dfir.science Open in urlscan Pro
2606:4700:3033::ac43:a2ce Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://dfir.science/
Effective URL:
https://dfir.science/
Submission: On November 23 via manual (November 23rd 2021, 9:31:51 pm UTC) from CA — Scanned from CA

Summary HTTP 29 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 7 IPs in 1 countries across 7 domains to perform 29 HTTP transactions. The main IP is 2606:4700:3033::ac43:a2ce, located in United States and belongs to CLOUDFLARENET, US. The main domain is dfir.science.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 6th 2021. Valid for: a year.

This is the only time dfir.science was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 9	2606:4700:303... 2606:4700:3033::ac43:a2ce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6810:5614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700::68... 2606:4700::6810:731	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.73.255.205 23.73.255.205	16625 (AKAMAI-AS) (AKAMAI-AS)
7	13.225.221.36 13.225.221.36	16509 (AMAZON-02) (AMAZON-02)
1	23.73.244.145 23.73.244.145	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2607:f8b0:400... 2607:f8b0:4006:80c::200a	15169 (GOOGLE) (GOOGLE)
29	7

9 2606:4700:3033::ac43:a2ce (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dfir.science	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6810:5614 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6810:731 (United States)

ASN13335 (CLOUDFLARENET, US)

c6.patreon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.patreon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c5.patreon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.73.255.205 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-73-255-205.deploy.static.akamaitechnologies.com

chimpstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 13.225.221.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-221-36.jfk51.r.cloudfront.net

downloads.mailchimp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.73.244.145 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-73-244-145.deploy.static.akamaitechnologies.com

mc.us5.list-manage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	dfir.science 1 redirects dfir.science	179 KB
7	mailchimp.com downloads.mailchimp.com	86 KB
7	patreon.com c6.patreon.com www.patreon.com c5.patreon.com	647 KB
4	jsdelivr.net cdn.jsdelivr.net	179 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	list-manage.com mc.us5.list-manage.com	2 KB
1	chimpstatic.com chimpstatic.com	2 KB
29	7

	Domain	Requested by
9	dfir.science	1 redirects dfir.science
7	downloads.mailchimp.com	chimpstatic.com downloads.mailchimp.com
4	cdn.jsdelivr.net	dfir.science cdn.jsdelivr.net
3	c6.patreon.com	dfir.science www.patreon.com
2	c5.patreon.com	www.patreon.com c5.patreon.com
2	www.patreon.com	c6.patreon.com
1	fonts.googleapis.com	c6.patreon.com
1	mc.us5.list-manage.com	downloads.mailchimp.com
1	chimpstatic.com	dfir.science
29	9

This site contains links to these domains. Also see Links.

Domain
youtube.com
swag.dfir.science
eepurl.com
www.youtube.com
twitter.com
github.com
linkedin.com
reddit.com
us5.list-manage.com
www.patreon.com
forms.gle
infosec.exchange
www.facebook.com
instagram.com
jekyllrb.com
mademistakes.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-06` - `2022-07-05`	a year	crt.sh
patreon.com Cloudflare Inc ECC CA-3	`2021-06-08` - `2022-06-07`	a year	crt.sh
wildcardsan.us15.list-manage.com DigiCert SHA2 Secure Server CA	`2021-01-11` - `2022-01-17`	a year	crt.sh
downloads.mailchimp.com Amazon	`2021-07-21` - `2022-08-19`	a year	crt.sh
wildcardsan.list-manage.com DigiCert SHA2 Secure Server CA	`2021-09-27` - `2022-09-27`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://dfir.science/
Frame ID: 4030C2386CE3B4F81A7C99284BF4ECDA
Requests: 18 HTTP requests in this frame

Frame: https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620
Frame ID: 1027861E52E28246B93CC9151C320E07
Requests: 7 HTTP requests in this frame

Frame: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: 9930C92C9E8CA8117390B4A88A320ABD
Requests: 2 HTTP requests in this frame

Frame: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: F5E9C7769C12A50BD1F2F934C0DCB6CE
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DFIRScience

Page URL History Show full URLs

http://dfir.science/ HTTP 301
https://dfir.science/ Page URL

Page Statistics

29
Requests

100 %
HTTPS

57 %
IPv6

7
Domains

9
Subdomains

7
IPs

1
Countries

1095 kB
Transfer

5803 kB
Size

4
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://youtube.com/dfirscience
Title: Tutorials

Search URL Search Domain Scan URL

URL: https://swag.dfir.science/
Title: Shop

Search URL Search Domain Scan URL

URL: http://eepurl.com/hG9inj
Title: Newsletter

Search URL Search Domain Scan URL

URL: https://www.youtube.com/DFIRScience?sub_confirmation=1
Title: Youtube

Search URL Search Domain Scan URL

URL: https://twitter.com/DFIRScience
Title: Twitter

Search URL Search Domain Scan URL

URL: https://github.com/DFIRScience
Title: GitHub

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/dfirscience
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://reddit.com/u/dfirscience
Title: Reddit

Search URL Search Domain Scan URL

URL: https://us5.list-manage.com/contact-form?u=3664f5bc2c4350bc7454f233d&form_id=42749486e45c8394701634ff776be7b8
Title: Email

