research.checkpoint.com Open in urlscan Pro
141.193.213.20 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Submission: On December 13 via api (December 13th 2021, 2:09:14 am UTC) from US — Scanned from DE

Summary HTTP 150 Redirects Links 46 Behaviour Indicators

Summary

This website contacted 32 IPs in 4 countries across 27 domains to perform 150 HTTP transactions. The main IP is 141.193.213.20, located in United States and belongs to CLOUDFLARESPECTRUM Cloudflare, Inc., US. The main domain is research.checkpoint.com.
TLS certificate: Issued by R3 on October 7th 2021. Valid for: 3 months.

This is the only time research.checkpoint.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
20	141.193.213.20 141.193.213.20	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
1	2606:4700:303... 2606:4700:3031::ac43:d645	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
8	104.111.231.109 104.111.231.109	16625 (AKAMAI-AS) (AKAMAI-AS)
1	13.224.96.103 13.224.96.103	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:219... 2600:9000:2190:2c00:c:abe:f440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	18.198.109.212 18.198.109.212	16509 (AMAZON-02) (AMAZON-02)
9	104.111.233.140 104.111.233.140	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2a00:1450:400... 2a00:1450:4001:82b::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c08::9d	15169 (GOOGLE) (GOOGLE)
1	185.33.220.242 185.33.220.242	29990 (ASN-APPNEX) (ASN-APPNEX)
10	2600:9000:219... 2600:9000:2190:2e00:1d:85c3:6640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
2	35.158.71.178 35.158.71.178	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba20	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	151.101.12.157 151.101.12.157	54113 (FASTLY) (FASTLY)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	108.174.10.14 108.174.10.14	14413 (LINKEDIN) (LINKEDIN)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
2	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
62	13.224.96.51 13.224.96.51	() ()
2	3.94.218.138 3.94.218.138	() ()
2	54.147.21.139 54.147.21.139	() ()
150	32

20 141.193.213.20 (United States)

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

research.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::ac43:d645 (United States)

ASN13335 (CLOUDFLARENET, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.111.231.109 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-231-109.deploy.static.akamaitechnologies.com

sc1.checkpoint.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.96.103 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-96-103.zrh50.r.cloudfront.net

platform-api.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:2c00:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)

buttons-config.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.198.109.212 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-109-212.eu-central-1.compute.amazonaws.com

l.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.111.233.140 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-233-140.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c08::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.220.242 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2600:9000:2190:2e00:1d:85c3:6640:93a1 (United States)

ASN16509 (AMAZON-02, US)

platform-cdn.sharethis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.158.71.178 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-158-71-178.eu-central-1.compute.amazonaws.com

epsilon.6sense.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba20 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.174.10.14 (United States)

ASN14413 (LINKEDIN, US)
PTR: 108-174-10-14.fwd.linkedin.com

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

750-dqh-528.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

62 13.224.96.51 (None, )

ASN- ()

js.driftt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.94.218.138 (None, )

ASN- ()

metrics.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.147.21.139 (None, )

ASN- ()

bootstrap.api.drift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
62	driftt.com js.driftt.com	742 KB
28	checkpoint.com research.checkpoint.com sc1.checkpoint.com	555 KB
13	sharethis.com platform-api.sharethis.com buttons-config.sharethis.com l.sharethis.com platform-cdn.sharethis.com	53 KB
9	6sc.co j.6sc.co c.6sc.co b.6sc.co	15 KB
6	onesignal.com cdn.onesignal.com onesignal.com img.onesignal.com	86 KB
4	drift.com metrics.api.drift.com bootstrap.api.drift.com	345 B
4	linkedin.com 3 redirects px.ads.linkedin.com www.linkedin.com px4.ads.linkedin.com	3 KB
3	google-analytics.com www.google-analytics.com	20 KB
2	facebook.com www.facebook.com	386 B
2	facebook.net connect.facebook.net	113 KB
2	marketo.net munchkin.marketo.net	6 KB
2	6sense.com epsilon.6sense.com	1 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	mktoresp.com 750-dqh-528.mktoresp.com	311 B
1	t.co t.co	470 B
1	twitter.com analytics.twitter.com	675 B
1	ads-twitter.com static.ads-twitter.com	6 KB
1	licdn.com snap.licdn.com	2 KB
1	google.de www.google.de	501 B
1	google.com www.google.com	501 B
1	adnxs.com secure.adnxs.com	697 B
1	doubleclick.net stats.g.doubleclick.net	447 B
1	googletagmanager.com www.googletagmanager.com	73 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	jquery.com code.jquery.com	30 KB
1	fontawesome.com use.fontawesome.com	12 KB
0	driftcdn.com Failed embeds.driftcdn.com Failed
150	27

	Domain	Requested by
62	js.driftt.com	research.checkpoint.com js.driftt.com
20	research.checkpoint.com	research.checkpoint.com
10	platform-cdn.sharethis.com	research.checkpoint.com
8	sc1.checkpoint.com	research.checkpoint.com
7	b.6sc.co	research.checkpoint.com
3	onesignal.com	cdn.onesignal.com
3	www.google-analytics.com	www.googletagmanager.com research.checkpoint.com
2	bootstrap.api.drift.com	js.driftt.com
2	metrics.api.drift.com	js.driftt.com
2	www.facebook.com
2	px.ads.linkedin.com	2 redirects
2	connect.facebook.net	research.checkpoint.com connect.facebook.net
2	munchkin.marketo.net	research.checkpoint.com munchkin.marketo.net
2	epsilon.6sense.com	j.6sc.co
2	cdn.onesignal.com	research.checkpoint.com cdn.onesignal.com
1	fonts.gstatic.com	fonts.googleapis.com
1	img.onesignal.com
1	750-dqh-528.mktoresp.com	munchkin.marketo.net
1	px4.ads.linkedin.com
1	www.linkedin.com	1 redirects
1	t.co
1	analytics.twitter.com	static.ads-twitter.com
1	static.ads-twitter.com	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	www.google.de	research.checkpoint.com
1	www.google.com	research.checkpoint.com
1	c.6sc.co	j.6sc.co
1	secure.adnxs.com	j.6sc.co
1	stats.g.doubleclick.net	www.google-analytics.com
1	j.6sc.co	research.checkpoint.com
1	l.sharethis.com	platform-api.sharethis.com
1	buttons-config.sharethis.com	platform-api.sharethis.com
1	www.googletagmanager.com	research.checkpoint.com
1	platform-api.sharethis.com	research.checkpoint.com
1	fonts.googleapis.com	research.checkpoint.com
1	code.jquery.com	research.checkpoint.com
1	use.fontawesome.com	research.checkpoint.com
0	embeds.driftcdn.com Failed	js.driftt.com
150	38

This site contains links to these domains. Also see Links.

Domain
www.checkpoint.com
www.facebook.com
plus.google.com
www.linkedin.com
twitter.com
cpr-zero.checkpoint.com
evasions.checkpoint.com
anti-debug.checkpoint.com
threatemulation.checkpoint.com
www.cpcheckme.com
threatmap.checkpoint.com
blogs.microsoft.com
blog.checkpoint.com
www.reuters.com
fidelissecurity.com
securelist.com
www.deepinstinct.com
www.bankinfosecurity.com
www.safernetvpn.com
threatpost.com
www.netscout.com
www.france24.com
1gew6o3qn6vx9kp3s42ge0y1-wpengine.netdna-ssl.com
www.raconteur.net
us-cert.cisa.gov
www.ic3.gov
www.wired.com
www.europol.europa.eu
krebsonsecurity.com
www.microsoft.com
www.welivesecurity.com
www.bleepingcomputer.com
www.justice.gov
securityintelligence.com
bit.ly

Subject Issuer	Validity	Valid
research.checkpoint.com R3	`2021-10-07` - `2022-01-05`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-07` - `2022-07-06`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.checkpoint.com GlobalSign GCC R3 DV TLS CA 2020	`2020-12-02` - `2022-01-03`	a year	crt.sh
sharethis.com Amazon	`2021-07-19` - `2022-08-17`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.6sc.co DigiCert SHA2 Secure Server CA	`2021-03-09` - `2022-03-16`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
*.6sense.com Amazon	`2021-06-30` - `2022-07-29`	a year	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2021-07-15` - `2022-07-20`	a year	crt.sh
ads-twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-07-21` - `2022-07-26`	a year	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2021-03-29` - `2022-04-06`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-09-21` - `2021-12-20`	3 months	crt.sh
*.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
t.co DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
*.mktoresp.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2022-01-21`	2 years	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-08` - `2022-01-31`	3 months	crt.sh
drift.com Amazon	`2021-09-08` - `2022-10-07`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Frame ID: 4749CF63D352DBCC06585222C29EE282
Requests: 83 HTTP requests in this frame

Frame: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
Frame ID: E105EF911AC199764DABC859BE524060
Requests: 32 HTTP requests in this frame

Frame: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
Frame ID: 7B13B29621DE6BE82C2F979DFCEC833F
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

When old friends meet again: why Emotet chose Trickbot for rebirth - Check Point Research

Page Statistics

150
Requests

98 %
HTTPS

50 %
IPv6

27
Domains

38
Subdomains

32
IPs

4
Countries

1736 kB
Transfer

4873 kB
Size

20
Cookies

46 Outgoing links

These are links going to different origins than the main page.

