KB
2	marketo.net munchkin.marketo.net	7 KB
2	driftt.com js.driftt.com	45 KB
1	bizibly.com cdn.bizibly.com	202 B
1	mktoresp.com 003-yru-314.mktoresp.com	311 B
1	t.co t.co	448 B
1	adnxs.com secure.adnxs.com	700 B
1	googleadservices.com www.googleadservices.com	12 KB
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	52 KB
102	26

	Domain	Requested by
30	redcanary.com	redcanary.com cdn.bizible.com
7	www.redcanary.com	7 redirects
5	sjrtp8.marketo.com	sjrtp8-cdn.marketo.com cdn.bizible.com
5	www.facebook.com	redcanary.com connect.facebook.net
5	app-sj28.marketo.com	redcanary.com app-sj28.marketo.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com cdn.bizible.com
4	rtp-static.marketo.com	sjrtp8-cdn.marketo.com
4	connect.facebook.net	www.googletagmanager.com connect.facebook.net
4	fonts.gstatic.com	fonts.googleapis.com
4	platform.twitter.com	redcanary.com platform.twitter.com
4	cdn.bizible.com	redcanary.com cdn.bizible.com
3	script.crazyegg.com	redcanary.com script.crazyegg.com
2	www.google.de	redcanary.com
2	www.google.com	redcanary.com
2	epsilon.6sense.com	cdn.bizible.com
2	px.ads.linkedin.com	1 redirects redcanary.com
2	snap.licdn.com	www.googletagmanager.com snap.licdn.com
2	munchkin.marketo.net	redcanary.com munchkin.marketo.net
2	js.driftt.com	redcanary.com js.driftt.com
2	fonts.googleapis.com	redcanary.com
1	stats.g.doubleclick.net	cdn.bizible.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	analytics.twitter.com	static.ads-twitter.com
1	cdn.bizibly.com	redcanary.com
1	www.linkedin.com	1 redirects
1	003-yru-314.mktoresp.com	munchkin.marketo.net
1	b.6sc.co	redcanary.com
1	t.co	redcanary.com
1	secure.adnxs.com	j.6sc.co
1	c.6sc.co	j.6sc.co
1	www.googleadservices.com	www.googletagmanager.com
1	static.ads-twitter.com	www.googletagmanager.com
1	j.6sc.co	redcanary.com
1	sjrtp8-cdn.marketo.com	redcanary.com
1	www.googletagmanager.com	redcanary.com
1	ajax.googleapis.com	redcanary.com
102	36

This site contains links to these domains. Also see Links.

Domain
help.redcanary.com
github.com
twitter.com
www.linkedin.com
www.redcanary.com
attack.mitre.org
blog.malwarebytes.com
www.youtube.com

Subject Issuer	Validity	Valid
redcanary.com Let's Encrypt Authority X3	`2020-10-07` - `2021-01-05`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
io.bizible.com DigiCert SHA2 Secure Server CA	`2020-10-07` - `2021-11-08`	a year	crt.sh
app-sj28.marketo.com Cloudflare Inc ECC CA-3	`2020-07-03` - `2021-07-03`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-06-09` - `2021-06-09`	a year	crt.sh
*.twimg.com DigiCert SHA2 High Assurance Server CA	`2019-11-12` - `2020-11-18`	a year	crt.sh
drift.com Amazon	`2020-09-21` - `2021-10-23`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.marketo.com DigiCert SHA2 Secure Server CA	`2020-03-14` - `2021-04-13`	a year	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2020-01-07` - `2021-04-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2020-08-05` - `2021-02-05`	6 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.6sense.com Amazon	`2020-07-29` - `2021-08-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Frame ID: FEF4075F0F449D16E4D67992D6F04ADF
Requests: 97 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fredcanary.com
Frame ID: F9D36AEA93550067F6F890C116AE0BC3
Requests: 1 HTTP requests in this frame

Frame: https://app-sj28.marketo.com/index.php/form/XDFrame
Frame ID: CD263ABC1A6FEBB3D3AAC5BA472AF47E
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=500px
Frame ID: DA9B050B0EE581F9EEF768277A958E90
Requests: 1 HTTP requests in this frame

Frame: https://js.driftt.com/deploy/assets/index.html
Frame ID: DADD91D598383D64E4523A6D8E2EDE7E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

102
Requests

100 %
HTTPS

53 %
IPv6

26
Domains

36
Subdomains

31
IPs

6
Countries

3832 kB
Transfer

6063 kB
Size

19
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://help.redcanary.com/hc/en-us
Title: Help Center

Search URL Search Domain Scan URL

URL: https://github.com/redcanaryco/cb-response-surveyor
Title: Surveyor

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/&text=In%20this%20article,%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&title=Stopping+Emotet+Before+it+Moves+Laterally&summary=In+this+article%2C+we+examine+how+you+can+detect+adversaries+attempting+to+execute+Emotet+before+it+compromises+your+environment+and+moves+laterally.&source=RedCanary
Title:

Search URL Search Domain Scan URL

URL: https://www.redcanary.com/blog/threat-hunting-psexec-lateral-movement/
Title: lateral movement

Search URL Search Domain Scan URL

URL: https://attack.mitre.org/tactics/TA0008/
Title: tactic

Search URL Search Domain Scan URL

URL: https://www.redcanary.com/lateral-movement/?utm_source=website&utm_medium=blog
Title: an upcoming webinar

Search URL Search Domain Scan URL

URL: https://blog.malwarebytes.com/detections/trojan-emotet/
Title: good analyses of Emotet

Search URL Search Domain Scan URL

URL: https://twitter.com/redcanaryco
Title:

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/redcanary/
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCulDoWwoy0vNvRwl2tVX3-w
Title:

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://www.redcanary.com/wp-content/uploads/Emotet-detection-1.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-1.png

Request Chain 11

https://www.redcanary.com/wp-content/uploads/Emotet-detection-2.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-2.png

Request Chain 12

https://www.redcanary.com/wp-content/uploads/Emotet-detection-3.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-3.png

Request Chain 13

https://www.redcanary.com/wp-content/uploads/Emotet-detection-6.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-6.png

Request Chain 14

https://www.redcanary.com/wp-content/uploads/Emotet-detection-4.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-4.png

Request Chain 15

https://www.redcanary.com/wp-content/uploads/Emotet-detection-5.png HTTP 301
https://redcanary.com/wp-content/uploads/Emotet-detection-5.png

Request Chain 16

https://www.redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg HTTP 301
https://redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg

Request Chain 57

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1603395900697%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog%252Fstopping-emotet-before-it-moves-laterally%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true

102 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
redcanary.com/blog/stopping-emotet-before-it-moves-laterally/ 126 KB
20 KB 447ms
150ms Document
text/html 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

7ce4ca0e02dcd2e5d53782f3a82d8351337a909c13a9d6713e5c29fd2fdd3a97

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

:method: GET
:authority: redcanary.com
:scheme: https
:path: /blog/stopping-emotet-before-it-moves-laterally/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: nginx
date: Thu, 22 Oct 2020 19:44:59 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
content-security-policy: upgrade-insecure-requests
x-pingback: https://redcanary.com/xmlrpc.php
set-cookie: cookielawinfo-checkbox-necessary=yes; expires=Thu, 22-Oct-2020 20:11:09 GMT; Max-Age=3600; path=/; HTTPOnly; Secure cookielawinfo-checkbox-non-necessary=yes; expires=Thu, 22-Oct-2020 20:11:09 GMT; Max-Age=3600; path=/; HTTPOnly; Secure
link: <https://redcanary.com/wp-json/>; rel="https://api.w.org/" <https://redcanary.com/wp-json/wp/v2/posts/13345>; rel="alternate"; type="application/json" <https://redcanary.com/?p=13345>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 1
x-cache-group: normal
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block 1; mode=block
referrer-policy: no-referrer
feature-policy: microphone 'none'; geolocation 'none'
x-permitted-cross-domain-policies: master-only
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br