Search URL Search Domain Scan URL

URL: https://www.patreon.com/dfirscience
Title: Support

Search URL Search Domain Scan URL

URL: https://forms.gle/HtTr5SBcMv1oAZkh9
Title: Forensic 4:castDFIR Blog of the Year

Search URL Search Domain Scan URL

URL: https://infosec.exchange/@DFIRScience
Title: Mastodon

Search URL Search Domain Scan URL

URL: https://www.facebook.com/DFIRScience
Title: Facebook

Search URL Search Domain Scan URL

URL: https://instagram.com/DFIRScience
Title: Instagram

Search URL Search Domain Scan URL

URL: https://jekyllrb.com/
Title: Jekyll

Search URL Search Domain Scan URL

URL: https://mademistakes.com/work/minimal-mistakes-jekyll-theme/
Title: Minimal Mistakes

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://dfir.science/ HTTP 301
https://dfir.science/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
dfir.science/
Redirect Chain

http://dfir.science/
https://dfir.science/

13 KB
4 KB

312ms
253ms

Document
text/html

2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

785bfdb8bb2ed191ebf3bd54a56dd694e524fcda99a840060b9097e40a3c9380

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-type: text/html; charset=utf-8
cf-ray: 6b2d819b6815715a-YUL
access-control-allow-origin: *
cache-control: max-age=600
expires: Tue, 23 Nov 2021 21:41:46 GMT
last-modified: Mon, 22 Nov 2021 15:02:01 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Accept-Encoding
cf-cache-status: DYNAMIC
content-security-policy: upgrade-insecure-requests
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
feature-policy: camera 'none'; geolocation 'none'; microphone 'none'
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
x-frame-options: DENY
x-github-request-id: A2C8:23A5:17F43:2D125:619D5DC1
x-proxy-cache: MISS
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BbNeHkv8UCKB9Z4qujMLlZ5%2Fa0%2BXvtIdoO0gkVm7LgZyruiIf%2FKGMgneowvAevmPLWvHHe3tB9m9%2F4pYjRMIaGzn1Zzkbj0DFT49GLrUZpKpgR84Q%2F%2B3tjXY1ed5nEnH%2BjMHQXSzKuDn6Ho%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

Date: Tue, 23 Nov 2021 21:31:45 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Tue, 23 Nov 2021 22:31:45 GMT
Location: https://dfir.science/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fw07SlcWEc99my9VYY4KC%2FtsaIS1Vo7ct3qDhzKURE%2FJ8YfVogkgXOOWcuEBReqqfB%2BS1x5Nn1NPUZtiWEg6JCquj7Jbj1lttoDanwKAlxldGl%2BlowGo3AJNNziXzxJlD8B87mmIUJCmLJo%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 6b2d819abec0713f-YUL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 main.css
dfir.science/assets/css/ 64 KB
13 KB 115ms
115ms Stylesheet
text/css 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/assets/css/main.css

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

46adc17654b2b97fe9ce98c2ea8d643b0d8bb58224e990b858858f6d335b8e6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:02:01 GMT
server: cloudflare
x-github-request-id: 88DA:3545:126F8:274AA:619D5DC2
etag: W/"619bb0e9-10033"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gJofHABfmDxb4X2UU9mtG4CGFg2OaDx6269H5FbLnhUj72NPSTiakV1sGcGNSK7aMwWzoULWEPBluvIohtMcqHyFnWnzEc9Xbl6tnB774j93%2Fm7HKxM9kj8x9qaKJ7TFHszf44KjHjSseQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6b2d819d1a58715a-YUL
x-proxy-cache: MISS
expires: Tue, 23 Nov 2021 21:41:46 GMT

GET
H2 200 all.min.css
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/ 58 KB
13 KB 82ms
35ms Stylesheet
text/css 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 40138
x-jsd-version: 5.15.4
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19134-FRA, cache-yyz4527-YYZ
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"e7a9-pX7mjRFgGw/Y5QN/wkH/ZadURzw"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6b2d819d5d02713e-YUL

GET
H3 200 REAPERlogoMini.png
dfir.science/assets/images/ 5 KB
6 KB 150ms
149ms Image
image/png 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dfir.science/assets/images/REAPERlogoMini.png

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17c3227d1401b1649d43a49f3955f47a3cd6c72478d3dbf614b693dbeca1e290

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b2d819ddc987156-YUL
vary: Accept-Encoding
content-length: 5207
last-modified: Mon, 22 Nov 2021 15:01:33 GMT
server: cloudflare
x-github-request-id: AEBE:0C08:117C1:264C0:619D5DC2
etag: "619bb0cd-1457"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OyV%2FScUrq5c446dPwRjKT%2FHmuD%2FND77dOu6HiOGdJtRvcSx7l1k8sju1heTy0ZpL%2BX7Gp%2Fb7nxEjPnwAYVGW4VJfPzxJUyPu7goze0wJvHpi2XpeongixfUxGI8a68NigSDqvwpSjy95nno%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Tue, 23 Nov 2021 21:41:46 GMT
cache-control: max-age=14400
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: MISS

GET
H2 200 becomePatronButton.bundle.js Show response
c6.patreon.com/ 2 MB
305 KB 104ms
37ms Script
application/javascript 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c6.patreon.com/becomePatronButton.bundle.js