URL: https://www.checkpoint.com/
Title: CheckPoint.com

Search URL Search Domain Scan URL

URL: https://www.facebook.com/checkpointresearch/

Search URL Search Domain Scan URL

URL: https://plus.google.com/+checkpoint/posts

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/check-point-software-technologies

Search URL Search Domain Scan URL

URL: https://twitter.com/_cpresearch_

Search URL Search Domain Scan URL

URL: https://cpr-zero.checkpoint.com/
Title: CPR Zero- Vulnerability Repository

Search URL Search Domain Scan URL

URL: https://evasions.checkpoint.com/
Title: Evasion techniques Encyclopedia

Search URL Search Domain Scan URL

URL: https://anti-debug.checkpoint.com/
Title: Anti-Debug Tricks

Search URL Search Domain Scan URL

URL: https://threatemulation.checkpoint.com/
Title: SandBlast File Analysis

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/urlcat/
Title: URL Categorization

Search URL Search Domain Scan URL

URL: http://www.cpcheckme.com/checkme/
Title: Instant Security Assessment

Search URL Search Domain Scan URL

URL: https://threatmap.checkpoint.com/ThreatPortal/livemap.html
Title: Live Threat Map

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/support-services/threatcloud-incident-response/

Search URL Search Domain Scan URL

URL: https://blogs.microsoft.com/on-the-issues/2020/10/20/trickbot-ransomware-disruption-update/
Title: 94% of core servers

Search URL Search Domain Scan URL

URL: https://blog.checkpoint.com/2021/06/10/check-point-softwares-may-2021-most-wanted-malware-dridex-drops-from-list-while-trickbot-rises-to-top/
Title: May

Search URL Search Domain Scan URL

URL: https://blog.checkpoint.com/2021/07/13/june-2021s-most-wanted-malware-trickbot-remains-on-top/
Title: June

Search URL Search Domain Scan URL

URL: https://blog.checkpoint.com/2021/10/08/september-2021s-most-wanted-malware-trickbot-once-again-tops-the-list/
Title: September

Search URL Search Domain Scan URL

URL: https://www.reuters.com/article/us-cybercrime-russia-dyre-exclusive-idUSKCN0VE2QS
Title: arrested by the Russian authorities

Search URL Search Domain Scan URL

URL: https://fidelissecurity.com/threatgeek/archive/trickbot-we-missed-you-dyre/
Title: code similarities

Search URL Search Domain Scan URL

URL: https://securelist.com/trickbot-module-descriptions/104603/
Title: 20 Trickbot modules

Search URL Search Domain Scan URL

URL: https://www.deepinstinct.com/blog/trickbooster-trickbots-email-based-infection-module
Title: 250 million emails

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/covid-19-phishing-emails-mainly-contain-trickbot-microsoft-a-14149
Title: 240 million spam

Search URL Search Domain Scan URL

URL: https://www.safernetvpn.com/universal-health-services-report-67-million-loss-to-ryuk-ransomware/
Title: reported

Search URL Search Domain Scan URL

URL: https://www.bankinfosecurity.com/ryuk-ransomware-profits-150-million-a-15726
Title: researches

Search URL Search Domain Scan URL

URL: https://threatpost.com/lazarus-collaborates-trickbots-anchor-project/151000/
Title: Lazarus group was spotted

Search URL Search Domain Scan URL

URL: https://www.netscout.com/blog/asert/dropping-anchor
Title: Anchor Project

Search URL Search Domain Scan URL

URL: https://www.france24.com/en/americas/20201015-trickbot-and-its-one-million-zombie-computers-us-election-under-threat
Title: millions of Trickbot-infected machines

Search URL Search Domain Scan URL

URL: https://1gew6o3qn6vx9kp3s42ge0y1-wpengine.netdna-ssl.com/wp-content/uploads/prod/sites/5/2020/10/new-trickbot.gif
Title: election process.

Search URL Search Domain Scan URL

URL: https://www.raconteur.net/technology/the-five-most-important-ransomware-attacks-of-2021/
Title: serious ransomware attacks

Search URL Search Domain Scan URL

URL: https://us-cert.cisa.gov/ncas/alerts/aa21-265a
Title: released an advisory

Search URL Search Domain Scan URL

URL: https://www.ic3.gov/Media/News/2021/210521.pdf
Title: FBI report

Search URL Search Domain Scan URL

URL: https://www.wired.com/story/emotet-botnet-takedown/
Title: 2 and a half billion dollars

Search URL Search Domain Scan URL

URL: https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action
Title: taken down

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/infinity-vision/zero-day-protection/
Title: Zero-Day Protection

Search URL Search Domain Scan URL

URL: https://www.safernetvpn.com/universal-health-services-report-67-million-loss-to-ryuk-ransomware
Title: https://www.safernetvpn.com/universal-health-services-report-67-million-loss-to-ryuk-ransomware

Search URL Search Domain Scan URL

URL: https://threatpost.com/trickbot-switches-to-a-new-windows-10-uac-bypass-to-evade-detection/152477/
Title: https://threatpost.com/trickbot-switches-to-a-new-windows-10-uac-bypass-to-evade-detection/152477/

Search URL Search Domain Scan URL

URL: https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/
Title: https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/security/blog/2020/10/12/trickbot-disrupted/
Title: https://www.microsoft.com/security/blog/2020/10/12/trickbot-disrupted/

Search URL Search Domain Scan URL

URL: https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/
Title: https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/trickbot-botnet-targeted-in-takedown-operations-little-impact-seen/
Title: https://www.bleepingcomputer.com/news/security/trickbot-botnet-targeted-in-takedown-operations-little-impact-seen/

Search URL Search Domain Scan URL

URL: https://www.bleepingcomputer.com/news/security/trickbot-malware-under-siege-from-all-sides-and-its-working/
Title: https://www.bleepingcomputer.com/news/security/trickbot-malware-under-siege-from-all-sides-and-its-working/

Search URL Search Domain Scan URL

URL: https://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization
Title: https://www.justice.gov/opa/pr/latvian-national-charged-alleged-role-transnational-cybercrime-organization

Search URL Search Domain Scan URL

URL: https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/
Title: https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/

Search URL Search Domain Scan URL

URL: https://www.checkpoint.com/advisories/
Title: IPS ADVISORIES

Search URL Search Domain Scan URL

URL: http://blog.checkpoint.com/
Title: CHECK POINT BLOG

Search URL Search Domain Scan URL

URL: https://bit.ly/2Pmx8R2

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 66

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1639361348261%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%252F2021%252Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%252F%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&liSync=true&e_ipv6=AQL82I1vqJ0ZeAAAAX2xjQPfwYJgYdTYE2cWbuQVcr88WikQUSqtZqCKmenJJcfG_Lf2aCx8

150 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/ 52 KB
15 KB 275ms
186ms Document
text/html 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare / WP Engine

Resource Hash

170ef28b6e95640173ac6371097814b19627a79e1ac132ac8166b6af52b0c1c1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://research.checkpoint.com/?p=25592>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 14
x-cache-group: normal
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6bcba6040a4054bd-MAN
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.min.css
research.checkpoint.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 45ms
40ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Sep 2021 04:05:58 GMT
server: cloudflare
age: 1832015
etag: W/"612efc26-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055ac654bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.css
research.checkpoint.com/wp-content/themes/research/ 18 KB
4 KB 45ms
41ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.29
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 27e3e60081926b895d5615743273a67f3280908e74e364f789df932ddc0661e8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 23 Sep 2021 14:23:14 GMT
server: cloudflare
age: 6935005
etag: W/"614c8dd2-4967"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055ac954bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 bootstrap.min.css
research.checkpoint.com/wp-content/themes/research/css/ 137 KB
22 KB 50ms
46ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/css/bootstrap.min.css?ver=4.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:49 GMT
server: cloudflare
age: 13779418
etag: W/"5dc49a65-22485"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055aca54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 flickity.min.css
research.checkpoint.com/wp-content/themes/research/css/ 2 KB
700 B 46ms
42ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/css/flickity.min.css?ver=1.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 13779418
etag: W/"5dc49a64-71d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055acb54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 all.css
use.fontawesome.com/releases/v5.6.3/css/ 52 KB
12 KB 80ms
29ms Stylesheet
text/css 2606:4700:3031::ac43:d645
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.6.3/css/all.css?ver=5.6.3
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:d645 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 13759118
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-amz-request-id: RWAP64QWP4JN0WCE
x-amz-id-2: 9tYsgPtosv/J7MT9gW/UYbHMZqn9uvJcD7rDrc+BgsMwrgFTU8tkFZ5I32tu9lvkblTFHt7NJkw=
last-modified: Wed, 30 Jun 2021 15:44:33 GMT
server: cloudflare
etag: W/"dc93d584e41f8417f6b7163320d34329"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TDacswLyuJt17kB4KJndHtDVCBLsWjcZmXJci4uPz%2BX%2FAJMw5AdHTaN82uzz8sVW1UGLAAn7FtIkkUxwurtP%2FOrDiq5GO%2BeMFnJv7PsMYYG85auX9IXEWlfdfkbRKwrlMSEB%2B0M4KWNZ8M7O%2FQHLLJge"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=31556926
cf-ray: 6bcba6059b7ce8fb-MXP