GET
H2 200 cookie-law-info-public.css
redcanary.com/wp-content/plugins/cookie-law-info/public/css/ 3 KB
1 KB 129ms
127ms Stylesheet
text/css 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-public.css
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:44:59 GMT
content-encoding: br
last-modified: Thu, 22 Oct 2020 05:40:44 GMT
server: nginx
status: 200
etag: W/"5f911b5c-c25"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cookie-law-info-gdpr.css
redcanary.com/wp-content/plugins/cookie-law-info/public/css/ 27 KB
5 KB 142ms
140ms Stylesheet
text/css 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/plugins/cookie-law-info/public/css/cookie-law-info-gdpr.css
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:44:59 GMT
content-encoding: br
last-modified: Thu, 22 Oct 2020 05:40:44 GMT
server: nginx
status: 200
etag: W/"5f911b5c-6cdf"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 master.min.css
redcanary.com/wp-content/themes/redcanary/assets/build/ 545 KB
63 KB 162ms
160ms Stylesheet
text/css 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: ad15377f35d02809231d95a70eb18aeeff5624b39ab1139a1e5249eff7cbd666

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:44:59 GMT
content-encoding: br
last-modified: Wed, 21 Oct 2020 16:02:52 GMT
server: nginx
status: 200
etag: W/"5f905bac-88365"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 18:30:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4495
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30774
x-xss-protection: 0
last-modified: Mon, 13 May 2019 14:37:17 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Oct 2021 18:30:04 GMT

GET
H2 200 cookie-law-info-public.js Show response
redcanary.com/wp-content/plugins/cookie-law-info/public/js/ 33 KB
8 KB 161ms
160ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/plugins/cookie-law-info/public/js/cookie-law-info-public.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: fec6411c0449c2f2b631cdb40900e968c49501f4e92e7b12e75e1e1bc6ed2813

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:44:59 GMT
content-encoding: br
last-modified: Thu, 22 Oct 2020 05:40:44 GMT
server: nginx
status: 200
etag: W/"5f911b5c-8344"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 86 KB
33 KB 71ms
16ms Script
application/x-javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F85) /
Resource Hash: 4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
last-modified: Thu, 15 Oct 2020 16:31:04 GMT
server: ECS (pab/6F85)
age: 17149
etag: "b079809310a3d61:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
accept-ranges: bytes
content-length: 33769

GET
H2 200 forms2.min.js Show response
app-sj28.marketo.com/js/forms2/js/ 205 KB
69 KB 174ms
42ms Script
application/x-javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj28.marketo.com/js/forms2/js/forms2.min.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 7011
status: 200
cf-request-id: 05f370ea6f00000487b0a3e000000001
last-modified: Mon, 12 Oct 2020 17:13:35 GMT
server: cloudflare
etag: "2a00544-33245-5b17c6b21edc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: public, max-age=14400
cf-ray: 5e65b7571f760487-CDG
expires: Thu, 22 Oct 2020 23:45:00 GMT

GET
H2 200 9416.js Show response
script.crazyegg.com/pages/scripts/0096/ 3 KB
2 KB 59ms
39ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 00745dffe700afe5a7c3819448689da4e8fa928e6da90c344517f96278778857

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
cf-cache-status: HIT
ce-version: 11.1.118
age: 13870
cf-polished: origSize=2833
status: 200
cf-request-id: 05f370ebfc0000d6f917915000000001
last-modified: Thu, 22 Oct 2020 15:53:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
cf-ray: 5e65b7599c4dd6f9-FRA
cf-bgj: minify

GET
H2 200 share-email.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 3 KB
2 KB 315ms
310ms Image
image/svg+xml 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/img/share-email.svg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4fe00ebc1aa4fc9a058b88c1b226a3feb16e330fab8af40f4c18de31f26837b5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Wed, 27 Feb 2019 15:51:13 GMT
server: nginx
status: 200
etag: W/"5c76b1f1-ca1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 95 KB
29 KB 34ms
7ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4187) /
Resource Hash: 2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 1181
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Content-Length: 28698
x-tw-cdn: VZ
Last-Modified: Thu, 01 Oct 2020 21:52:09 GMT
Server: ECS (fcn/4187)
Etag: "a671d4d584ef50954e5cebb21da17065+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2

200

Emotet-detection-1.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-1.png
https://redcanary.com/wp-content/uploads/Emotet-detection-1.png

166 KB
166 KB

168ms
167ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-1.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 583a780196ce444aeeda88a30e7b343216e9fe937bb40ece69b673589e902551

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:40 GMT
server: nginx
status: 200
etag: "5c8b2908-29858"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 170072

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-1.png
content-type: text/html

GET
H2

200

Emotet-detection-2.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-2.png
https://redcanary.com/wp-content/uploads/Emotet-detection-2.png

410 KB
411 KB

168ms
168ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-2.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 487673291004a3ed129a617baeafd16774387981024bc286177ebbcdc6ecec72

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:41 GMT
server: nginx
status: 200
etag: "5c8b2909-6690d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 420109

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-2.png
content-type: text/html

GET
H2

200

Emotet-detection-3.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-3.png
https://redcanary.com/wp-content/uploads/Emotet-detection-3.png

374 KB
375 KB

169ms
168ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-3.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9ba815a999a1ca2299c373aad76b849c92ed4fe53650c95a3c16a8a11ed2bae0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:43 GMT
server: nginx
status: 200
etag: "5c8b290b-5d9ce"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 383438

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-3.png
content-type: text/html

GET
H2

200

Emotet-detection-6.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-6.png
https://redcanary.com/wp-content/uploads/Emotet-detection-6.png

209 KB
210 KB

150ms
149ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-6.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7e99351f16a4c1387d31a35e02efd51006255c3750deba6950973461cf33f6a1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:47 GMT
server: nginx
status: 200
etag: "5c8b290f-34517"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 214295

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-6.png
content-type: text/html

GET
H2

200

Emotet-detection-4.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-4.png
https://redcanary.com/wp-content/uploads/Emotet-detection-4.png

130 KB
130 KB

150ms
149ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-4.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 02ce79bb4b5ac1f3eb3dce120788723fe26f77720680d7cd9cdb770485a804d7

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:44 GMT
server: nginx
status: 200
etag: "5c8b290c-20764"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 132964

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-4.png
content-type: text/html

GET
H2

200

Emotet-detection-5.png
redcanary.com/wp-content/uploads/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/Emotet-detection-5.png
https://redcanary.com/wp-content/uploads/Emotet-detection-5.png

182 KB
182 KB

150ms
150ms

Image
image/png

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/Emotet-detection-5.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8cd8d00a6404d6f2b3c365ef5822ac6e13d76ff220ce6346d89f1195b7b8d8f3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 15 Mar 2019 04:24:45 GMT
server: nginx
status: 200
etag: "5c8b290d-2d7e4"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 186340

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/Emotet-detection-5.png
content-type: text/html

GET
H2

200

Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg
redcanary.com/wp-content/uploads/2019/08/
Redirect Chain

https://www.redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg
https://redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg

165 KB
166 KB

150ms
149ms

Image
image/jpeg

104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 53ea7c05e64bb9639d577f772e3b56a89adaa9a102ed1d0ba5e239dd50faca34

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 07 Aug 2019 04:00:52 GMT
server: nginx
status: 200
etag: "5d4a4cf4-294d4"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 169172

Redirect headers

status: 301
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx
content-length: 162
location: https://redcanary.com/wp-content/uploads/2019/08/Deep-Dive-Speakers-On-Demand-Twitter-1200x675.jpg
content-type: text/html

GET
H2 200 comment-reply.min.js Show response
redcanary.com/wp-includes/js/ 3 KB
1 KB 324ms
323ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-includes/js/comment-reply.min.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: d06df4184ba84e09a4be6a6ed101d1c3adefea0eaa833ddecf2f2251f6af33a3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Wed, 23 Sep 2020 13:59:17 GMT
server: nginx
status: 200
etag: W/"5f6b54b5-b2d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 manifest.min.js Show response
redcanary.com/wp-content/themes/redcanary/assets/build/ 800 B
678 B 214ms
213ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/manifest.min.js?id=d64713044d4b02b1808b
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1eb2d178abcddee24e52a57f478b9a89ef9ad0254e570dcfa63d63fa7dd54d83

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Mon, 22 Apr 2019 16:23:11 GMT
server: nginx
status: 200
etag: W/"5cbdea6f-320"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 vendor.min.js Show response
redcanary.com/wp-content/themes/redcanary/assets/build/ 196 KB
61 KB 129ms
123ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/vendor.min.js?id=37aaa38e5cec0c32c7dc
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 51383b257916f54e8916354ef97cd3fe21122ec737ab070d5927f933817b8756