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f331eec54f8cd37a92bc4761cee8665908f88ffb693c1ff3c97fc34a559fe92c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2624
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 311064
last-modified: Tue, 16 Nov 2021 15:39:58 GMT
server: cloudflare
etag: "4dbd7c6d4a24cbe3fed0f68a5b9d8cbb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UAuC6%2BizoUgG6roqyk9DrmJBugxZpv8J%2BzcJjM2sdRHRtDy%2FemRsc7tobWRn7fJn7LITKXCW9XUA5%2FoEDJdrLaRfy6d89GJ44FuxWhPk0CqZD24pQX5niDRE1JpisS9GTKAnP%2Br2obxxqizJ"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 0_WPhdC9shVvjJ2d81U6y3zkdeotBaIx
via: 1.1 80ee33ec5258be8bb18516a7e3ec751d.cloudfront.net (CloudFront)
x-amz-cf-pop: DFW55-C1
accept-ranges: bytes
cf-ray: 6b2d819e4c0e7136-YUL
x-amz-cf-id: gE3ug0vnWu-EeK1-qKkmL5nHJrNwEuZDXMsXJQ7tEROPUbMOdsv23w==

GET
H3 200 REAPERlogo.png
dfir.science/assets/images/ 42 KB
43 KB 150ms
149ms Image
image/png 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dfir.science/assets/images/REAPERlogo.png

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d459ffd1f0b02498ca73cc7b57aa033f01d60e401e911e45ac5e456fca203f53

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43087
expires: Tue, 23 Nov 2021 21:41:46 GMT
last-modified: Mon, 22 Nov 2021 15:01:33 GMT
server: cloudflare
x-github-request-id: E794:278E:2A6FC:405B7:619D5DC2
etag: "619bb0cd-a84f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jjfdDah%2BHngcGWdwOsVXozmR1bhgQ8H9OB5QZgXLlbhEtD3nUTg4SaKbjAGpb522Cm8tLsTQnt%2F0r8X1lzmCgOrMpae%2FWaRUUh%2Be8O3dyCUtoimP7Fo8b25tKNhzWlclr2zBYNHShxMGYrw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6b2d819ddc997156-YUL
x-proxy-cache: MISS

GET
H3 200 main.min.js Show response
dfir.science/assets/js/ 120 KB
44 KB 125ms
125ms Script
application/javascript 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/assets/js/main.min.js

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7d188f6c8f8c4df10ebfb10a1921ccb1d384817a0178373ce2ae9abd7e7bd66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:01:33 GMT
server: cloudflare
x-github-request-id: BFB2:2212:18CA7:2DFFD:619D5DC2
etag: W/"619bb0cd-1de10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JtFk%2FzXsot6QR0tMcxsztnJt%2B%2FTGpuA51wohep3ltqqayUqzN6vV2h5IrtvPIb4MMunjOBEmezZJRh5%2Fr0BDZQ9RjOA2DQ8lib8kY%2Fogn05xzGsp%2BWcErnY6cpC%2B1DWXEZm%2BEqj%2BkYu742o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6b2d819dac417156-YUL
x-proxy-cache: MISS
expires: Tue, 23 Nov 2021 21:41:46 GMT

GET
H3 200 lunr.min.js Show response
dfir.science/assets/js/lunr/ 29 KB
9 KB 135ms
135ms Script
application/javascript 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/assets/js/lunr/lunr.min.js

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c50d9002b85780a842afffb567bb54ede402dae7c6dc5997a018614d8044fc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:01:33 GMT
server: cloudflare
x-github-request-id: 684A:6FFF:30ED0:42610:619D5DC2
etag: W/"619bb0cd-7346"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wNZRifu2%2BvKWZNd511dnKJTaGxGerqJpmGhHWyAhxR%2Fbgtu3wxCUn3LzDhRU%2BmdCJQQUpc4Lb3%2FV0EGGxx8Mhm8zQ09vPQxuwIuf%2Fi%2F%2BUjce8MzQ5EzSecQPGYEmkSQXdfmUDYgFbnOJOGY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6b2d819ddc897156-YUL
x-proxy-cache: MISS
expires: Tue, 23 Nov 2021 21:41:46 GMT

GET
H3 200 lunr-store.js Show response
dfir.science/assets/js/lunr/ 201 KB
57 KB 132ms
131ms Script
application/javascript 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/assets/js/lunr/lunr-store.js

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c8e8df03c16370bd61901239d0df53be96d25ac7a99156bf9bb44f1dc97e21e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:02:01 GMT
server: cloudflare
x-github-request-id: 784C:2EBC:13623:28277:619D5DC2
etag: W/"619bb0e9-324dc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YwNu7Y0iptLM7GAg0ZelTkuSN%2BMd05gM2S94nDp4O%2BOMJ86eX3cLAsHtDFqR4Vg6LzTMG0s0w41EaIZRP5T9ECfbxBCQaFXTOFIE%2FOmPESSEAYi0YbiXVcw2sh%2FvXAfqHyufsMz3SfPLB%2FQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6b2d819ddc937156-YUL
x-proxy-cache: MISS
expires: Tue, 23 Nov 2021 21:41:46 GMT