GET
H2 200 enlighterjs.min.css
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 78 KB
9 KB 68ms
64ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.css?ver=TJ0/7+iAWMKbDKS
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 Feb 2021 20:35:46 GMT
server: cloudflare
age: 13779418
etag: W/"602adb22-13686"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055acc54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 jquery-3.4.0.min.js Show response
code.jquery.com/ 86 KB
30 KB 71ms
21ms Script
application/javascript 2001:4de0:ac18::1:a:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.0.min.js?ver=5.8.2
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:2a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: gzip
last-modified: Wed, 10 Apr 2019 19:56:14 GMT
server: nginx
etag: W/"5cae4a5e-15857"
vary: Accept-Encoding
x-hw: 1639361347.dop028.ml1.t,1639361347.cds015.ml1.hn,1639361347.cds211.ml1.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30632

GET
H2 200 bootstrap.bundle.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 66 KB
19 KB 65ms
62ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/js/lib/bootstrap.bundle.min.js?ver=4.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 13779418
etag: W/"5dc49a64-1089e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055acd54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 flickity.pkgd.min.js Show response
research.checkpoint.com/wp-content/themes/research/js/lib/ 54 KB
14 KB 47ms
43ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/js/lib/flickity.pkgd.min.js?ver=1.0.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 1822699
etag: W/"5dc49a64-d7c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055ace54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 single-post.js Show response
research.checkpoint.com/wp-content/themes/research/js/ 422 B
316 B 44ms
41ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/js/single-post.js?ver=1.0.4
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 14 Jan 2020 00:00:05 GMT
server: cloudflare
age: 1822699
etag: W/"5e1d0485-1a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055acf54bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 inc-header.js Show response
research.checkpoint.com/wp-content/themes/research/header/ 1 KB
501 B 45ms
42ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/header/inc-header.js?v=1.1
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 1832014
etag: W/"5dc49a64-47a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055ad154bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 style.css
research.checkpoint.com/wp-content/themes/research/header/ 9 KB
2 KB 45ms
43ms Stylesheet
text/css 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 1832015
etag: W/"5dc49a64-25cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6055ad054bd-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 45ms
20ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 13 Dec 2021 00:33:40 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 13 Dec 2021 02:09:07 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 13 Dec 2021 02:09:07 GMT

GET
H/1.1 200
OK facebook.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 98ms
35ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/facebook.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "7eb7015574801089503dd7095e1d4313:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1254

GET
H/1.1 200
OK google-plus.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 108ms
45ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/google-plus.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "eedd0b2cde10b6b1930d57a10c6d0422:1612322629.149034"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1653

GET
H/1.1 200
OK linkedin.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 104ms
43ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/linkedin.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "6789b034de6591b26bbd9b5fa6b451ca:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1416

GET
H/1.1 200
OK email.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 1 KB
2 KB 141ms
51ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/email.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "15f1e1004accdbc019365e658249f334:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1407

GET
H/1.1 200
OK rss.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 128ms
38ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/rss.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "8cc18e3677ea53cc679e33e82bf9497a:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1620

GET
H/1.1 200
OK twitter.gif
sc1.checkpoint.com/sc1/inc/html/images/social/ 2 KB
2 KB 144ms
54ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/social/twitter.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "6b05f4fc9522afa0cdbeb1a2c0bccc2c:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1608

GET
H/1.1 200
OK check-point-research-logo.gif
sc1.checkpoint.com/sc1/inc/html/images/ 3 KB
3 KB 97ms
91ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/check-point-research-logo.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 09 Jul 2018 21:15:16 GMT
Server: AkamaiNetStorage
ETag: "c425f4400a5c9dfbaecb24275f494931:1531172224"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 2901

GET
H3 200 under-attack.gif
research.checkpoint.com/wp-content/themes/research/img/lib/ 458 B
831 B 120ms
119ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/themes/research/img/lib/under-attack.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
age: 2954991
cf-polished: origFmt=gif, origSize=1666
content-disposition: inline; filename="under-attack.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 458
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
etag: "5dc49a64-682"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba6061d791887-MAN
cf-bgj: imgq:100,h2pri

GET
H3 200 email-decode.min.js Show response
research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
937 B 30ms
30ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://research.checkpoint.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

QUIC, , AES_128_GCM

Server

141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 08 Dec 2021 16:45:16 GMT
server: cloudflare
etag: W/"61b0e11c-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 6bcba605ed5a1887-MAN
vary: Accept-Encoding
expires: Wed, 15 Dec 2021 02:09:07 GMT

GET
H2 200 sharethis.js Show response
platform-api.sharethis.com/js/ 184 KB
41 KB 59ms
16ms Script
text/javascript 13.224.96.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://platform-api.sharethis.com/js/sharethis.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.103 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-224-96-103.zrh50.r.cloudfront.net

Software

Resource Hash

444ee2a405e57ede9ef10e17bb58c0351c39e9d21203f242b55a77fd07d30784

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:07:48 GMT
content-encoding: gzip
vary: Accept-Encoding
age: 79
etag: W/"2df1b-sQ5Sn/JpfKxrQLYebTQ3d0yXV0s"
x-frame-options: SAMEORIGIN
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
via: 1.1 f0f5607a03d2ae4c43b553dc2cef0c9e.cloudfront.net (CloudFront)
edge-control: cache-maxage=60m,downstream-ttl=60m
cache-control: max-age=600, public
x-amz-cf-pop: ZRH50-C1
strict-transport-security: max-age=31536000; includeSubDomains
x-amz-cf-id: HFq6xqm-XuupveWdbCnJ-OLA4f9gctsOr1VIAi_eg9oXf3FCjonrEg==

GET
H3 200 CfP_1021x580_A.jpg
research.checkpoint.com/wp-content/uploads/2018/11/ 127 KB
128 KB 92ms
91ms Image
image/jpeg 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2018/11/CfP_1021x580_A.jpg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba8d88ea5f494982cae457a29fd31a03869293680fbf2cf1b17138b8c48d6b69

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
age: 20181997
cf-polished: origSize=134980, status=webp_bigger
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 130331
last-modified: Thu, 07 Nov 2019 22:27:41 GMT
server: cloudflare
etag: "5dc49a5d-20f44"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba6061d7a1887-MAN
cf-bgj: imgq:100,h2pri

GET
H3 200 enlighterjs.min.js Show response
research.checkpoint.com/wp-content/plugins/enlighter/cache/ 57 KB
17 KB 42ms
41ms Script
application/javascript 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/plugins/enlighter/cache/enlighterjs.min.js?ver=TJ0/7+iAWMKbDKS
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 15 Feb 2021 20:35:46 GMT
server: cloudflare
age: 20192057
etag: W/"602adb22-e33f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 6bcba6060d751887-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 79ms
31ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.8.2
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 55b4a8ebd4ce4144242d6bb9d0ebb65a01b2759e67243ed5badc3ac96c6fd396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 870
etag: W/"2d763adca2b6a93c45e5b76bff1f8c5d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6bcba6065b31839d-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 16 Dec 2021 02:09:07 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 253 KB
73 KB 67ms
40ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

787a1ead7327243569f14b82fdfecfdfc2533b17a2bc212a93b367c81d77e77e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74513
x-xss-protection: 0
last-modified: Mon, 13 Dec 2021 00:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 13 Dec 2021 02:09:07 GMT

GET
H/1.1 200
OK search-icon.gif
sc1.checkpoint.com/sc1/inc/html/images/ 2 KB
2 KB 41ms
40ms Image
image/gif 104.111.231.109
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sc1.checkpoint.com/sc1/inc/html/images/search-icon.gif
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/header/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.231.109 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-231-109.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Last-Modified: Mon, 25 Sep 2017 18:13:31 GMT
Server: AkamaiNetStorage
ETag: "2e1aa25e7e77e6a393fd38efb413370f:1506366539"
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Content-Length: 1755

GET
H3 200 34CA47_6_0.woff2
research.checkpoint.com/wp-content/themes/research/fonts/ 58 KB
58 KB 52ms
52ms Font
font/woff2 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL: https://research.checkpoint.com/wp-content/themes/research/fonts/34CA47_6_0.woff2
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.29
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b

Request headers

Referer: https://research.checkpoint.com/wp-content/themes/research/style.css?ver=1.29
Origin: https://research.checkpoint.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
last-modified: Thu, 07 Nov 2019 22:27:48 GMT
server: cloudflare
age: 50919
etag: "5dc49a64-e890"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba6062d831887-MAN
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 59536

GET
H3 200 CPR_blog_article_07_12.jpg
research.checkpoint.com/wp-content/uploads/2021/12/ 215 KB
215 KB 49ms
48ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2021/12/CPR_blog_article_07_12.jpg
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e84c10c157e2274814bccf7475c42275d2f5dfdfaacfd7070510034bfccecbb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
age: 398919
cf-polished: origFmt=jpeg, origSize=481704
content-disposition: inline; filename="CPR_blog_article_07_12.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 219746
last-modified: Tue, 07 Dec 2021 19:02:43 GMT
server: cloudflare
etag: "61afafd3-759a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba606ade61887-MAN
cf-bgj: imgq:100,h2pri

GET
H3 200 Trickbot-victims-abs.png
research.checkpoint.com/wp-content/uploads/2021/12/ 4 KB
4 KB 77ms
76ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2021/12/Trickbot-victims-abs.png
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dc03d7d27d7a8aea9c3adae49b9c60179da40637b907e08be97cae8428edfa20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=45648
content-disposition: inline; filename="Trickbot-victims-abs.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 3722
last-modified: Wed, 08 Dec 2021 07:44:29 GMT
server: cloudflare
etag: "61b0625d-b250"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba606ade71887-MAN
cf-bgj: imgq:100,h2pri