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Mon, 22 Apr 2019 16:23:20 GMT
server: nginx
status: 200
etag: W/"5cbdea78-31102"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 main.min.js Show response
redcanary.com/wp-content/themes/redcanary/assets/build/ 39 KB
12 KB 130ms
124ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/main.min.js?id=83f39cc6f333c3343832
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: e2dfd9f6302bbe189ea1244646b771ed6d3f4a111a8f01532da8543bc95afd2b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Thu, 22 Oct 2020 15:25:34 GMT
server: nginx
status: 200
etag: W/"5f91a46e-9d8c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
redcanary.com/wp-includes/js/ 1 KB
951 B 130ms
125ms Script
application/javascript 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://redcanary.com/wp-includes/js/wp-embed.min.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Sat, 26 Oct 2019 00:17:07 GMT
server: nginx
status: 200
etag: W/"5db39083-59a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 css
fonts.googleapis.com/ 8 KB
855 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e6aa5a045a41477d7cea6e5ff9f3c6e1fe6edd98e4f5cd03ac35b360e0725dd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 19:43:55 GMT
server: ESF
date: Thu, 22 Oct 2020 19:45:00 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Oct 2020 19:45:00 GMT

GET
H2 200 65zait4t5ws7.js Show response
js.driftt.com/include/1603396200000/ 137 KB
45 KB 241ms
153ms Script
application/javascript 52.85.32.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1603396200000/65zait4t5ws7.js

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.32.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-32-38.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 13 Oct 2020 15:05:22 GMT
server: nginx
etag: W/"a48548cec5608126b24de4cbfe9bfb8d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 73bc1d640c0c6e18c08ecc8b7ae0c8d1.cloudfront.net (CloudFront)
cache-control: max-age=10
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XqjFXq2BKL5BxoV9aZe2LOGjrugfU-p-Axpzi01ef1hao9Fp3BqJSQ==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 119ms
53ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Last-Modified: Wed, 05 Aug 2020 03:11:00 GMT
Server: AkamaiNetStorage
ETag: "a67ed8ce0a86706b9f73a86806ce5bd3:1596597060.25158"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7lujVj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 11:20:35 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:14 GMT
server: sffe
age: 116665
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13324
x-xss-protection: 0
expires: Thu, 21 Oct 2021 11:20:35 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 155 KB
52 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4217aeda4eea0c5354e9ed375863b7d7ac381162264bd4a24a18c64a6f278343

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53319
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:45:00 GMT

GET
H/1.1 200
OK rtp.js Show response
sjrtp8-cdn.marketo.com/rtp-api/v1/ 151 KB
42 KB 1063ms
904ms Script
application/x-javascript 104.111.239.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.158 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-239-158.deploy.static.akamaitechnologies.com

Software

Jetty(7.3.1.v20110307) /

Resource Hash

3237c33cfd2483887984745c0125b4cc2fda7f265f79dbdd1eae17d10caea0d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=63113904
Content-Encoding: gzip
Last-Modified: Sat, 17 Oct 2020 00:37:16 GMT
Server: Jetty(7.3.1.v20110307)
Date: Thu, 22 Oct 2020 19:45:01 GMT
Vary: Accept-Encoding
Content-Type: application/x-javascript; charset=UTF-8
Cache-Control: public, max-age=300
Connection: keep-alive
Content-Length: 42242
X-Akamai-Path-Stats: [3:138018:10982],[1:14266:691734]

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 15 KB
7 KB 126ms
36ms Script
application/javascript 104.108.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://j.6sc.co/6si.min.js
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.67.47 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-67-47.deploy.static.akamaitechnologies.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 22:09:24 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5f6d1914-3a6c"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 6116

GET
H2 200 top-banner-animation-exp-1.gif
redcanary.com/wp-content/uploads/2020/09/ 709 KB
710 KB 310ms
310ms Image
image/gif 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2020/09/top-banner-animation-exp-1.gif
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: a1dbc0f2338517af3af73672c44f83f13f99a9c0dc7e9f8b18884f48f724710a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Mon, 28 Sep 2020 15:22:52 GMT
server: nginx
status: 200
etag: "5f71ffcc-b143a"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 726074

GET
H2 200 cta-background.jpg
redcanary.com/wp-content/uploads/2018/12/ 8 KB
8 KB 314ms
314ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2018/12/cta-background.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: d28ffa42ee409fb556cfa1d109df82708bd4b2bb5e13e6318b96b929cd46e6ff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 27 Feb 2019 16:13:07 GMT
server: nginx
status: 200
etag: "5c76b713-1ee8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 7912

GET
H2 200 arrow-slider-next.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 527 B
553 B 313ms
313ms Image
image/svg+xml 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/img/arrow-slider-next.svg
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 929169823afc0c1b96ebabd781fe0211e432d8eb455ab15c8f661c3f6322d597

Request headers

Referer: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Wed, 27 Feb 2019 15:51:01 GMT
server: nginx
status: 200
etag: W/"5c76b1e5-20f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 Threat-Detection-975x975.jpg
redcanary.com/wp-content/uploads/2019/02/ 108 KB
108 KB 313ms
312ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2019/02/Threat-Detection-975x975.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: fc6f67630ef4abd949210c71c665a86810d3eb28d613900326f29f6baa4b1f48

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Tue, 12 Mar 2019 13:40:26 GMT
server: nginx
status: 200
etag: "5c87b6ca-1aed5"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 110293

GET
H2 200 Brian-Donohue.jpg
redcanary.com/wp-content/uploads/2019/02/ 28 KB
28 KB 313ms
313ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2019/02/Brian-Donohue.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9d8559eba8ec6953f79c06df15b1a64e2dc91c12cb2f0200a135ea86ec87e658

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 27 Feb 2019 16:27:02 GMT
server: nginx
status: 200
etag: "5c76ba56-6eaf"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 28335

GET
H3-Q050 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 29ms
15ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 11:20:35 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:11 GMT
server: sffe
age: 116665
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12976
x-xss-protection: 0
expires: Thu, 21 Oct 2021 11:20:35 GMT

GET
H3-Q050 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 27ms
15ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,500,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 11:20:35 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:10:08 GMT
server: sffe
age: 116665
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13224
x-xss-protection: 0
expires: Thu, 21 Oct 2021 11:20:35 GMT

GET
H2 200 getForm Show response
app-sj28.marketo.com/index.php/form/ 3 KB
2 KB 463ms
463ms Script
application/javascript 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj28.marketo.com/index.php/form/getForm?munchkinId=003-YRU-314&form=1034&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&callback=jQuery112406432144726865103_1603395900331&_=1603395900332

Requested by

Host: app-sj28.marketo.com
URL: https://app-sj28.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0bc90721e98f61d677256d016c8b6dabe0b5267aa0ca778b2df5d0e30e6b8608

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
status: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cached: false
strict-transport-security: max-age=63113904
cf-ray: 5e65b759de270487-CDG
cf-request-id: 05f370ec2c00000487dfb27000000001

GET
H2 200 Threat-Detection-2188-500x500-1.jpg
redcanary.com/wp-content/uploads/2020/10/ 36 KB
36 KB 268ms
266ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2020/10/Threat-Detection-2188-500x500-1.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9fe8f8b001d5356b967eebbd61b4344bbde1d5a879cdf541eb0117faca20befe

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 14 Oct 2020 15:35:40 GMT
server: nginx
status: 200
etag: "5f871acc-905e"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 36958

GET
H2 200 BH_10.13.20_500x500.jpg
redcanary.com/wp-content/uploads/2020/10/ 53 KB
53 KB 268ms
266ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2020/10/BH_10.13.20_500x500.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 37a121a2628f705662a9872f9beb83e4d9e4c42b157296a72f04afd55159a222

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Mon, 12 Oct 2020 20:14:53 GMT
server: nginx
status: 200
etag: "5f84b93d-d37d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 54141