GET
H3 200 lunr-en.js Show response
dfir.science/assets/js/lunr/ 2 KB
1 KB 149ms
148ms Script
application/javascript 2606:4700:3033::ac43:a2ce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dfir.science/assets/js/lunr/lunr-en.js

Requested by

Host: dfir.science
URL: https://dfir.science/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::ac43:a2ce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

455dd8504356827ccf085274d4fd54ae29b0d906e993b3ecd28a8a9b290cd7f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 22 Nov 2021 15:02:01 GMT
server: cloudflare
x-github-request-id: 4FE2:7105:17EF5:28983:619D5DC2
etag: W/"619bb0e9-9bd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d37GHQewWzMxz%2BTgvyI4M0NbIp2QjfU1mSj1kvmsgH8XCK71Cv1bTqCOAIfok%2B9f1TdXiDq2TLtJ10J9tYNK%2B4QYfDxzmRRckkHPDwe0OL1%2FUHl1LrfDPx4EZQxdp%2FBGcQBvN06wJHCAhlI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: max-age=14400
cf-ray: 6b2d819ddc977156-YUL
x-proxy-cache: MISS
expires: Tue, 23 Nov 2021 21:41:46 GMT

GET
H/1.1 200
OK bc1e83d88c15540b3c7f781ee.js Show response
chimpstatic.com/mcjs-connected/js/users/3664f5bc2c4350bc7454f233d/ 4 KB
2 KB 162ms
73ms Script
application/javascript 23.73.255.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://chimpstatic.com/mcjs-connected/js/users/3664f5bc2c4350bc7454f233d/bc1e83d88c15540b3c7f781ee.js
Requested by: Host: dfir.science
URL: https://dfir.science/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.73.255.205 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-73-255-205.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 16e04a9a46ac0ea5e191b0883837e6dd660c7823b5400db021889d4a4e450a8c

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

X-EdgeConnect-Origin-MEX-Latency: 37, 20, 23, 14
Date: Tue, 23 Nov 2021 21:31:46 GMT
Content-Encoding: gzip
x-amz-request-id: JNQC6XXHKX5FDZTK
X-EdgeConnect-MidMile-RTT: 0, 0, 4, 0
Connection: keep-alive
Content-Length: 1222
x-amz-id-2: 1kwRNPYX0KBoIAVUamm5vKz2yC0qxA4Rbfwgx0KyhRbdJXbelkq2W65N3iXH8FKHMJQbsqJDlco=
Last-Modified: Tue, 19 Oct 2021 16:00:54 GMT
Server: AmazonS3
ETag: "a8e7eb74a2d4000de591d9250af7701b"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=1800
Accept-Ranges: bytes
Expires: Tue, 23 Nov 2021 22:01:46 GMT

GET
H3 200 fa-solid-900.woff2
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/ 76 KB
77 KB 97ms
74ms Font
font/woff2 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/fa-solid-900.woff2

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css
Origin: https://dfir.science
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 39330
x-jsd-version: 5.15.4
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 78268
x-served-by: cache-fra19122-FRA, cache-yyz4541-YYZ
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"131bc-DMssgUp+TKEsR3iCFjOAnLA2Hqo"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
cf-ray: 6b2d819e09214bd0-YUL

GET
H3 200 fa-brands-400.woff2
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/ 75 KB
75 KB 51ms
28ms Font
font/woff2 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/fa-brands-400.woff2

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css
Origin: https://dfir.science
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 36936
x-jsd-version: 5.15.4
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 76736
x-served-by: cache-fra19143-FRA, cache-yyz4537-YYZ
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"12bc0-BhPH67pV7kfvMCwPd2YyRpL4mac"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
cf-ray: 6b2d819e09224bd0-YUL

GET
H3 200 fa-regular-400.woff2
cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/ 13 KB
13 KB 121ms
99ms Font
font/woff2 2606:4700::6810:5614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/webfonts/fa-regular-400.woff2

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e42a88444448ac3d60549cc7c1ff2c8a9cac721034c073d80a14a44e79730cca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5/css/all.min.css
Origin: https://dfir.science
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 35397
x-jsd-version: 5.15.4
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13224
x-served-by: cache-fra19155-FRA, cache-yyz4552-YYZ
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"33a8-E1F1Ka/6OeJYXFkayubcM2tqqRc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
cf-ray: 6b2d819e09234bd0-YUL

GET
H/1.1 200
OK embed.js Show response
downloads.mailchimp.com/js/signup-forms/popup/unique-methods/ 128 KB
46 KB 191ms
73ms Script
application/javascript 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Requested by: Host: chimpstatic.com
URL: https://chimpstatic.com/mcjs-connected/js/users/3664f5bc2c4350bc7454f233d/bc1e83d88c15540b3c7f781ee.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b960a89dca43490bf0005a6ed7ef8287405c4bd8b050fc4a4934580d8a5920c6

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Nov 2021 15:14:40 GMT
Server: AmazonS3
Age: 41
ETag: W/"7ab9fd3318ef228deb0ec630a29c7cbe"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: JFK51-C1
X-Amz-Cf-Id: ZPLIBa5-nvfzAH7w1ZBlVZLmWwKpD6uGYA5Em1JgSakVQem3kSeriQ==