GET
H3 200 2.png
research.checkpoint.com/wp-content/uploads/2021/12/ 13 KB
13 KB 77ms
76ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2021/12/2.png
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d4dd6f74048362b427d4bb83d6cd9364dd4a2451c1caf482be84ec54a79fac9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=31356
content-disposition: inline; filename="2.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 13190
last-modified: Tue, 07 Dec 2021 11:21:52 GMT
server: cloudflare
etag: "61af43d0-7a7c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba606ade81887-MAN
cf-bgj: imgq:100,h2pri

GET
H3 200 3.png
research.checkpoint.com/wp-content/uploads/2021/12/ 3 KB
3 KB 78ms
77ms Image
image/webp 141.193.213.20
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://research.checkpoint.com/wp-content/uploads/2021/12/3.png
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 141.193.213.20 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: efd598dd7ed5344fcd7bf5c92b1e5743915899137ea95901e634212a41fc2b68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
cf-cache-status: HIT
cf-polished: origFmt=png, origSize=10930
content-disposition: inline; filename="3.webp"
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2828
last-modified: Tue, 07 Dec 2021 11:23:27 GMT
server: cloudflare
etag: "61af442f-2ab2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cf-ray: 6bcba606ade91887-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 5a3031770f16c70012a3c297.js Show response
buttons-config.sharethis.com/js/ 525 B
922 B 174ms
120ms Script
text/javascript 2600:9000:2190:2c00:c:abe:f440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://buttons-config.sharethis.com/js/5a3031770f16c70012a3c297.js

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2c00:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
via: 1.1 a06cb72e779e366fcd004926eacd5b85.cloudfront.net (CloudFront)
last-modified: Tue, 12 Dec 2017 19:43:54 GMT
server: AmazonS3
x-amz-cf-pop: ZRH50-C1
etag: "29c30155cdf2eaa96943948b94d537b6"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: max-age=60,public
accept-ranges: bytes
content-length: 525
x-amz-cf-id: g3wryZg3jNwE4pNhld3P1fY6ItwacDJ2tFgfvxYQAxkHGQ8BbAJRKA==

GET
H/1.1 204
No Content pview Show response
l.sharethis.com/ 0
410 B 51ms
11ms XHR
text/plain 18.198.109.212
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://l.sharethis.com/pview?event=pview&hostname=research.checkpoint.com&location=%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&product=sticky-share-buttons&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research&cms=unknown&publisher=5a3031770f16c70012a3c297&sop=true&version=st_sop.js&lang=en&description=Research%20by%3A%20Raman%20Ladutska%2C%20Aliaksandr%20Trafimchuk%2C%20David%20Driker%2C%20Yali%20Magiel%20Overview%20Trickbot%20and%20Emotet%20are%20considered%20some%20of%20the%20largest%20botnets%20in%20history.%20They%20both%20share%20a%20similar%20story%3A%20they%20were%20taken%20down%20and%20made%20a%20comeback.%20Check%20Point%20Research%20(CPR)%20observed%20Trickbot%E2%80%99s%20activities%20after%20the%20takedown%20operation%20and%20recently%20noticed%20it%20started%20to%20spread...%20Click%20to%20Read%20More

Requested by

Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.198.109.212 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-198-109-212.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Strict-Transport-Security: max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Expose-Headers: stid
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1728000
Connection: keep-alive
Access-Control-Allow-Headers: *

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 48ms
28ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=5.8.2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ba83c227cde7d4c34fb514ccd483305e8dfef365e6b2b70a126f2d73adaa1691

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 789
etag: W/"bac537a7eba0b66473f70a7a4bf837c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6bcba60729d83752-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 16 Dec 2021 02:09:07 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 27 KB
9 KB 83ms
19ms Script
application/javascript 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 8575
Pragma: no-cache
Last-Modified: Thu, 07 Oct 2021 17:17:43 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615f2bb7-6a5f"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Mon, 13 Dec 2021 02:09:07 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 46ms
13ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4081
date: Mon, 13 Dec 2021 01:01:06 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Mon, 13 Dec 2021 03:01:06 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
447 B 71ms
20ms XHR
text/plain 2a00:1450:400c:c08::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-194688-3&cid=1687260925.1639361348&jid=374865125&gjid=1652731149&_gid=476371934.1639361348&_u=YGBAgEABAAAAAE~&z=927413127

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://research.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Mon, 13 Dec 2021 02:09:07 GMT
content-type: text/plain
access-control-allow-origin: https://research.checkpoint.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 22ms
7ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1915424533&t=pageview&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&ul=en-us&de=UTF-8&dt=When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEAB~&jid=374865125&gjid=1652731149&cid=1687260925.1639361348&tid=UA-194688-3&_gid=476371934.1639361348&gtm=2wgc105JCRGP&z=561063312

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Dec 2021 10:54:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54862
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 3 KB
2 KB 370ms
360ms Script
text/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/3ba17c77-81bb-4a83-8917-7b62de3d6e22/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09de3245965e90dfc9ac24b906c86c1025768ad5e347361145a48c36448a7ab8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
status: 200 OK
x-envoy-upstream-service-time: 52
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 2babcc49-8188-415e-9318-fcd5da3193a4
x-runtime: 0.050618
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"09de3245965e90dfc9ac24b906c86c10"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 6bcba607ec46839d-MXP
access-control-allow-headers: SDK-Version
expires: Mon, 13 Dec 2021 03:09:08 GMT

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
697 B 58ms
14ms XHR
application/json 185.33.220.242
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.242 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

724.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Dec 2021 02:09:07 GMT
X-Proxy-Origin: 194.36.108.22; 194.36.108.22; 724.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5afa0b47-7081-45c6-bf04-8a986f62c418
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://research.checkpoint.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
379 B 68ms
18ms XHR
text/plain 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-233-140.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b57b08b644c46020873648d2ef72bcedb87ba742cb0823e6bf62480f8f51f6d9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:07 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://research.checkpoint.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 twitter.svg
platform-cdn.sharethis.com/img/ 731 B
1 KB 59ms
12ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/twitter.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 08 Dec 2021 03:10:35 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 428313
etag: "0af2fb38987598376c99e21af17ade45"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 731
x-amz-cf-id: axSBV408fvbpADzjNhosG3CFK3kPpkhBBZIP8ZJghtwMbaMMhzlHVw==

GET
H2 200 whatsapp.svg
platform-cdn.sharethis.com/img/ 832 B
1 KB 59ms
13ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/whatsapp.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 17 Nov 2021 00:58:56 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 2250612
etag: "afe7fc60ed757db39a88d2950fce69c9"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 832
x-amz-cf-id: pjAbdrcLddxfgZbC8Xs5qiv1nh0tmW2zuxHGpp1vFjQONo9ZdxVOaA==

GET
H2 200 facebook.svg
platform-cdn.sharethis.com/img/ 301 B
726 B 59ms
14ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/facebook.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sun, 05 Dec 2021 03:40:43 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 685705
etag: "c6e9be45643e197ce1db1d7e24a99adc"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 301
x-amz-cf-id: zK4iAJeOwyJqUpJFOhY2Gsm81HwT6UKXyJZKJO3bZlDwcYXMaEGdtA==

GET
H2 200 linkedin.svg
platform-cdn.sharethis.com/img/ 456 B
881 B 60ms
14ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/linkedin.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 20 Nov 2021 03:16:18 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 1983170
etag: "fa43b4ede18498b114fc7185993f6da7"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 456
x-amz-cf-id: EIlTQP1facxRy1zlw3_hIfycNI25M3o5UmZ8RLLjZU2_jVIup4kFHw==

GET
H2 200 email.svg
platform-cdn.sharethis.com/img/ 343 B
770 B 59ms
14ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/email.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Tue, 16 Nov 2021 01:54:40 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 2333668
etag: "5977437466e857c7ddcadda6f6d88c2a"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 343
x-amz-cf-id: eAD99uiBqXS9jeSC4NKG7upZnXsDy29vVhxPYtBFhW8YPwJXEj9W-Q==

GET
H2 200 pinterest.svg
platform-cdn.sharethis.com/img/ 771 B
1 KB 59ms
15ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/pinterest.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 06 Dec 2021 05:36:56 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 592332
etag: "2b10a062e719c64b686e2e8fcdc216dc"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 771
x-amz-cf-id: p9YPtHasRtkI7T_NhCVxJaN0CVTEWFhORhAZUo9af3zjjZ4sKx_nnA==

GET
H2 200 sharethis.svg
platform-cdn.sharethis.com/img/ 514 B
939 B 19ms
12ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/sharethis.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 19 Nov 2021 17:18:09 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 2019059
etag: "deecdaa377907db5cc1722fc831670a1"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 514
x-amz-cf-id: N7gxqhMll5Q_3ZZZDT2yNy-Tt1xPA-hwDnejUdXlSU2B7-oa8XnX5Q==

GET
H2 200 reddit.svg
platform-cdn.sharethis.com/img/ 910 B
1 KB 20ms
13ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/reddit.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Fri, 03 Dec 2021 21:48:25 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:13 GMT
server: AmazonS3
age: 793243
etag: "78d796ca648d8a5e665b48ed0217c56a"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 910
x-amz-cf-id: 0ehfJYRi-oEUhmVinDHfuOgWjP9DU6YZwtEvlY9gUHUj1XmkTzpLoA==

GET
H2 200 arrow_left.svg
platform-cdn.sharethis.com/img/ 565 B
990 B 20ms
14ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/arrow_left.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Wed, 08 Dec 2021 08:34:56 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 408852
etag: "b55d8d2b9321e381a3c38a4bddb74037"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 565
x-amz-cf-id: yy3ssCV1ur6z_Pc1fZc6MOfVAsAYTzan3Y8DPDIJdNJztONqbKe7RQ==