GET
H2 200 Nothingtohide_Rootkits_Blog_500x500.jpg
redcanary.com/wp-content/uploads/2020/09/ 24 KB
24 KB 268ms
267ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2020/09/Nothingtohide_Rootkits_Blog_500x500.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 239b66d7e481d8db4b5a59728346c9eb7d98e9366d2caeabd621cc993a16d331

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Tue, 22 Sep 2020 17:19:29 GMT
server: nginx
status: 200
etag: "5f6a3221-5ee4"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 24292

GET
H2 200 Introducing-series-CIRT-500x500-1.jpg
redcanary.com/wp-content/uploads/2019/09/ 35 KB
35 KB 268ms
267ms Image
image/jpeg 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2019/09/Introducing-series-CIRT-500x500-1.jpg
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3de12cebe7337529cd0fcb01f20f10bde90a467e2bc8b40e37e29a34f339af6e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 04 Sep 2019 21:06:32 GMT
server: nginx
status: 200
etag: "5d702758-8cef"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 36079

GET
H2 200 globe-white-right-1.png
redcanary.com/wp-content/uploads/2019/01/ 259 KB
260 KB 268ms
267ms Image
image/png 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/uploads/2019/01/globe-white-right-1.png
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Wed, 27 Feb 2019 16:15:47 GMT
server: nginx
status: 200
etag: "5c76b7b3-40da2"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 265634

GET
H2 200 9416.json Show response
script.crazyegg.com/pages/data-scripts/0096/ 4 KB
1 KB 38ms
25ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0096/9416.json?t=5344653
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9687266216f0f8cced77f8e915a79eaa3f683706f165d325025fe00dd8971adc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 13870
ce-version: 11.1.118
status: 200
content-length: 1017
cf-request-id: 05f370ec61000064f7d523f000000001
last-modified: Thu, 22 Oct 2020 15:53:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
cf-ray: 5e65b75a3f4464f7-FRA

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 82ms
24ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
age: 79948
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4067-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1603395901.620733,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 965 B
761 B 30ms
10ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=59114
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 448

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 88 KB
23 KB 20ms
7ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23070
x-xss-protection: 0
pragma: public
x-fb-debug: b6WQDhMg2gRd/d8lbkalhl3VDF22zxEu23uEA9hA91yvPe6BQ5/bbmkQqK6SdB0SOBaZCCkYSQztoD2atGisuw==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 22 Oct 2020 19:45:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 29 KB
12 KB 94ms
37ms Script
text/javascript 172.217.23.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s22-in-f162.1e100.net

Software

cafe /

Resource Hash

fb5323b78f8c4ac3d3e67de94a47d0b48cad5d735784abce37c0e05ef5c83543

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 11245
x-xss-protection: 0
server: cafe
etag: 812263826817654958
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 22 Oct 2020 19:45:00 GMT

GET
H2 200 11.1.118.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 99 KB
32 KB 22ms
22ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/11.1.118.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0096/9416.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9417079952dbe5d1b1bc0bf209d04bcf97459ce3c271837b4d9c45a48e3ecfa

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 1214440
cf-polished: origSize=105320
status: 200
cf-request-id: 05f370ec7f0000d6f9b309e000000001
last-modified: Mon, 14 Sep 2020 15:45:13 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
cf-ray: 5e65b75a6de2d6f9-FRA
cf-bgj: minify

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/159/ 11 KB
5 KB 31ms
31ms Script
application/x-javascript 104.109.95.62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/159/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-95-62.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Last-Modified: Fri, 08 May 2020 02:24:14 GMT
Server: AkamaiNetStorage
ETag: "79274ffc293e4f76fc372b953f780d16:1588904654.430334"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4810
Expires: Sat, 30 Jan 2021 19:45:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
369 B 100ms
30ms XHR
text/plain 104.108.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.67.47 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-67-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6025fa97477a49682e1e6fb1d484bf377075293ba1eebac16ca44405940597b9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://redcanary.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
700 B 77ms
23ms XHR
application/json 185.33.221.87
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.87 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

723.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:45:00 GMT
X-Proxy-Origin: 82.102.18.251; 82.102.18.251; 723.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.42:80
AN-X-Request-Uuid: 9457b85a-a0a1-4acb-a774-d9434b5d8a66
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://redcanary.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 202ms
146ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 116
pragma: no-cache
last-modified: Thu, 22 Oct 2020 19:45:00 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5ad044042b17d74ac18719d6b456f6fb
x-transaction: 002a0d22006e997d
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H/1.1 200
OK insight.beta.min.js Show response
snap.licdn.com/li.lms-analytics/ 4 KB
2 KB 10ms
10ms Script
application/x-javascript 2a02:26f0:10c:582::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.beta.min.js
Requested by: Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:582::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 Sep 2020 22:01:48 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=77440
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1799

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 11 KB
5 KB 7ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.27

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3bea34f20c813024f046166fb0ad98a8eb93d5ab93052ceb993eee238ece5b66

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 4673
x-xss-protection: 0
pragma: public
x-fb-debug: TPAPX7dA1MsDdH6CU7d9Q4H+2VYn4IUid/DWimHpQggzNHLEUjat6p9ZrKkUlGt/8/k+7zDfgZutiemZlkOM1g==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Thu, 22 Oct 2020 19:45:00 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 3437263309637655 Show response
connect.facebook.net/signals/config/ 234 KB
68 KB 48ms
45ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/3437263309637655?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d51ec7751071c95d98515f043a4753ad1ac6569f8a5c4a496abb84f338a47317

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: +irpLjaPHVAuFpx+eGJFqg9BPDs7bC2va/5aGHin7eJVN5Pxeq0PrL1HfZCuFMZrcNrliPOon8ad0W14Jd2Uzw==
x-fb-trip-id: 664085054
date: Thu, 22 Oct 2020 19:45:00 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 307ms
235ms Image
image/gif 104.108.67.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=565ffb1efc5e75f417d1fe1c2134f835&svisitor=&visitor=e9dc75be-e774-48f6-8b04-f08d7f7629cf&session=7f0ceffc-718d-4947-85e8-fda5bd2fadc8&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22In%20this%20article%2C%20we%20examine%20how%20you%20can%20detect%20adversaries%20attempting%20to%20execute%20Emotet%20before%20it%20compromises%20your%20environment%20and%20moves%20laterally.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary%22%7D&cb=95900693&r=&thirdParty=%7B%7D&pageURL=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.108.67.47 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-67-47.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:00 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 19:02:58 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502962-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK visitWebPage Show response
003-yru-314.mktoresp.com/webevents/ 2 B
311 B 805ms
169ms XHR
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://003-yru-314.mktoresp.com/webevents/visitWebPage?_mchNc=1603395900696&_mchCn=&_mchId=003-YRU-314&_mchTk=_mch-redcanary.com-1603395900696-15562&_mchHo=redcanary.com&_mchPo=&_mchRu=%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/159/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: a003b0d8-c8de-426c-9710-1bc21009312c

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D1540753%26time%3D1603395900697%26url%3Dhttps%253A%252F%252Fredcanary.com%252Fblog...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true

0
80 B

148ms
148ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:01 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-ltx1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: wtLxrhNoQBaw9Xn9JCsAAA==

Redirect headers

content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-content-type-options: nosniff
linkedin-action: 1
status: 302
content-length: 0
x-li-uuid: r8MvqRNoQBaA1UO5NCsAAA==
pragma: no-cache
x-li-pop: afd-prod-ltx1
x-msedge-ref: Ref A: BD6FE5BB07E24AD3925DA7A7BAE40E88 Ref B: FRAEDGE1307 Ref C: 2020-10-22T19:45:00Z
x-frame-options: sameorigin
date: Thu, 22 Oct 2020 19:45:00 GMT
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security: max-age=2592000
x-li-fabric: prod-ltx1
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1540753&time=1603395900697&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&liSync=true
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store
x-li-proto: http/2
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ 10 KB
1 KB 38ms
23ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700

Requested by

Host: redcanary.com
URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/main.min.js?id=83f39cc6f333c3343832

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8f3c599e913a341d24581a4d48437f742d3b5a1558389acca0265c1e19502318

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:51:51 GMT
server: ESF
date: Thu, 22 Oct 2020 19:45:00 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 22 Oct 2020 19:45:00 GMT