GET
H2 200 iframe Show response
www.patreon.com/platform/ Frame 1027 1 KB
1 KB 233ms
217ms Document
text/html 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620

Requested by

Host: c6.patreon.com
URL: https://c6.patreon.com/becomePatronButton.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8133bad2b32666126bc19ec35b890fddc27a413e5bb9986d7f67319ed086e799

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-type: text/html; charset=utf-8
cf-ray: 6b2d81a0ffdb7136-YUL
cache-control: public, s-maxage=300, max-age=0
strict-transport-security: max-age=2592000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy: origin,strict-origin-when-cross-origin
x-content-type-options: nosniff
x-patreon-uuid: 4b4470c5-71f8-430f-ac03-b6654d6188f5
x-protected-by: Sqreen
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FhMXRYIfEBq6N8SRCnpU4ikFqmz7wGp4rL67zM9qgc7MvzDR9JTQvtmJo2kuoy%2FtLnUls4gqo28P%2BEy7UnY8nSLp7Xn7I%2B%2BrTbBOWzY3DTrNCRR7m6ZbCA5p9Z9YxcFeIqQEqjlGw351RdI6Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
content-encoding: gzip

GET
H2 200 form-settings Show response
mc.us5.list-manage.com/subscribe/ 2 KB
2 KB 362ms
242ms Script
application/json 23.73.244.145
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mc.us5.list-manage.com/subscribe/form-settings?u=3664f5bc2c4350bc7454f233d&id=522fd8fdae&u=3664f5bc2c4350bc7454f233d&id=522fd8fdae&c=dojo_request_script_callbacks.dojo_request_script0
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.73.244.145 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-73-244-145.deploy.static.akamaitechnologies.com
Software: openresty /
Resource Hash: 21a0d5dad4c2ef414d324ba4a0ee6889693e972e5c0b4d946813de6624cb5298

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:47 GMT
content-encoding: gzip
referrer-policy: same-origin
server: openresty
vary: Accept-Encoding
content-type: application/json; charset=utf-8
expires: Tue, 23 Nov 2021 21:36:47 GMT
cache-control: max-age=300
content-length: 792
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 gt-america.css
c5.patreon.com/external/fonts/ Frame 1027 731 B
946 B 105ms
89ms Stylesheet
text/css 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c5.patreon.com/external/fonts/gt-america.css

Requested by

Host: www.patreon.com
URL: https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

482ce392cf63e483ac92c9a7bd13c25da0eccec03b1525b42b92df4254a559c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.patreon.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 21753
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
x-amz-request-id: F5H28HGTTEV3JRDF
x-amz-id-2: wuENExIPiIyxEWRmirrtSaWEo++RTpdtwKAXLuj6Bfw/PR+1Kg5/W+KyMX3iIIvmNTElkoZfrqs=
last-modified: Tue, 26 Oct 2021 15:53:19 GMT
server: cloudflare
etag: W/"9a9cf200c3e5715829e92ef35046fe69"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Eoxxw6gO4AlmKwSDyZYsvU7nBe%2B7p3bi4Tnq2VTShXV1qgKUSlvmbGWe0e4RaP0DAw02Az0DdUGjSnFGuX6ADaJq3i71VAtcsDHNiiuxr6dOHCuMpsVQPIpGJzyR4dyQ6KpBLVFZ6VKe4TJq"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: public, max-age=86400
x-amz-version-id: tspBtI.vaHj4h4dJvIuzMvVMTVKXGQJv
cf-ray: 6b2d81a27a1d7136-YUL

GET
H2 200 widget.css
c6.patreon.com/ Frame 1027 1 KB
922 B 103ms
103ms Stylesheet
text/css 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c6.patreon.com/widget.css

Requested by

Host: www.patreon.com
URL: https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f63641a2ed8a4345ba245490d7ec89ad7651446557b137e1527fc39ed9bf6fd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.patreon.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4934
x-cache: Miss from cloudfront
content-type: text/css
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 422
last-modified: Tue, 16 Nov 2021 15:40:07 GMT
server: cloudflare
etag: "4a20a26c329192ae003201fa0964fccf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yCS6mXa3Ut6ZdZX3V%2FpVIi1M%2FyJEVETQ3yi7ZDwEriTVRndG0sqqkP5Rh%2FPidOgSZL3AFhaOvPPMPtweku19w%2BeJ1Y5NvTtTk3JvPYlnbqi3BKKGZqHfdMy8YNCifCPLikDMTFdCE3Phw8wJ"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: _msDwdInYvHQCIVbHvTjRlAsqdMOpo.I
via: 1.1 295436c328732642848d67dafd07b971.cloudfront.net (CloudFront)
x-amz-cf-pop: SCL50-C1
accept-ranges: bytes
cf-ray: 6b2d81a25a037136-YUL
x-amz-cf-id: aB1Vxic6rKRCThWcqchg3r57rHH_kaUu2ht0UQ08w2Ub8ORoOJE-bA==

GET
H2 200 becomePatronButton.bundle.js Show response
c6.patreon.com/ Frame 1027 2 MB
304 KB 35ms
34ms Script
application/javascript 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c6.patreon.com/becomePatronButton.bundle.js