GET
H2 200 arrow_right.svg
platform-cdn.sharethis.com/img/ 565 B
989 B 21ms
14ms Image
image/svg+xml 2600:9000:2190:2e00:1d:85c3:6640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://platform-cdn.sharethis.com/img/arrow_right.svg

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2190:2e00:1d:85c3:6640:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 27 Nov 2021 06:08:00 GMT
via: 1.1 666ff4ad81b3b60af3d2241160893ee3.cloudfront.net (CloudFront)
last-modified: Thu, 10 Oct 2019 01:20:12 GMT
server: AmazonS3
age: 1368068
etag: "9928d025bd5792b718ee0a185f62e67c"
strict-transport-security: max-age=31536000; includeSubDomains
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public, max-age=2592000
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-length: 565
x-amz-cf-id: EjsE15JM6oi8tTzJbyb9Bc9hWZQiQ2mOP8prKk9BrBnzv_5pZQq0Cg==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 44ms
19ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1687260925.1639361348&jid=374865125&_u=YGBAgEABAAAAAE~&z=143712187

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Dec 2021 02:09:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 43ms
19ms Image
image/gif 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-194688-3&cid=1687260925.1639361348&jid=374865125&_u=YGBAgEABAAAAAE~&z=143712187

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Dec 2021 02:09:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 258ms
196ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=null&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A07%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 details Show response
epsilon.6sense.com/v3/company/ 2 KB
1 KB 818ms
801ms XHR
application/json 35.158.71.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Requested by: Host: j.6sc.co
URL: https://j.6sc.co/6si.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.71.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-71-178.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bfdf771a88510602e591de3b4f605bbc87b53800129f5dee8d926a66da8328c0

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Referer: https://research.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
Authorization: Token 87c67a7c5a9e9b4dd1824f6727ed4e43fadadde4
EpsilonCookie: 36bb1002af0b000043abb661fa020000454f0e00

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://research.checkpoint.com
access-control-allow-credentials: true
content-length: 897

OPTIONS
H2 200 details
epsilon.6sense.com/v3/company/ Frame 0
0 45ms
10ms Preflight 35.158.71.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://epsilon.6sense.com/v3/company/details
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.71.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-71-178.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization,epsiloncookie
Origin: https://research.checkpoint.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 13 Dec 2021 02:09:07 GMT
server: nginx
access-control-allow-origin: https://research.checkpoint.com
access-control-allow-credentials: true
access-control-max-age: 1800
access-control-allow-methods: OPTIONS,GET
access-control-allow-headers: authorization,epsiloncookie

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 5 KB
2 KB 58ms
14ms Script
application/x-javascript 2a02:26f0:6c00::210:ba20
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00::210:ba20 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Sep 2021 19:17:49 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=38026
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2036

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 14 KB
6 KB 36ms
7ms Script
application/javascript 151.101.12.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5JCRGP
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: gzip
last-modified: Mon, 20 Sep 2021 23:58:10 GMT
etag: "8dc11b7ca1d5ed9ec3b1ab1beb621c75+gzip+gzip"
vary: Accept-Encoding,Host
x-tw-cdn: FT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache
x-cache: HIT, HIT
accept-ranges: bytes
content-type: application/javascript; charset=utf-8
content-length: 5410
x-served-by: cache-iad-kiad7000020-IAD, cache-fra19143-FRA

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 73ms
19ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 29 Oct 2021 01:24:07 GMT
Server: AkamaiNetStorage
ETag: "461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 753

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
26 KB 27ms
7ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 25965
x-xss-protection: 0
pragma: public
x-fb-debug: 9MW09wF24qaPcNSpriEJ7j2R1zl4U6Y+70KcYWvy0FUkGlexevzQ9MVbVOuzCkmX3zPYl1yCONSY5Wh6SGRoJQ==
x-fb-trip-id: 917726464
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Mon, 13 Dec 2021 02:09:08 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 24ms
24ms Stylesheet
text/css 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 853
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=259200
cf-ray: 6bcba60a6b843752-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 16 Dec 2021 02:09:08 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
675 B 153ms
121ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=066d6952-a4a9-4645-9e0a-17c26cdd5694&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&tpx_cb=twttr.conversion.loadPixels

Requested by

Host: static.ads-twitter.com
URL: https://static.ads-twitter.com/uwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 57
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Mon, 13 Dec 2021 02:09:08 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: d35c4709fa66eb35d9f724a6efc85980ea338c1f8b68aa987dadcd9e1f332c13
x-transaction: 3fb75325a3dbe295
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
470 B 158ms
119ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=2.0.4&p_id=Twitter&p_user_id=0&txn_id=nxi3o&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&event_id=066d6952-a4a9-4645-9e0a-17c26cdd5694&tw_document_href=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 111
pragma: no-cache
last-modified: Mon, 13 Dec 2021 02:09:08 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 5480f2a9392a5edfdca92c42edd60f41de5528c70b81f203c69198e35fa88170
x-transaction: c0b698e7e9b03a84
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3 200 1692853834349189 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 159ms
149ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1692853834349189?v=2.9.48&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f69f074cc1ecce0a1c4d713e7d4f1a4460f6fe600100330fcb2418881e710d79

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
x-xss-protection: 0
pragma: public
x-fb-debug: jsrnO02qecJcurYSjL9r3K2AnrRSm2tkl00PAItnLuzfiGByL1Q1T7nh6++1tDPJbxGwRdrpuz6VO2LMLIn+Pw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Mon, 13 Dec 2021 02:09:08 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D51830%26time%3D1639361348261%26url%3Dhttps%253A%252F%252Fresearch.checkpoint.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&l...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&...

0
155 B

373ms
164ms

Image
application/javascript

108.174.10.14
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&liSync=true&e_ipv6=AQL82I1vqJ0ZeAAAAX2xjQPfwYJgYdTYE2cWbuQVcr88WikQUSqtZqCKmenJJcfG_Lf2aCx8
Protocol: H2
Server: 108.174.10.14 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS: 108-174-10-14.fwd.linkedin.com
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lva1
x-li-proto: http/2
x-li-pop: prod-lva1
content-type: application/javascript
content-length: 0
x-li-uuid: 52bLCnYuwBagWUoAjysAAA==

Redirect headers

date: Mon, 13 Dec 2021 02:09:08 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 6AA62AD9BFC74D92B86E77307FF6073C Ref B: FRAEDGE0712 Ref C: 2021-12-13T02:09:08Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=51830&time=1639361348261&url=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&liSync=true&e_ipv6=AQL82I1vqJ0ZeAAAAX2xjQPfwYJgYdTYE2cWbuQVcr88WikQUSqtZqCKmenJJcfG_Lf2aCx8
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXS/Y7W9ucqut/eO+UIjA==

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/ 176 B
612 B 318ms
301ms Fetch
application/json 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/3ba17c77-81bb-4a83-8917-7b62de3d6e22/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151510

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
status: 200 OK
x-envoy-upstream-service-time: 7
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 3f8193bf-9623-4368-adab-509592a99060
x-runtime: 0.006241
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"57e48df5586242df165fa8424ae8cb9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 6bcba60ac82a4ec7-FRA
access-control-allow-headers: SDK-Version

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 19ms
19ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Wed, 23 Mar 2022 02:09:08 GMT

POST
H/1.1 200
OK visitWebPage
750-dqh-528.mktoresp.com/webevents/ 2 B
311 B 571ms
94ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://750-dqh-528.mktoresp.com/webevents/visitWebPage?_mchNc=1639361348307&_mchCn=&_mchId=750-DQH-528&_mchTk=_mch-checkpoint.com-1639361348306-60344&_mchHo=research.checkpoint.com&_mchPo=&_mchRu=%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://research.checkpoint.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 0ecf16aa-1fd1-4f77-a434-73223d403e1d

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 26ms
7ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=PageView&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&rl=&if=false&ts=1639361348444&sw=1600&sh=1200&v=2.9.48&r=stable&ec=0&o=30&fbp=fb.1.1639361348443.630306060&it=1639361348250&coo=false&exp=p1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Mon, 13 Dec 2021 02:09:08 GMT