GET
H/1.1 200
OK widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html
platform.twitter.com/widgets/ Frame F9D3 0
0 6ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.96fd96193cc66c3e11d4c5e4c7c7ec97.html?origin=https%3A%2F%2Fredcanary.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/41A9) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 654340
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 22 Oct 2020 19:45:00 GMT
Etag: "9fa476ae827f556d5b037fe43632370d+gzip"
Last-Modified: Thu, 01 Oct 2020 21:50:01 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/41A9)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 5825

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
304 B 25ms
22ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=a23403493c6043f8a216971d6b2506f4&_biz_s=614fb3&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1603395900502&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&_biz_n=0&a=redcanary.com&rnd=52199&cdn_o=a&_biz_z=1603395900746
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F9A) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 16 Oct 2020 13:34:04 GMT
server: ECS (pab/6F9A)
age: 540656
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
202 B 20ms
18ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=a23403493c6043f8a216971d6b2506f4&_biz_s=614fb3&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1603395900749&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&a=redcanary.com&rnd=115178&cdn_o=a&_biz_z=1603395900749
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F90) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Fri, 16 Oct 2020 02:05:00 GMT
server: ECS (pab/6F90)
age: 582000
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 198ms
140ms Script
application/javascript 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=o015g&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 110
pragma: no-cache
last-modified: Thu, 22 Oct 2020 19:45:01 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 71aedbef8b4c502fb28187c1bf14113b
x-transaction: 0090b9e900901076
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 button-right-arrow-white.svg
redcanary.com/wp-content/themes/redcanary/assets/img/ 350 B
470 B 196ms
195ms Image
image/svg+xml 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://redcanary.com/wp-content/themes/redcanary/assets/img/button-right-arrow-white.svg
Requested by: Host: redcanary.com
URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.198.136.223 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 223.136.198.104.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85

Request headers

Referer: https://redcanary.com/wp-content/themes/redcanary/assets/build/master.min.css?id=ffdbf37febfab49413ac
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: br
last-modified: Wed, 27 Feb 2019 15:51:05 GMT
server: nginx
status: 200
etag: W/"5c76b1e9-15e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 details Show response
epsilon.6sense.com/v1/company/ 113 B
284 B 101ms
35ms XHR
application/json 52.29.125.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.125.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-125-201.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 895dab8d7c699b768da1e03abee778c0d01b124ed849d090671f6bb9964f66f0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
Authorization: Token 5056c3929c3198270386ced81b434006bcef81be
EpsilonCookie: 5eb3f748580200003ce1915f48020000efd50100

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx/1.16.0
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://redcanary.com
access-control-allow-credentials: true
content-length: 113

OPTIONS
H2 200 details
epsilon.6sense.com/v1/company/ Frame 0
0 102ms
26ms Other 52.29.125.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v1/company/details
Protocol: H2
Server: 52.29.125.201 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-29-125-201.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,epsiloncookie
Origin: https://redcanary.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
date: Thu, 22 Oct 2020 19:45:00 GMT
server: nginx/1.16.0
access-control-allow-origin: https://redcanary.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization,epsiloncookie

GET
H/1.1 200
OK horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js Show response
platform.twitter.com/js/ 6 KB
3 KB 6ms
6ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/horizon_tweet.716ef7f4c155526f8ec8e60dbd2fbf56.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/4188) /
Resource Hash: b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Last-Modified: Thu, 01 Oct 2020 21:49:51 GMT
Server: ECS (fcn/4188)
Age: 684898
Etag: "15d6bf68a8d65b293e52ddc833724ed4+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 2195

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/ 2 KB
1 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:819::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/759876114/?random=1603395900807&cv=9&fst=1603395900807&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgae1&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f4ec5cf55b03bcfa3d332a6209807f9c7546ebf7e38590e90de0931a4f78041a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1047
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 104042533266547 Show response
connect.facebook.net/signals/config/ 234 KB
68 KB 43ms
42ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/104042533266547?v=2.9.27&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

671e15d9fdd048e6c4c1bded58adb1f768367a6e04942b607a48f3bb5f7154ee

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: QewYY6eb28cj8RjmpZgg/MGeaLLZdpA5J0kZpDrWnyo1pwVrPXm1jBJrXCLnvugCM8gEv8P1jKRD5Xu6jC1ryA==
x-fb-trip-id: 664085054
date: Thu, 22 Oct 2020 19:45:00 GMT
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
378 B 22ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=3437263309637655&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&rl=&if=false&ts=1603395900820&sw=1600&sh=1200&v=2.9.27&r=stable&ec=0&o=30&fbp=fb.1.1603395900819.500925867&it=1603395900689&coo=false&dpo=&tm=1&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:01 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 22 Oct 2020 19:45:01 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
412 B 137ms
137ms Script
text/javascript 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=a23403493c6043f8a216971d6b2506f4&_biz_h=-1906410348&cdn_o=a&jsVer=4.20.08.28&a=redcanary.com
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6FAE) /
Resource Hash: ae76d216bd13d104d294a81defeeeafa14238ced1cb67fb364d7d413426c780e

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
server: ECS (pab/6FAE)
etag: C12A41EF
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 220

GET
H3-Q050 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ 13 KB
13 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu3cOWxw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc772b0188bc262494be9dc529c50893ae189110dfcad5a286512b737aef93b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://redcanary.com
Referer: https://fonts.googleapis.com/css?family=Source+Sans+Pro:300,400,600,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 11:20:36 GMT
x-content-type-options: nosniff
last-modified: Tue, 15 Sep 2020 18:12:16 GMT
server: sffe
age: 116664
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13108
x-xss-protection: 0
expires: Thu, 21 Oct 2021 11:20:36 GMT

GET
H2 200 u
cdn.bizible.com/m/ 43 B
121 B 19ms
18ms Image
image/gif 68.232.35.12
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1603395900696-15562&_biz_u=a23403493c6043f8a216971d6b2506f4&_biz_s=614fb3&_biz_l=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&_biz_t=1603395900750&_biz_i=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&_biz_n=1&a=redcanary.com&rnd=313050&cdn_o=a&_biz_z=1603395900855
Requested by: Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 68.232.35.12 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (pab/6F8C) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:00 GMT
last-modified: Mon, 19 Oct 2020 17:17:04 GMT
server: ECS (pab/6F8C)
age: 268076
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status: 200
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 8ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=3437263309637655&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&rl=&if=false&ts=1603395900878&sw=1600&sh=1200&v=2.9.27&r=stable&ec=1&o=30&fbp=fb.1.1603395900819.500925867&it=1603395900689&coo=false&dpo=&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:01 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 22 Oct 2020 19:45:01 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
100 B 8ms
7ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=104042533266547&ev=PageView&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&rl=&if=false&ts=1603395900879&sw=1600&sh=1200&v=2.9.27&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1603395900819.500925867&it=1603395900689&coo=false&dpo=&rqm=GET

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:01 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 22 Oct 2020 19:45:01 GMT

GET
H2 200 forms2.css
app-sj28.marketo.com/js/forms2/css/ 13 KB
3 KB 26ms
26ms Stylesheet
text/css 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj28.marketo.com/js/forms2/css/forms2.css

Requested by

Host: app-sj28.marketo.com
URL: https://app-sj28.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 6352
status: 200
content-length: 2623
cf-request-id: 05f370edff0000048783876000000001
last-modified: Mon, 12 Oct 2020 17:13:35 GMT
server: cloudflare
etag: "2a00547-3437-5b17c6b21edc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5e65b75ccd150487-CDG
expires: Thu, 22 Oct 2020 23:45:00 GMT

GET
H2 200 forms2-theme-plain.css
app-sj28.marketo.com/js/forms2/css/ 828 B
363 B 36ms
36ms Stylesheet
text/css 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj28.marketo.com/js/forms2/css/forms2-theme-plain.css

Requested by

Host: app-sj28.marketo.com
URL: https://app-sj28.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4905
status: 200
vary: Accept-Encoding
content-length: 246
cf-request-id: 05f370ee00000004878f1e6000000001
last-modified: Mon, 12 Oct 2020 17:13:35 GMT
server: cloudflare
etag: "2a0054e-33c-5b17c6b21edc0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=63113904
content-type: text/css
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 5e65b75ccd170487-CDG
expires: Thu, 22 Oct 2020 23:45:00 GMT