Requested by

Host: www.patreon.com
URL: https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f331eec54f8cd37a92bc4761cee8665908f88ffb693c1ff3c97fc34a559fe92c

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.patreon.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2624
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-replication-status: COMPLETED
vary: Accept-Encoding
content-length: 311064
last-modified: Tue, 16 Nov 2021 15:39:58 GMT
server: cloudflare
etag: "4dbd7c6d4a24cbe3fed0f68a5b9d8cbb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FQ80UhRwcMo2hGG99MM76dSFibMavfEv42BHAO1Yb6nYBzybapjjSJMSNMfX%2BxopoKeIMTY16DaeHyzpzl1ysgOB62NO1YNnbmFlo9ToV0KOPA54gn%2F5ddMZrPiFgYAqH9joD9uoh5POKu7G"}],"group":"cf-nel","max_age":604800}
x-amz-version-id: 0_WPhdC9shVvjJ2d81U6y3zkdeotBaIx
via: 1.1 80ee33ec5258be8bb18516a7e3ec751d.cloudfront.net (CloudFront)
x-amz-cf-pop: DFW55-C1
accept-ranges: bytes
cf-ray: 6b2d81a25a057136-YUL
x-amz-cf-id: gE3ug0vnWu-EeK1-qKkmL5nHJrNwEuZDXMsXJQ7tEROPUbMOdsv23w==

GET
H2 200 css
fonts.googleapis.com/ Frame 1027 7 KB
1 KB 116ms
39ms Stylesheet
text/css 2607:f8b0:4006:80c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,100,100italic,300,300italic,400italic,500,700,700italic,900,900italic

Requested by

Host: c6.patreon.com
URL: https://c6.patreon.com/becomePatronButton.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80c::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

50069dd80a131b78b7fd612ad86927814782ddff1f58c06c376f0d9bf90ff051

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://www.patreon.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 23 Nov 2021 21:00:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 23 Nov 2021 21:31:47 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 23 Nov 2021 21:31:47 GMT

GET
H2 200 GT-America-Standard-Regular.woff2
c5.patreon.com/external/fonts/gt-america/ Frame 1027 33 KB
34 KB 79ms
31ms Font
binary/octet-stream 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://c5.patreon.com/external/fonts/gt-america/GT-America-Standard-Regular.woff2

Requested by

Host: c5.patreon.com
URL: https://c5.patreon.com/external/fonts/gt-america.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5f30f93ffaeb0203cb18491f66e7b2e5aee2c66fbc23f1e34b5a4e2ce30af71

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Referer: https://c5.patreon.com/external/fonts/gt-america.css
Origin: https://www.patreon.com
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:31:47 GMT
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 33914
x-amz-replication-status: COMPLETED
content-length: 33304
strict-transport-security: max-age=2592000
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
x-amz-request-id: B82PZ0GZ11DQCEGR
x-amz-id-2: 2Y7rWYR9wGNx13arnj/FVVrDFrN5qli1RcJ963nOVHvRh1KE7lXLbaOLdD6iW861mWlVmI2aqpc=
last-modified: Tue, 16 Nov 2021 18:24:01 GMT
server: cloudflare
etag: "3358db6a3157a3396942c2d0ba141395"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2p96X6tOejiRS68cLAJIGWvFwSXEczx9%2FoL9sdo9N1Yu%2BUxdMqNr62R%2Bsq%2BvRSA%2BLGYDCjTL2%2F1jJ2iODTN%2BhsvoYIDFaJ7ZPqUAe%2F9eoH9hNbKmCiXl3DacciA0JzikvESsPB6EVg0caN%2Fq"}],"group":"cf-nel","max_age":604800}
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=86400
x-amz-version-id: 576Jay71oAtLKurzb2vQtzYe9PSg.ihV
accept-ranges: bytes
cf-ray: 6b2d81a3bafc4bc5-YUL

GET
H/1.1 200
OK popup.js Show response
downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 101 KB
31 KB 37ms
37ms Script
application/javascript 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6ed1a215eecd0157174987e302a5f4e1f6a5d1cd7f384608c4e6e8f5cd535ff1

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:46 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 2
ETag: W/"459011526cbe745c65ba1b165285fbe9"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: JFK51-C1
X-Amz-Cf-Id: d-vt2zQBBtB64W-vxXAfCJLOT58Ys64QHmMIVIRIU0hNZmSAwpbzhQ==

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 9930 9 KB
3 KB 27ms
27ms Stylesheet
text/css 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK51-C1
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: ZvPOZpkaRir-hQTpk-5yrwBsDLldRQfZiFUr__s6na-mZXfRCKI4vQ==

GET
H/1.1 200
OK banner.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 9930 1005 B
938 B 57ms
30ms Stylesheet
text/css 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/banner.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:07 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 41
ETag: W/"78d1bdd981816cfbeb6954a85f9efa58"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: JFK51-C1
X-Amz-Cf-Id: qWAcClI87VpJ3cDmWmFFpcKVo6pkR7b5Ay8HINKhiNXTLoNPIF6ihw==

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame F5E9 9 KB
3 KB 56ms
23ms Stylesheet
text/css 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:48 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK51-C1
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 7787c17f7e39468ee68e2078b8b5894e.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: Gt6Fn9qRWTSpLBH70zdUu6i_S3EVb7-v-rg48q6oPs0liuJUwEp53g==