GET
H2 200 7ec0ceb7-c110-40e8-9782-73562b05b110.gif
img.onesignal.com/t/ 3 KB
3 KB 482ms
471ms Image
image/gif 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.onesignal.com/t/7ec0ceb7-c110-40e8-9782-73562b05b110.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:09 GMT
cf-cache-status: REVALIDATED
x-amz-request-id: DJ1W3EES2WJV240S
x-amz-meta-cache-control: public, maxage=604800
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 2901
x-amz-id-2: atLrHJIKsEkfN1rIviBMkOpyszLCxvrtFwvhSYPlSIhJ9wrCrTmuEWUCF0iuZs/ptbpvRAg5t8g=
last-modified: Mon, 26 Aug 2019 20:17:26 GMT
server: cloudflare
etag: "c425f4400a5c9dfbaecb24275f494931"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
cache-control: public, max-age=2678400
accept-ranges: bytes
cf-ray: 6bcba60ccf40839d-MXP
expires: Thu, 13 Jan 2022 02:09:09 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ 15 KB
16 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://research.checkpoint.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 08 Dec 2021 01:54:06 GMT
x-content-type-options: nosniff
age: 432902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 08 Dec 2022 01:54:06 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 8ms
7ms Image
image/gif 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1915424533&t=event&ni=1&_s=1&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&ul=en-us&de=UTF-8&dt=When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=6si_company_details&ea=6si_data_loaded&_u=aGDAgEABAAAAAE~&jid=&gjid=&cid=1687260925.1639361348&tid=UA-194688-3&_gid=476371934.1639361348&gtm=2wgc105JCRGP&cd9=Credit%20Suisse&cd10=credit-suisse.com&cd11=Financial%20Services&cd12=10%2C000%2B&cd13=Quantum_BO%2C2%2B%20Engagements%20Past%2030%20Days%20DO%20NOT%20TOUCH%2C3%2B%20Engagements%20Past%2030%20Days%2CWW%20%2F%2F%20Bombora%20Keyword%20%2F%2F%20Open%20Web%20Application%20Security%20Project%20(OWASP)%20%2F%2F%207%20Days%2CQuantum_BO_20211118_2_DO_NOT_TOUCH%2CWW%20%2F%2F%20Bombora%20Keyword%20%2F%2F%20Remote%20Access%20%2F%2F%207%20Days%2C1%2B%20Engagements%20Past%2030%20Days%20DO%20NOT%20TOUCH%2CQuantum_BO_20211122_1_DO_NOT_TOUCH%2CHarmony_BO_20210816_DO_NOT_TOUCH%2C2%2B%20Engagements%20Past%2030%20Days%2C1%2B%20Engagements%20Past%2030%20Days%2CWW%20%2F%2F%20Bombora%20Keyword%20%2F%2F%20Cloud%20Compliance%20%2F%2F%207%20Days%2CBuying%20Stage%203%3A%20Decision%20-%20SC%2CQuantum_BO_20211130_1_DO_NOT_TOUCH%2CBuying%20Stage%201%3A%20Awareness%20-%20SC%2C3%2B%20Engagements%20Past%2030%20Days%20DO%20NOT%20TOUCH%2CQuantum_BO_20211203_1_DO_NOT_TOUCH%2CMcafee%203.22&cd14=%245B%2B&cd16=47860&cd17=United%20States&z=1147333058

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 12 Dec 2021 10:54:45 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 54863
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 196ms
196ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A08%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A07%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%221002%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:08 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 17ms
8ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1692853834349189&ev=Microdata&dl=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&rl=&if=false&ts=1639361348948&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%2C%22meta%3Adescription%22%3A%22Latest%20Research%20by%20our%20Team%22%7D&cd[OpenGraph]=%7B%22og%3Alocale%22%3A%22en_US%22%2C%22og%3Atype%22%3A%22article%22%2C%22og%3Atitle%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%2C%22og%3Adescription%22%3A%22Research%20by%3A%20Raman%20Ladutska%2C%20Aliaksandr%20Trafimchuk%2C%20David%20Driker%2C%20Yali%20Magiel%20Overview%20Trickbot%20and%20Emotet%20are%20considered%20some%20of%20the%20largest%20botnets%20in%20history.%20They%20both%20share%20a%20similar%20story%3A%20they%20were%20taken%20down%20and%20made%20a%20comeback.%20Check%20Point%20Research%20(CPR)%20observed%20Trickbot%E2%80%99s%20activities%20after%20the%20takedown%20operation%20and%20recently%20noticed%20it%20started%20to%20spread...%20Click%20to%20Read%20More%22%2C%22og%3Aurl%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F%22%2C%22og%3Asite_name%22%3A%22Check%20Point%20Research%22%2C%22article%3Apublished_time%22%3A%222021-12-08T10%3A58%3A48%2B00%3A00%22%2C%22og%3Aimage%22%3A%22https%3A%2F%2Fresearch.checkpoint.com%2Fwp-content%2Fuploads%2F2021%2F12%2FCPR_blog_article_07_12.jpg%22%2C%22og%3Aimage%3Awidth%22%3A%221021%22%2C%22og%3Aimage%3Aheight%22%3A%22580%22%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.48&r=stable&ec=1&o=30&fbp=fb.1.1639361348443.630306060&it=1639361348250&coo=false&es=automatic&tm=3&exp=p1&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 13 Dec 2021 02:09:08 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
priority: u=3,i
expires: Mon, 13 Dec 2021 02:09:08 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 198ms
198ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A09%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A08%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:09 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 194ms
194ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A10%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A09%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%223004%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:10 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 194ms
194ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A11%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A10%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%224005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:11 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 200ms
200ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A12%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A11%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225006%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:12 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 wxbvs5zxy7iy.js Show response
js.driftt.com/include/1639361400000/ 218 KB
62 KB 219ms
167ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/include/1639361400000/wxbvs5zxy7iy.js

Requested by

Host: research.checkpoint.com
URL: https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dd7da6e06a4f7997ad3f918923972a7d96c6dd23ca13f7f107b7cc45da665c98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-amz-version-id: u58N0IePXF4zgvTcAmP2FC5hZNVh2rOw
content-encoding: gzip
etag: W/"161509ac8f95f2ef92923d56adfb8a62"
x-amz-cf-pop: ZRH50-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:51:02 GMT
server: nginx
date: Mon, 13 Dec 2021 02:09:13 GMT
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript; charset=utf-8
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: c0VjHd5tNL1ALpN3QEyWFMOJcrtnPW-gH4nQgV7lc85bhsjgkGdKzg==

GET
H2 200 core Show response
js.driftt.com/ Frame E105 2 KB
1 KB 325ms
324ms Document
text/html 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1639361400000/wxbvs5zxy7iy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

679f94121a8eef76a85fd8f18c08770809552ffee58555121d61da7b0366e59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Thu, 09 Dec 2021 14:50:49 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 2v..twk4cQPvekhnKmFaMEAW5KagGTbP
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 13 Dec 2021 02:09:13 GMT
cache-control: no-cache
etag: W/"1d841d2e0fe94962df0c78e6969a5716"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: Rrq41alOJWySJtedPlYMZ8bnfF9MmS9J6WAg4zysJHoD2jwm0xl9ww==

GET
H2 200 chat Show response
js.driftt.com/core/ Frame 7B13 2 KB
1 KB 119ms
118ms Document
text/html 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/include/1639361400000/wxbvs5zxy7iy.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

679f94121a8eef76a85fd8f18c08770809552ffee58555121d61da7b0366e59b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/

Response headers

content-type: text/html; charset=utf-8
server: nginx
last-modified: Thu, 09 Dec 2021 14:50:49 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: 2v..twk4cQPvekhnKmFaMEAW5KagGTbP
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Mon, 13 Dec 2021 02:09:13 GMT
cache-control: no-cache
etag: W/"1d841d2e0fe94962df0c78e6969a5716"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
x-amz-cf-pop: ZRH50-C1
x-amz-cf-id: 2dPNlrT6IdAok7nCW7iPMdrWNJAC1MKk2ygppiZvDrx6YYSjxnLkWQ==

GET
H2 200 runtime~main.a6344017.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 6 KB
3 KB 16ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f27be3c0e561adce25bf4f49eeb96763d5e9d8710210198867970df0501e57cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:24 GMT
server: nginx
etag: W/"696f53bfdee61fb2778728d5ce81c78b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: z7L1_ygvVW_.r5TcSEKIrr6uxCpFws_h
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rLqMGbXMgjwuD4aDyOAbTLK7pVOEBJbVZ7Z5v7_tWSgJ5ClL6ZkjJQ==

GET
H2 200 4.a93e53d9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 58 KB
20 KB 17ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 11083016
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:25 GMT
server: nginx
etag: W/"fce0b3daf28dfa888be2818f43b06ef0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: jYPm_Z34ZvZ_N_L4Zf-6tty4YILRyJTmgKd-TVDTm7n0F5kCqvbQWw==

GET
H2 200 main~493df0b3.580db5ef.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 6 KB
3 KB 17ms
17ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 06:03:57 GMT
content-encoding: gzip
age: 4219516
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:07:00 GMT
server: nginx
etag: W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9m2yGImcuCx0B2XygfVHSg2DRnUvpr3be0ihm_d6Br52GN_L1nTorA==

GET
H2 200 42.3b1c2441.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 47 KB
14 KB 15ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:54:58 GMT
content-encoding: gzip
age: 3626055
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:08 GMT
server: nginx
etag: W/"62fe06940598a98760a9eae46800ff59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: sdL5HsKjbatAG-IrkkeEM0cCK6BTQkvzOnIU7lTpjn0boZrURyV5nw==

GET
H2 200 17.cce21c2a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 44 KB
13 KB 16ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:54:58 GMT
content-encoding: gzip
age: 3626055
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:07 GMT
server: nginx
etag: W/"565bf690dc82ce7e1f45c9647d892490"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: rQn_Dd6HzAvzSTKRnUMPXAXsFpdPVY9XsIXoZVh3bNlFydoeLElydA==

GET
H2 200 35.3e4eba7e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 25 KB
8 KB 16ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 06 Nov 2021 02:57:28 GMT
content-encoding: gzip
age: 3193905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Nov 2021 15:09:54 GMT
server: nginx
etag: W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rVOZxkkH0Vnn22xeEPRRFzkcE.ar0yRa
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DsvmoH2du1rz4LMdt4f6ZZb5LwKxzud5BTThKBAEp2uczqEHUT6-ug==

GET
H2 200 15.8065fdbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 16 KB
5 KB 17ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 06:18:05 GMT
content-encoding: gzip
age: 8452268
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 03 Sep 2021 14:38:32 GMT
server: nginx
etag: W/"db60664de2c8d54d23e359c94e68f6ce"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ToHhTP2S5NTTtYO-lUEA2gxMj4jKFyN-TxUN6CBeBIBaDQBPd4y4UQ==