GET
H2 200 XDFrame
app-sj28.marketo.com/index.php/form/ Frame CD26 0
0 197ms
196ms Document
text/html 104.16.93.80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://app-sj28.marketo.com/index.php/form/XDFrame

Requested by

Host: app-sj28.marketo.com
URL: https://app-sj28.marketo.com/js/forms2/js/forms2.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.93.80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: app-sj28.marketo.com
:scheme: https
:path: /index.php/form/XDFrame
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cf_bm=5bac6c473ee0905cc1f6fb1a49ddb740e03a3ead-1603395900-1800-AW7HyYUh2q+N0ZFQ9rAR8CWBuAh7uKHN26JUB9/+skEfT8XXC6649ttiJx7GmVeyTiESeILCAZpSaRtmZ5MvXww=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Thu, 22 Oct 2020 19:45:01 GMT
content-type: text/html; charset=utf-8
content-length: 652
set-cookie: __cfduid=d92650524c0809425d2975acd067f1fa61603395901; expires=Sat, 21-Nov-20 19:45:01 GMT; path=/; domain=.app-sj28.marketo.com; HttpOnly; SameSite=Lax BIGipServersj28web-nginx-app_https=!K8q96UceX3UH4oLInuzRy4alk/3R/jiy7Da4NXZtcXWpOPYVO1R3y20Zbza9OUgeoqOYdjagxvHKPg==;Path=/;Version=1;Secure;Httponly
cache-control: max-age=3600
strict-transport-security: max-age=63113904
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cf-cache-status: DYNAMIC
cf-request-id: 05f370ee4c00000487f3bd4000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5e65b75d4e550487-CDG

POST
H2 200 admin-ajax.php Show response
redcanary.com/wp-admin/ 0
617 B 706ms
705ms XHR
text/html 104.198.136.223
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://redcanary.com/wp-admin/admin-ajax.php

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.198.136.223 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

223.136.198.104.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	SAMEORIGIN, deny
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

Accept: */*
Referer
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff, nosniff
x-permitted-cross-domain-policies: master-only
x-powered-by: WP Engine
status: 200
vary: X-NR-SAMPLE-PERCENT
content-length: 0
x-xss-protection: 1; mode=block, 1; mode=block
referrer-policy: strict-origin-when-cross-origin, no-referrer
server: nginx
x-frame-options: SAMEORIGIN, deny
date: Thu, 22 Oct 2020 19:45:01 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, must-revalidate, max-age=0
feature-policy: microphone 'none'; geolocation 'none'
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H/1.1 200
OK index.html
platform.twitter.com/embed/ Frame DA9B 0
0 7ms
6ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/embed/index.html?dnt=true&embedId=twitter-widget-0&frame=false&hideCard=false&hideThread=false&id=1080570556620124160&lang=en&origin=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&theme=light&widgetsVersion=ed20a2b%3A1601588405575&width=500px
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (fcn/40D0) /
Resource Hash

Request headers

Host: platform.twitter.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 991
Cache-Control: public, max-age=1800
Content-Type: text/html; charset=utf-8
Date: Thu, 22 Oct 2020 19:45:01 GMT
Etag: "5349d12bea368508533f7a71f7df5727"
Last-Modified: Wed, 14 Oct 2020 21:28:12 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (fcn/40D0)
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 577

GET
H2 200 /
www.google.com/pagead/1p-user-list/759876114/ 42 B
287 B 28ms
27ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/759876114/?random=1603395900807&cv=9&fst=1603393200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgae1&sendb=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&async=1&fmt=3&is_vtc=1&random=1382862576&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/759876114/ 42 B
560 B 41ms
21ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/759876114/?random=1603395900807&cv=9&fst=1603393200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wgae1&sendb=1&frm=0&url=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&tiba=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&async=1&fmt=3&is_vtc=1&random=1382862576&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: redcanary.com
URL: https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:01 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
www.facebook.com/tr/ 0
81 B 7ms
7ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary2xSINFmtMxKM389u

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 22 Oct 2020 19:45:01 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://redcanary.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

POST
H2 200 /
www.facebook.com/tr/ 0
30 B 7ms
7ms Other
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydXiyT8XF6KrFADAk

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
server: proxygen-bolt
date: Thu, 22 Oct 2020 19:45:01 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://redcanary.com
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0

GET
H/1.1 200
OK jquery.min.js Show response
rtp-static.marketo.com/rtp/libs/jquery/1.8.3/ 91 KB
33 KB 136ms
61ms Script
application/x-javascript 104.111.239.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jquery/1.8.3/jquery.min.js
Requested by: Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.239.158 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-239-158.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Sep 2015 11:20:15 GMT
Server: AkamaiNetStorage
ETag: "3576a6e73c9dccdbbc4a2cf8ff544ad7:1441624815"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 33467

GET
H/1.1 200
OK jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/ 22 KB
4 KB 109ms
34ms Stylesheet
text/css 104.111.239.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by: Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.239.158 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-239-158.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Nov 2017 08:57:42 GMT
Server: AkamaiNetStorage
ETag: "7f5b0bee9b1f7af8413b351cbceca223:1510045062"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/css
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 3752

GET
H/1.1 200
OK trw Show response
sjrtp8.marketo.com/gw1/ 0
435 B 705ms
152ms Script
application/x-javascript 192.28.147.37
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp8.marketo.com/gw1/trw?aid=redcanary2&trwv.uid=redcanary2-1603395901604-ee1b050c&trwv.vc=1&trwsa.sid=redcanary2-1603395901606-8edd9c00&trwsb.cpv=1&ctzo=+02:00&uri=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&ma=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1603395900696-15562&pm=&viewedTypes=&rts=1603395901608

Requested by

Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.28.147.37 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(7.3.1.v20110307) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:02 GMT
Cache-Control: no-cache
Server: Jetty(7.3.1.v20110307)
Connection: close
Content-Length: 0
Strict-Transport-Security: max-age=63113904
Content-Type: application/x-javascript; charset=UTF-8

GET
H/1.1 200
OK ga-integration-2.0.2.js Show response
rtp-static.marketo.com/rtp/libs/ 15 KB
5 KB 102ms
34ms Script
application/x-javascript 104.111.239.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.2.js
Requested by: Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.239.158 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-239-158.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7fb58f6c6c2c3b61909e3b4bb9e199d95d5e2a4e39b58f25d1a9894971ed16b9

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 03 Jul 2018 13:42:27 GMT
Server: AkamaiNetStorage
ETag: "52b7a5deba12e7e1147fcebaa9fd9691:1530625347"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 4977

GET
H/1.1 200
OK msg Show response
sjrtp8.marketo.com/gw1/ 0
494 B 673ms
158ms Script
text/javascript 192.28.147.37
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp8.marketo.com/gw1/msg?a=2&sid=redcanary2-1603395901606-8edd9c00&aid=redcanary2&ma=id%3A003-YRU-314%26token%3A_mch-redcanary.com-1603395900696-15562&viewedTypes=&0.21295013348043756&rts=1603395901660

Requested by

Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.28.147.37 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(7.3.1.v20110307) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:02 GMT
Content-Encoding: gzip
Server: Jetty(7.3.1.v20110307)
Transfer-Encoding: chunked
Connection: close
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904

GET
H/1.1 200
OK jquery-custom-ui.min.js Show response
rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/ 126 KB
35 KB 46ms
46ms Script
application/x-javascript 104.111.239.158
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Requested by: Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.239.158 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-239-158.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 09 Jan 2018 12:54:21 GMT
Server: AkamaiNetStorage
ETag: "5a9f8dd85d85afd20544bd437a505338:1515502461"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 86400
Access-Control-Allow-Credentials: false
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 35484

GET
H/1.1 200
OK msg Show response
sjrtp8.marketo.com/gw1/ 0
494 B 454ms
152ms Script
text/javascript 192.28.147.37
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: sjrtp8-cdn.marketo.com
URL: https://sjrtp8-cdn.marketo.com/rtp-api/v1/rtp.js?aid=redcanary2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.28.147.37 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(7.3.1.v20110307) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:02 GMT
Content-Encoding: gzip
Server: Jetty(7.3.1.v20110307)
Transfer-Encoding: chunked
Connection: close
Content-Type: text/javascript; charset=UTF-8
Cache-Control: no-cache
Strict-Transport-Security: max-age=63113904