GET
H/1.1 200
OK layout-1.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame F5E9 804 B
1 KB 82ms
31ms Stylesheet
text/css 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/layout-1.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60defd0229880a6f78696fcf8e687f94e43fc8bb5ff66028e23e546d0345d2f1

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:30:50 GMT
Via: 1.1 ab00cdb05d9e58b648b9b6b09875b196.cloudfront.net (CloudFront)
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 58
ETag: "33e182d2957d66f0239c291b39120c17"
X-Cache: Hit from cloudfront
Content-Type: text/css
Connection: keep-alive
X-Amz-Cf-Pop: JFK51-C1
Accept-Ranges: bytes
Content-Length: 804
X-Amz-Cf-Id: lMZN5Op1q3_YvP1RTJZ6aJD73y51yeXX7U6RlTI3ERQZlCci3KLjpQ==

GET
H/1.1 200
OK modal-slidein.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 3 KB
2 KB 82ms
31ms Stylesheet
text/css 13.225.221.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/modal-slidein.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/unique-methods/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.221.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-221-36.jfk51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 717a079466da86282255203ddb9f6faafb2bf0ca0bb23ecb539463b3f963bde4

Request headers

Accept-Language: en-CA,en;q=0.9
Referer: https://dfir.science/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Tue, 23 Nov 2021 21:31:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 46
ETag: W/"d23d4c0fac6d9f158d23552bbd4592f0"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 8844c3dbe820eac69f8ca9f1c7fb7403.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: JFK51-C1
X-Amz-Cf-Id: WMkA5tmjJHoTR9392CWl-J6FYgZPZg7sXfhg8osnnlW_Ck-ygvpVTg==

POST
H2 200 tracking Show response
www.patreon.com/api/ Frame 1027 7 B
520 B 198ms
197ms XHR
text/html 2606:4700::6810:731
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.patreon.com/api/tracking

Requested by

Host: c6.patreon.com
URL: https://c6.patreon.com/becomePatronButton.bundle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:731 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.patreon.com/platform/iframe?widget=become-patron-button&redirectURI=https%3A%2F%2Fdfir.science%2F&creatorID=16239620
Accept-Language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 23 Nov 2021 21:31:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-patreon-uuid: ed3180f2-5734-4fc3-a413-d8be8714d5a9
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rwxx3pSHD7fhwCWE7p%2BMFOLn7xA2wdp%2BWClrE7MAqwc%2FbRXWAuocR9TOlWuy%2Bpbv%2FV7KL0UB3Zp4zF4VfC8PfSvlgAzN6OQRGOXyIov6J2sPWkQI0Ki5uEs7Uj%2FFS9pnRQfoP7Td%2FrIwn%2FYLEA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
cache-control: private
x-protected-by: Sqreen
cf-ray: 6b2d81b63d757136-YUL
vary: Accept-Encoding

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.patreon.com/	1970-01-19 22:55:04	Name: __cf_bm Value: zd5KP43gz6Jk0cK2sqyec.WpMZRMqGTk0sECX0sfRNA-1637703106-0-Abvkj0W7nwdyrISnGNCMZMqaWcODt9nP6mN9p6ipJ+IzOXQeaC6K0cpfWu+2RpX0NQWDWbmvjhTv5j0PLJ5DHOEWksoqenEicmVbE9igzksm
.list-manage.com/	1970-01-20 07:40:39	Name: _abck Value: FCE7DD6BFBBECD3CF2F428F7E4471D56~-1~YAAQkZcwF+ZWSER9AQAAQ0K2TgY6+sibArTVny9/HHhL4NiWqG33fb18x/vsnuyxdp6hW3B3Tz1Lg5uhWPV9FLsm6trTxGsVahhArdx/5eJBNlIYhdZ94sTiaROzECOu7a1/VlzxZspHzyTQ5XaCMo/DloU+0fGOYvaU1zD4/5f+7dHLRWqKZoIxYfHHIDhdO9e0/nhAs3Pp2G06RhrgY5+hZ8nTvsplcbksGy4zczgC70AxZ1d93Hs/PUCB0qTvcicW+IB4DbxgP1P2QdcwftNnr9hSUged1N9Jyaxqo5qg4mFUj7qi0Q2tcOBtWWAHv+TefaFq0z5dzINP22bY7+zQYxuMNz6m+TIO//+CNucdnPGEXx2LvLIwOp0eIrXUnw==~-1~-1~-1
.us5.list-manage.com/	1970-01-19 22:55:10	Name: ak_bmsc Value: F84E2E0E82123AA9BB0D45DF251AD277~000000000000000000000000000000~YAAQkZcwF+dWSER9AQAAQ0K2Tg09NvDQGx24uaaQXwUWYskqMdSyOFbZEzSto+MN7EbDyAVqVq+Lfp0TFM5xEjfC1cmSGEdh6WZfzITblAhej5vQ7Fe+PASAUP7B296f1HRdpwglxFXH1bE87s69Lt2VZ6kd4I4hTi1JydGZnnD/Vg1j60KyU1ZWoUw4/BYQhfFgmmXQ1b+Idt7+dwlCnv5s7nLrAG0SaS6aVkTxFUp7hcEu5r/xoOSXXuRzvVSY4jP0IogXCC7+OVFaFJLSUh91g8CpAfvhWT2NCznc1Ui1CzuPqkLNEIH+n4ZrVyEp51Tuh7xW+krZJZ5DlU6hUBiAzbwWIQkuM/8+Dtbt4iYpx/0OgvPTaKFIN6PmmlVZ4CX1UUF2JpORcZlKDFDE1mY92Q==
.list-manage.com/	1970-01-19 22:55:17	Name: bm_sz Value: 564FCCB89B853F4E745316AE465EA612~YAAQkZcwF+hWSER9AQAAQ0K2Tg1Fa3zDeCLfcvhnYbFwzhFHBd98A+KC4CLrZxFXeCx7d4tTPec3IBFTOBcwE9Kbs7/5GSK1uQIqbBlUIm9KNKCuEVafBA/2DMTv9F3rCwoNcq+r20iyU+amIwaVOf0l3+JIzNYKLCjnd6H1wukNCljOXP5+iK9M90DqaxqsJ58opBShwMeYL2+ag3Ix392KsVNcJPDmwVyrfujTpTYnviJqSbta8TRw/XTH8eGYCj11FxRE7NX4zD5UZ/CqUvktfc0f44q71fb7iDkBg/Sm/lGJKy8VvQ==~3359797~4404792