GET
H2 200 19.5937a5b2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 72 KB
22 KB 18ms
17ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:55:04 GMT
content-encoding: gzip
age: 3626049
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:07 GMT
server: nginx
etag: W/"08aceb94bd26b0e431ca437d628e3c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: XWTFuehDnk11DcwrGsedRff80e2j1Moq0N7pPNJtr1txoN7YHtLGtA==

GET
H2 200 32.04864e7d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 16 KB
6 KB 18ms
17ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:58 GMT
server: nginx
etag: W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: juigjv2.842khaDjrzqiMoucoadLCjYk
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: LCwAR2GlE6F4QjSq4njc65kQN_H_p_n3FdzwFqM-bcwokdlgrfdp-w==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 59 KB
19 KB 22ms
21ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 01:41:23 GMT
content-encoding: gzip
age: 1124869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 29 Nov 2021 22:20:10 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Bes4ojoExyGtogevsaG2vPPgIGz3MINt
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: VhAsSSy3U2eyd7WpMwFb29frXfx-dci6tkdi20zkCjyHk4FTieucKg==

GET
H2 200 10.704ab67c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 91 KB
28 KB 23ms
22ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 20:47:44 GMT
content-encoding: gzip
age: 6240088
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 01 Oct 2021 18:06:47 GMT
server: nginx
etag: W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: r_zEt_drPON5VUEfK3dbyLmon0ud_T-ZjCk_W3m_n6EuJb7q3GFmiQ==

GET
H2 200 9.cea5327f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 24 KB
7 KB 24ms
23ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 15:01:38 GMT
content-encoding: gzip
age: 1076855
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 29 Nov 2021 22:20:12 GMT
server: nginx
etag: W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: SVtTLwbeoEoB3N8kFg7W12fQuW0BwsMuq9OT9umlVdlex0adxc16PA==

GET
H2 200 13.c2156fc2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 62 KB
20 KB 24ms
23ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:58 GMT
server: nginx
etag: W/"b94404e76324bd4454531b2e0a54f7bb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 2G8N1w1t_r6Mqd9hBlKbUK0K_XipY25UxsiO1yY8ZIp9R0j9QxeP9w==

GET
H2 200 40.01f4f7b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 105 KB
34 KB 25ms
24ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:59 GMT
server: nginx
etag: W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 3CUcQ7aFRKt6UiY4Z-CV6AhOMF2CG26op0RhdHO0ea3DsTg6Ce9Yuw==

GET
H2 200 33.c1910d43.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 12 KB
4 KB 28ms
27ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:05:25 GMT
content-encoding: gzip
age: 8449428
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 03 Sep 2021 14:38:33 GMT
server: nginx
etag: W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: x9xPxe0FOgEjzVEWwoqmEw_u_0f8UbkY
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: FQULn6rQbV-ck2pg-V8-peZBAUl1wJApw0z8NniTuevfJByDO5b2BQ==

GET
H2 200 25.b7a0bf53.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 12 KB
5 KB 28ms
27ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 03:18:04 GMT
content-encoding: gzip
age: 1637469
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 22 Nov 2021 19:33:19 GMT
server: nginx
etag: W/"808f7c7829001881a39cef6846a36ce0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6o8JokTX9EzWUc1WBkJjkxP5xIiNXEWf3MDMelb2-DRpjnG0plxjgw==

GET
H2 200 16.fab21cf4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 17 KB
7 KB 28ms
27ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 04 Nov 2021 16:58:47 GMT
content-encoding: gzip
age: 3316226
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Nov 2021 13:47:23 GMT
server: nginx
etag: W/"b451093ecfaa012f364641010ed13346"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: lIgB5rFL4MFbuGA-vSA6p-SCJx5VmSvzVvDJuHoB8zfhyPtfeJ5GkQ==

GET
H2 200 7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 11 KB
3 KB 28ms
27ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/7.30af169a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 18:28:20 GMT
content-encoding: gzip
age: 3570053
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 01 Nov 2021 17:24:54 GMT
server: nginx
etag: W/"bd798c00af88b7523deb5a8065993250"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kXDXf4t_oYbMcyUqMFmqEdiUcICzbAVLj9huW9-W3wLFqlmAGLt9lA==

GET
H2 200 7.892db701.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 69 KB
22 KB 28ms
27ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/7.892db701.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a85e6cc00b6521151a066190dfa2f0983135171fbc1845b0acfe09fddb245a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:53 GMT
server: nginx
etag: W/"59ff575cde5cbc57af07ef742efe8a77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6L5P_vHWmZADGUWpRUkNwqrHbIkXu6n5
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: s1K80E0ACSu1C-MpFE-gyyOUgp9Z77BoV2d8FdapS_XuNo1r_iVnAg==

GET
H2 200 14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 24 B
667 B 28ms
27ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
age: 11083015
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Fri, 06 Aug 2021 18:47:22 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: fKMdANxJ4uhbFbLlDFJkOR2BdvEATitW6OErsodenNxaN2MR9_IV2Q==

GET
H2 200 14.c25177a9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 74 KB
19 KB 29ms
28ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.c25177a9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d3cf67b9a5c82810aad30bbe1e7213ebf0e45879501938a34acbd5a1b39b3773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:21 GMT
server: nginx
etag: W/"18403c312bd271177d0f9589bf9f8e63"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: lOPAv9SDW_4LP.6rK6h_XISnbYxX1zW_
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5d8KBQADTeRefNEY83mqOJ3-9q8X4XLuV3NtQC5gq429e8-T-Yl3AA==

GET
H2 200 20.ead2182b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 47 KB
13 KB 30ms
29ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.ead2182b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:51 GMT
server: nginx
etag: W/"61892b29d94d646e4fe4c955206e953e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: R.TDOsQ8XUx2f30jYVAP1aJfV9HUfplp
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 5wOOzzm-yk0UActb330yq0yew5V4iodOWFe7jbaUHq-3NBm4-0OEpQ==

GET
H2 200 12.2bc7e7e0.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 41 KB
13 KB 30ms
30ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/12.2bc7e7e0.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

0bf25c908c1290efef93757e032d7d9b6329348af7d24cf8ad6ae8400543a714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:20 GMT
server: nginx
etag: W/"4e5b47ac99b22392d5a4734fab93000d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: P2wsQKh7MZNx5UgC_6V2IutNaEbhKyaZ
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: HaG_1VivFPYudN__LoSX05H26ClkEOwUFeaQvLEX9Sib7X3BkEiduQ==

GET
H2 200 30.11d2b6a7.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 3 KB
1 KB 14ms
14ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/30.11d2b6a7.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 18:28:20 GMT
content-encoding: gzip
age: 3570053
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 01 Nov 2021 17:24:54 GMT
server: nginx
etag: W/"87532c4db85f1429fa6d759bc3332f36"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: GBOBYZXPfE_Um1Sf_mqL4fDHmw8hrH5J
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: B3Koh99ocsURqJF8tSBby6tM84uxHN6mNmmp2mtSwsa5WTk90Ov-Hg==

GET
H2 200 30.0383f092.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 3 KB
2 KB 15ms
14ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/30.0383f092.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a5e4d82414a2ca26ea7d94c8586c3c32363073ecb1214c884d302439f420913c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:52 GMT
server: nginx
etag: W/"62187322b72b1fa76d14e19526c132b8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: z3aE86SV2XLkllCr6fKLzNFXHsnbcDpg
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BQokX4VZSkVTBz2ArsJTAwvFZJ3ZLE6t20X4yJAMHplTZGGr_NwKbQ==

GET
H2 200 1.07aa08a5.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 7 KB
2 KB 15ms
14ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/1.07aa08a5.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:55:04 GMT
content-encoding: gzip
age: 3626049
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:04 GMT
server: nginx
etag: W/"189aeffd571884559dababa22c66d75a"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: K9l0WdnhS0.sb1iJQdTJni3xfVGcn633
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: mAmXXmGScBiG7TAllEYbEh039VadoaKo0Vd8GwZem5Ys3Lk3SDteAQ==

GET
H2 200 1.187c50a5.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 54 KB
16 KB 15ms
14ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/1.187c50a5.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:22 GMT
content-encoding: gzip
age: 4205751
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:57 GMT
server: nginx
etag: W/"eeccccb655ee3b6bcb8b1a9b1da4fd30"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: T4NYA9GFrw0AOH7iks5Owut4YT_Q7yUg
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GjEKc-xfhkr2ocez9aqJDN1YKtQGeI27qxDxQ8Wl68a2-ZfWY-Z5Wg==

GET
H2 200 0.3c34c777.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 44 KB
7 KB 16ms
15ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/0.3c34c777.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

6c166626718a3f6b92a1e3b0d9c726c0c21e0f3ca92221066ab4a0a8d174a38e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 17:54:49 GMT
content-encoding: gzip
age: 1066464
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Tue, 30 Nov 2021 17:20:07 GMT
server: nginx
etag: W/"4a5aaafc0741834f0fd8c10d76bdcd18"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: mDo2e7nWXBuK1cbyE.Q6x8h8HG66HcZW
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: wUgOdcMX7drqY7Lq3eulXZnrUykLXUuIGF7TYItq4JtkAmSDOsqK4Q==

GET
H2 200 0.ff7509fd.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 70 KB
24 KB 16ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/0.ff7509fd.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