GET
H/1.1 200
OK visitor Show response
sjrtp8.marketo.com/gw1/rtp/api/v1_1/ 240 B
879 B 617ms
156ms XHR
application/json 192.28.147.37
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp8.marketo.com/gw1/rtp/api/v1_1/visitor?sid=redcanary2-1603395901606-8edd9c00&aid=redcanary2&1603395902787

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.28.147.37 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(7.3.1.v20110307) /

Resource Hash

4ab5eee7d4478e0afa169871ebd23b5d3cc8d2db3c8879ff0963a45cf4f73a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 19:45:03 GMT
Content-Encoding: gzip
Last-Modified: Thu Oct 22 14:45:03 CDT 2020
Server: Jetty(7.3.1.v20110307)
Strict-Transport-Security: max-age=63113904
Content-Type: application/json;charset=UTF-8
Access-Control-Allow-Origin: https://redcanary.com
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Transfer-Encoding: chunked
Connection: close
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sgm Show response
sjrtp8.marketo.com/gw1/ga/ 48 B
500 B 633ms
159ms XHR
text/json 192.28.147.37
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://sjrtp8.marketo.com/gw1/ga/sgm?sid=redcanary2-1603395901606-8edd9c00&1603395902788

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

192.28.147.37 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

Software

Jetty(7.3.1.v20110307) /

Resource Hash

25b4e974dc91d718d1b66bf120388c20da6dfd3a886ec8401af1c269dd169a44

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 19:45:03 GMT
Server: Jetty(7.3.1.v20110307)
Strict-Transport-Security: max-age=63113904
Content-Type: text/json;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: close
Content-Length: 48

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 1754
date: Thu, 22 Oct 2020 19:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 22 Oct 2020 21:15:48 GMT

GET
H2 200 index.html
js.driftt.com/deploy/assets/ Frame DADD 0
0 32ms
32ms Document
text/html 52.85.32.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/deploy/assets/index.html

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1603396200000/65zait4t5ws7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.85.32.38 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-85-32-38.ham50.r.cloudfront.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: js.driftt.com
:scheme: https
:path: /deploy/assets/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html; charset=utf-8
content-length: 894
server: nginx
last-modified: Tue, 13 Oct 2020 15:05:22 GMT
x-amz-server-side-encryption: AES256
accept-ranges: bytes
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
date: Thu, 22 Oct 2020 19:45:02 GMT
etag: "e6bb65f85e419beda3231798abde6eb3"
cache-control: max-age=10
x-cache: Hit from cloudfront
via: 1.1 73bc1d640c0c6e18c08ecc8b7ae0c8d1.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: yq0_ps_rHMWDfEhGmwcBfejVXMExni9H46ItK5MpO04me4Yv-qzhtA==

GET
H3-Q050 200 js Show response
www.google-analytics.com/gtm/ 93 KB
35 KB 56ms
41ms Script
application/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/js?id=GTM-KJTKFT3&t=gtm4&cid=1037211861.1603395903

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dd51fc5579e2b5e19ec14490b4d4f710cb1aaf2ab751483adc7848d399c04580

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:45:02 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35842
x-xss-protection: 0
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 19:45:02 GMT

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
136 B 15ms
13ms XHR
text/plain 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&a=554849915&t=pageview&_s=1&dl=https%3A%2F%2Fredcanary.com%2Fblog%2Fstopping-emotet-before-it-moves-laterally%2F&ul=en-us&de=UTF-8&dt=Stopping%20Emotet%20Before%20it%20Moves%20Laterally%20-%20Red%20Canary&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAAEADQAAAAC~&jid=1990548371&gjid=304978785&cid=1037211861.1603395903&tid=UA-52702906-1&_gid=560061426.1603395903&_r=1&gtm=2wgae1PXWC8JW&cd6=France&cd7=Paris&cd8=Paris&z=690536316

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PXWC8JW

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 1754
date: Thu, 22 Oct 2020 19:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 22 Oct 2020 21:15:48 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
465 B 42ms
15ms XHR
text/plain 2a00:1450:400c:c04::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-52702906-1&cid=1037211861.1603395903&jid=1990548371&gjid=304978785&_gid=560061426.1603395903&_u=aGDAAEACQAAAAC~&z=1412375649

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=redcanary.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 22 Oct 2020 19:45:02 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://redcanary.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
472 B 54ms
38ms Image
image/gif 2a00:1450:4001:803::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-52702906-1&cid=1037211861.1603395903&jid=1990548371&_u=aGDAAEACQAAAAC~&z=22244751

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
491 B 52ms
37ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-52702906-1&cid=1037211861.1603395903&jid=1990548371&_u=aGDAAEACQAAAAC~&z=22244751

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 19:45:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

112 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.redcanary.com/	1970-01-19 13:23:17	Name: trwsa.sid Value: redcanary2-1603395901606-8edd9c00%3A1
.redcanary.com/	1970-01-20 06:54:27	Name: trwv.uid Value: redcanary2-1603395901604-ee1b050c%3A1
.app-sj28.marketo.com/	1970-01-19 13:23:17	Name: __cf_bm Value: 5bac6c473ee0905cc1f6fb1a49ddb740e03a3ead-1603395900-1800-AW7HyYUh2q+N0ZFQ9rAR8CWBuAh7uKHN26JUB9/+skEfT8XXC6649ttiJx7GmVeyTiESeILCAZpSaRtmZ5MvXww=
.twitter.com/	1970-01-20 06:54:27	Name: personalization_id Value: "v1_4zH+6/dcna/pZQc0KI+P4g=="
.redcanary.com/	1970-01-19 22:08:51	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.redcanary.com/	1970-01-19 22:08:51	Name: _biz_pendingA Value: %5B%5D
.redcanary.com/	1970-01-19 22:08:51	Name: _biz_nA Value: 2
redcanary.com/	1970-01-19 13:23:30	Name: _gd_session Value: 7f0ceffc-718d-4947-85e8-fda5bd2fadc8
redcanary.com/	1970-01-20 06:54:27	Name: driftt_aid Value: 2ee35541-0e80-4007-b250-f77a1d49bb5d
redcanary.com/	1970-01-19 13:33:20	Name: _an_uid Value: 0
.redcanary.com/	1970-01-19 13:23:17	Name: _biz_sid Value: 614fb3
redcanary.com/	1970-01-20 06:54:27	Name: _gd_visitor Value: e9dc75be-e774-48f6-8b04-f08d7f7629cf
.redcanary.com/	1970-01-19 22:08:51	Name: _biz_uid Value: a23403493c6043f8a216971d6b2506f4
.redcanary.com/	1970-01-20 06:54:27	Name: _mkto_trk Value: id:003-YRU-314&token:_mch-redcanary.com-1603395900696-15562
.redcanary.com/	1970-01-19 15:32:51	Name: _gcl_au Value: 1.1.169495726.1603395901
.redcanary.com/	1970-01-19 15:32:51	Name: _fbp Value: fb.1.1603395900819.500925867
redcanary.com/	1970-01-20 06:54:27	Name: _gd_svisitor Value: 5eb3f748580200003ce1915f48020000efd50100
redcanary.com/	1970-01-19 13:23:19	Name: cookielawinfo-checkbox-non-necessary Value: yes
redcanary.com/	1970-01-19 13:23:19	Name: cookielawinfo-checkbox-necessary Value: yes

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/main.min.js?id=83f39cc6f333c3343832(Line 1) Message: 0
console-api	log	(Line 1) Message: in callback
console-api	log	URL: https://redcanary.com/wp-content/themes/redcanary/assets/build/main.min.js?id=83f39cc6f333c3343832(Line 1) Message: 0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