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c5.patreon.com
c6.patreon.com
cdn.jsdelivr.net
chimpstatic.com
dfir.science
downloads.mailchimp.com
fonts.googleapis.com
mc.us5.list-manage.com
www.patreon.com
13.225.221.36
23.73.244.145
23.73.255.205
2606:4700:3033::ac43:a2ce
2606:4700::6810:5614
2606:4700::6810:731
2607:f8b0:4006:80c::200a
0c50d9002b85780a842afffb567bb54ede402dae7c6dc5997a018614d8044fc8
16e04a9a46ac0ea5e191b0883837e6dd660c7823b5400db021889d4a4e450a8c
17c3227d1401b1649d43a49f3955f47a3cd6c72478d3dbf614b693dbeca1e290
21a0d5dad4c2ef414d324ba4a0ee6889693e972e5c0b4d946813de6624cb5298
455dd8504356827ccf085274d4fd54ae29b0d906e993b3ecd28a8a9b290cd7f5
46adc17654b2b97fe9ce98c2ea8d643b0d8bb58224e990b858858f6d335b8e6b
482ce392cf63e483ac92c9a7bd13c25da0eccec03b1525b42b92df4254a559c2
4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72
50069dd80a131b78b7fd612ad86927814782ddff1f58c06c376f0d9bf90ff051
60defd0229880a6f78696fcf8e687f94e43fc8bb5ff66028e23e546d0345d2f1
6ed1a215eecd0157174987e302a5f4e1f6a5d1cd7f384608c4e6e8f5cd535ff1
717a079466da86282255203ddb9f6faafb2bf0ca0bb23ecb539463b3f963bde4
785bfdb8bb2ed191ebf3bd54a56dd694e524fcda99a840060b9097e40a3c9380
8133bad2b32666126bc19ec35b890fddc27a413e5bb9986d7f67319ed086e799
8ea8791754915a898a3100e63e32978a6d1763be6df8e73a39d3a90d691cdeef
9834b82ad26e2a37583d22676a12dd2eb0fe7c80356a2114d0db1aa8b3899537
99464ceb71bc9bbdcc72275faefe44f98eb5cbb6b5d8ee665b87b35376f1a96e
aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
b5f30f93ffaeb0203cb18491f66e7b2e5aee2c66fbc23f1e34b5a4e2ce30af71
b960a89dca43490bf0005a6ed7ef8287405c4bd8b050fc4a4934580d8a5920c6
bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7
c8e8df03c16370bd61901239d0df53be96d25ac7a99156bf9bb44f1dc97e21e1
d459ffd1f0b02498ca73cc7b57aa033f01d60e401e911e45ac5e456fca203f53
d7d188f6c8f8c4df10ebfb10a1921ccb1d384817a0178373ce2ae9abd7e7bd66
e42a88444448ac3d60549cc7c1ff2c8a9cac721034c073d80a14a44e79730cca
f331eec54f8cd37a92bc4761cee8665908f88ffb693c1ff3c97fc34a559fe92c
f63641a2ed8a4345ba245490d7ec89ad7651446557b137e1527fc39ed9bf6fd7

dfir.science Open in urlscan Pro 2606:4700:3033::ac43:a2ce Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

29 Requests

100 %HTTPS

57 %IPv6

7 Domains

9 Subdomains

7 IPs

1 Countries

1095 kBTransfer

5803 kBSize

4 Cookies

16 Outgoing links

Page URL History

Redirected requests

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

dfir.science Open in urlscan Pro
2606:4700:3033::ac43:a2ce Public Scan

Screenshot
Live screenshot

Full Image

29
Requests

100 %
HTTPS

57 %
IPv6

7
Domains

9
Subdomains

7
IPs

1
Countries

1095 kB
Transfer

5803 kB
Size

4
Cookies

29 HTTP transactions
0 data transactions