003-yru-314.mktoresp.com
ajax.googleapis.com
analytics.twitter.com
app-sj28.marketo.com
b.6sc.co
c.6sc.co
cdn.bizible.com
cdn.bizibly.com
connect.facebook.net
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
j.6sc.co
js.driftt.com
munchkin.marketo.net
platform.twitter.com
px.ads.linkedin.com
redcanary.com
rtp-static.marketo.com
script.crazyegg.com
secure.adnxs.com
sjrtp8-cdn.marketo.com
sjrtp8.marketo.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redcanary.com
104.108.67.47
104.109.95.62
104.111.239.158
104.16.93.80
104.198.136.223
104.244.42.3
104.244.42.5
151.101.112.157
172.217.23.162
185.33.221.87
192.28.147.37
192.28.147.68
2606:2800:234:59:254c:406:2366:268c
2606:4700::6813:9408
2620:1ec:21::14
2a00:1450:4001:802::2003
2a00:1450:4001:803::2004
2a00:1450:4001:806::200a
2a00:1450:4001:808::2003
2a00:1450:4001:809::200e
2a00:1450:4001:819::2002
2a00:1450:4001:81e::200a
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a00:1450:400c:c04::9b
2a02:26f0:10c:582::25ea
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:f500:11:101::b93f:9005
52.29.125.201
52.85.32.38
68.232.35.12
00745dffe700afe5a7c3819448689da4e8fa928e6da90c344517f96278778857
02ce79bb4b5ac1f3eb3dce120788723fe26f77720680d7cd9cdb770485a804d7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0bc90721e98f61d677256d016c8b6dabe0b5267aa0ca778b2df5d0e30e6b8608
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1eb2d178abcddee24e52a57f478b9a89ef9ad0254e570dcfa63d63fa7dd54d83
239b66d7e481d8db4b5a59728346c9eb7d98e9366d2caeabd621cc993a16d331
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
25b4e974dc91d718d1b66bf120388c20da6dfd3a886ec8401af1c269dd169a44
2b418a10ba4680c77fa07fb0e736eec6306cba0dbbbc8deac94a25e679178e15
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3237c33cfd2483887984745c0125b4cc2fda7f265f79dbdd1eae17d10caea0d7
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31
37a121a2628f705662a9872f9beb83e4d9e4c42b157296a72f04afd55159a222
3bea34f20c813024f046166fb0ad98a8eb93d5ab93052ceb993eee238ece5b66
3de12cebe7337529cd0fcb01f20f10bde90a467e2bc8b40e37e29a34f339af6e
4217aeda4eea0c5354e9ed375863b7d7ac381162264bd4a24a18c64a6f278343
459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc
487673291004a3ed129a617baeafd16774387981024bc286177ebbcdc6ecec72
487f2e9da2ff0740755a5ef01dc15a2888b89537795895203a831b13b199d8bb
4ab5eee7d4478e0afa169871ebd23b5d3cc8d2db3c8879ff0963a45cf4f73a7d
4c77b84665a1e6bfb24ec928a1ed9045818099f6a6f2e26e2bb22a560067183f
4fe00ebc1aa4fc9a058b88c1b226a3feb16e330fab8af40f4c18de31f26837b5
51383b257916f54e8916354ef97cd3fe21122ec737ab070d5927f933817b8756
53ea7c05e64bb9639d577f772e3b56a89adaa9a102ed1d0ba5e239dd50faca34
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
583a780196ce444aeeda88a30e7b343216e9fe937bb40ece69b673589e902551
5cc2628039ee08964a5f46fb8abb1d5e1ec87e1200d12862ef1232bbfed7da55
6025fa97477a49682e1e6fb1d484bf377075293ba1eebac16ca44405940597b9
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
671e15d9fdd048e6c4c1bded58adb1f768367a6e04942b607a48f3bb5f7154ee
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
779651bc146d489786b9b4ab590d2784547448e4b85cf1bb9036b31e404d1a37
7bc1dc7d2a673a36a6e7b3d26c7fd8f5cc42d8b2d41a98e4de2a5ebdaaea9bf7
7ce4ca0e02dcd2e5d53782f3a82d8351337a909c13a9d6713e5c29fd2fdd3a97
7e99351f16a4c1387d31a35e02efd51006255c3750deba6950973461cf33f6a1
7ec7f22119da3493aedefd66ffd30f0aaf4cf4aee42d8254638bcca5971c3568
7fb58f6c6c2c3b61909e3b4bb9e199d95d5e2a4e39b58f25d1a9894971ed16b9
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
895dab8d7c699b768da1e03abee778c0d01b124ed849d090671f6bb9964f66f0
8cd8d00a6404d6f2b3c365ef5822ac6e13d76ff220ce6346d89f1195b7b8d8f3
8edbf02936f4bbda931a228bd84f7b668522af07f3dfc33b5caee429e7febb85
8f3c599e913a341d24581a4d48437f742d3b5a1558389acca0265c1e19502318
929169823afc0c1b96ebabd781fe0211e432d8eb455ab15c8f661c3f6322d597
9687266216f0f8cced77f8e915a79eaa3f683706f165d325025fe00dd8971adc
9ba815a999a1ca2299c373aad76b849c92ed4fe53650c95a3c16a8a11ed2bae0
9d8559eba8ec6953f79c06df15b1a64e2dc91c12cb2f0200a135ea86ec87e658
9fe8f8b001d5356b967eebbd61b4344bbde1d5a879cdf541eb0117faca20befe
a1dbc0f2338517af3af73672c44f83f13f99a9c0dc7e9f8b18884f48f724710a
a8431bfe4316cdc20de936e824f735c9478bbc9ce3d3a51c774eca45faff637f
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad15377f35d02809231d95a70eb18aeeff5624b39ab1139a1e5249eff7cbd666
ae76d216bd13d104d294a81defeeeafa14238ced1cb67fb364d7d413426c780e
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b8e8fe9b8ca280dc3c982691064e62ba97c8f2c192a17dfe74430c7cf73cb4de
b8fa20af264fcdd99621fc4e3a770927452b0fe382599e0d890a3bfa31152f80
d06df4184ba84e09a4be6a6ed101d1c3adefea0eaa833ddecf2f2251f6af33a3
d28ffa42ee409fb556cfa1d109df82708bd4b2bb5e13e6318b96b929cd46e6ff
d3d589e680bc49f54cb5721723fc2ec1a68d5e8ce3946db7192fb0d207e9b6cf
d44b68c7b3e659196a6a72662f4e2e903044d6e64a6a5c0002602711cd68a8fa
d51ec7751071c95d98515f043a4753ad1ac6569f8a5c4a496abb84f338a47317
d9417079952dbe5d1b1bc0bf209d04bcf97459ce3c271837b4d9c45a48e3ecfa
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd51fc5579e2b5e19ec14490b4d4f710cb1aaf2ab751483adc7848d399c04580
dde2a7cd4331f78a4b35dca9aa2e716fc3d0c83ba0f855f0812cbfae4a27a805
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2dfd9f6302bbe189ea1244646b771ed6d3f4a111a8f01532da8543bc95afd2b
e37570ef85a3553930ba20dfab7280bfcead8a2238b536b5c03c629c35b3d4ca
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6aa5a045a41477d7cea6e5ff9f3c6e1fe6edd98e4f5cd03ac35b360e0725dd9
ecf76895be1cf9e8b3edb254030e9c9c1d8f3c2efc1f9dc7e04ceff29eccae9c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10b9b0c4107ca5a40a5c69b1ac91a8948d84f39893dee6b429cdbdb05887093
f4ec5cf55b03bcfa3d332a6209807f9c7546ebf7e38590e90de0931a4f78041a
fb5323b78f8c4ac3d3e67de94a47d0b48cad5d735784abce37c0e05ef5c83543
fc6f67630ef4abd949210c71c665a86810d3eb28d613900326f29f6baa4b1f48
fc772b0188bc262494be9dc529c50893ae189110dfcad5a286512b737aef93b8
fec6411c0449c2f2b631cdb40900e968c49501f4e92e7b12e75e1e1bc6ed2813

redcanary.com Open in urlscan Pro 104.198.136.223 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

102 Requests

100 %HTTPS

53 %IPv6

26 Domains

36 Subdomains

31 IPs

6 Countries

3832 kBTransfer

6063 kBSize

19 Cookies

11 Outgoing links

Redirected requests

102 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

redcanary.com Open in urlscan Pro
104.198.136.223 Public Scan

Screenshot
Live screenshot

Full Image

102
Requests

100 %
HTTPS

53 %
IPv6

26
Domains

36
Subdomains

31
IPs

6
Countries

3832 kB
Transfer

6063 kB
Size

19
Cookies

102 HTTP transactions
0 data transactions