515f3e6178dfe19c3ca5a2319e50164de34932dc890b600f03d7c1fbfe06c245

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:50 GMT
server: nginx
etag: W/"eacf947526f3720c2665efed45e8730e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 4RwVApgafAmFGZgexLMAJzC37lHxSodT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: btuwoO7CWCMD6NJYF5IE_fXXnJ5o7IZ0xIOOZZXjl8Y2rvKUCYteqg==

GET
H2 200 29.a4eacd1c.chunk.css
js.driftt.com/core/assets/css/ Frame 7B13 11 KB
2 KB 18ms
17ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/29.a4eacd1c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 20:12:40 GMT
content-encoding: gzip
age: 2181393
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 17 Nov 2021 19:25:04 GMT
server: nginx
etag: W/"5fcabdf983fd5bbf7cb199063137d146"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: k82F8FaNpkIB_WK109g86MbRHlA8U_6q
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: D_kye7cf7zlYvZU-7pSGX-hxfZ9oQ2fbIYNHTKwkK9n7sGRcpa7EKA==

GET
H2 200 29.dc469063.chunk.js Show response
js.driftt.com/core/assets/js/ Frame 7B13 11 KB
5 KB 18ms
18ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/29.dc469063.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b3e92729562bf7aa805f612b4f909f640cdcfe2ccdc9ee6cf78f710491208e78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1639361347381
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:52 GMT
server: nginx
etag: W/"72171f9c0b9a4cd90bdf2440c1e572de"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: tOIlB4_T5WHhtdhh95vBpNvdrmWg4TVO
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: jritUrY-4Yes6oq2HoJhHsiQAViOO3yccwkIht4N7RoxbNOSkKLOtA==

GET
H2 200 runtime~main.a6344017.js Show response
js.driftt.com/core/assets/js/ Frame E105 6 KB
3 KB 15ms
14ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f27be3c0e561adce25bf4f49eeb96763d5e9d8710210198867970df0501e57cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:24 GMT
server: nginx
etag: W/"696f53bfdee61fb2778728d5ce81c78b"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: z7L1_ygvVW_.r5TcSEKIrr6uxCpFws_h
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: R16V5F3yIsnnIvB01UZ6dHVqDa3P75zY8QiVUJOPB2NR_QdRgM8B2w==

GET
H2 200 4.a93e53d9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 58 KB
20 KB 15ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/4.a93e53d9.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
content-encoding: gzip
age: 11083016
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 06 Aug 2021 18:47:25 GMT
server: nginx
etag: W/"fce0b3daf28dfa888be2818f43b06ef0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: imvxQz4ZQnCekVetyHrX84xCYV8ndGWZ
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: S_cuAHiK3gslhJyRdyOm2e44_2r2fvXre39KdfqLtgJG5ZOUR8Z1KA==

GET
H2 200 main~493df0b3.580db5ef.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 6 KB
3 KB 16ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/main~493df0b3.580db5ef.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
Origin: https://js.driftt.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 06:03:57 GMT
content-encoding: gzip
age: 4219516
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:07:00 GMT
server: nginx
etag: W/"9b4aab2d855603fa59a09f8160eb7cb4"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: SHbjo2Z875cq.BpS9ven0n3hNF1FVxPh
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: ObmK-J-jC3AsZdSPvcThCVcMX42nTwLPccxT4sqc2DnVLgZh4JqnNw==

GET
H2 200 42.3b1c2441.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 47 KB
14 KB 15ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:54:58 GMT
content-encoding: gzip
age: 3626055
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:08 GMT
server: nginx
etag: W/"62fe06940598a98760a9eae46800ff59"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: ZvrGZ__CENehO4yWRJghqJAjDXfkpDfG
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8mIQt1gxG6IG9SQV1xyiaHovSTq1d6KCKhq-DyIGtmGj1adILFJeJw==

GET
H2 200 17.cce21c2a.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 44 KB
13 KB 16ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/17.cce21c2a.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:54:58 GMT
content-encoding: gzip
age: 3626055
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:07 GMT
server: nginx
etag: W/"565bf690dc82ce7e1f45c9647d892490"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: V1tQBeNhHuSP3Kq4PFVzDyqDvIlj_GeG
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: WK7QuZFaYWij07jSuPzdkZxkjCPnMUlzgHCJ3I1SkTwIlC7Alf-Wtg==

GET
H2 200 35.3e4eba7e.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 25 KB
8 KB 17ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/35.3e4eba7e.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sat, 06 Nov 2021 02:57:28 GMT
content-encoding: gzip
age: 3193905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 05 Nov 2021 15:09:54 GMT
server: nginx
etag: W/"b1a0f364c9ad5137b5ab8e5237a825b8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: rVOZxkkH0Vnn22xeEPRRFzkcE.ar0yRa
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dVfQzjGAR0mecrkixQfXjT11T3_FkvIo9z4OuiCvC9rhegUSfhXxLw==

GET
H2 200 15.8065fdbf.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 16 KB
5 KB 17ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/15.8065fdbf.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 06:18:05 GMT
content-encoding: gzip
age: 8452268
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 03 Sep 2021 14:38:32 GMT
server: nginx
etag: W/"db60664de2c8d54d23e359c94e68f6ce"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: vLMtFICr__AmVbpyC1134yZVvjJr6q0Q
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: BIa4N9EYTp7jyN_r49qgkci-C1mLOFxqENkqSrex_8ZofTqAiwitiQ==

GET
H2 200 19.5937a5b2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 72 KB
22 KB 17ms
16ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/19.5937a5b2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 02:55:04 GMT
content-encoding: gzip
age: 3626049
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 29 Oct 2021 20:21:07 GMT
server: nginx
etag: W/"08aceb94bd26b0e431ca437d628e3c13"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: a9V2sG0hWPWT.cLrpxmLmJQEJHJ3pTch
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: cvOeiuP0ue8SIgO3Tb26OxFgRwnoSYfbKVe0MyBK4y97Ns6a52aCnA==

GET
H2 200 32.04864e7d.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 16 KB
6 KB 18ms
17ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/32.04864e7d.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:58 GMT
server: nginx
etag: W/"3b6707d602c1f7d03c4c8b0bdecb8e4e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: juigjv2.842khaDjrzqiMoucoadLCjYk
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: AF0Ngpz0Z7eymTr4o42MAQfKaN8i6rUgJ13t8ZJCsUzqrpGDqmGrDw==

GET
H2 200 23.a53d721f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 59 KB
19 KB 18ms
18ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/23.a53d721f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 01:41:23 GMT
content-encoding: gzip
age: 1124869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 29 Nov 2021 22:20:10 GMT
server: nginx
etag: W/"fe96cb8c4c390342c29d3c8cb0a4ca14"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Bes4ojoExyGtogevsaG2vPPgIGz3MINt
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: i8lWKR-cbSVk20J2OKCKbPWISAcFICU2SUdkPR10_MN84qBy8qDS2Q==

GET
H2 200 10.704ab67c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 91 KB
28 KB 20ms
19ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/10.704ab67c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 20:47:44 GMT
content-encoding: gzip
age: 6240088
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 01 Oct 2021 18:06:47 GMT
server: nginx
etag: W/"50dcb170ca1ae1f4a09fe8f23065f2a8"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 8SLWCghXfnMEQiqJuVzEB4mWFfFgTeMA
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: QvfanqUwISNSANrv6s7AVgWNA9DGBsUp2NmJtDEs-9FmBbnteIekRg==

GET
H2 200 9.cea5327f.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 24 KB
7 KB 22ms
21ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/9.cea5327f.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Tue, 30 Nov 2021 15:01:38 GMT
content-encoding: gzip
age: 1076855
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 29 Nov 2021 22:20:12 GMT
server: nginx
etag: W/"2db4f74e4d7ffda350b50dde6a07ed5e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: XO6Gj_y9Dw4LqhxSapA287FNAF2AYGBn
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 6VUElIn6LG2CCZWbFazFWkHYbFiCn5pYhSxoZ69BQSbw9y9yn2bSMw==

GET
H2 200 13.c2156fc2.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 62 KB
20 KB 23ms
22ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/13.c2156fc2.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:58 GMT
server: nginx
etag: W/"b94404e76324bd4454531b2e0a54f7bb"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: UBqTGR_Kpp2cPp4uQTy5DkPbiTlHyHAU
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: zYZNtdtxSYU_2FOiom4ZPCR4NzHqYK49j9TMb5XjCMoZ8ExAxBlIAw==

GET
H2 200 40.01f4f7b3.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 105 KB
34 KB 24ms
22ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/40.01f4f7b3.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 25 Oct 2021 09:53:21 GMT
content-encoding: gzip
age: 4205752
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 22 Oct 2021 17:06:59 GMT
server: nginx
etag: W/"7dd9b27f83583b6d43567ed4b21eff8c"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2QdQNwJ4SDmpUoZVr7HrkjjZUMt.Wzuw
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 75gV_WwJz0mWqw-8BOQvcoF3TZi2s46WZ8YTqNFgTcgTWpPeksxJ3g==

GET
H2 200 33.c1910d43.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 12 KB
4 KB 25ms
23ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/33.c1910d43.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 07:05:25 GMT
content-encoding: gzip
age: 8449428
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 03 Sep 2021 14:38:33 GMT
server: nginx
etag: W/"0e451f1cf9656229ccd33dfa3ad0638d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: x9xPxe0FOgEjzVEWwoqmEw_u_0f8UbkY
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: DuOIRR4_Xo9Rio3d-8yVDdOis83xUpyvNICe1ea273PZEgusCctaUg==

GET
H2 200 25.b7a0bf53.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 12 KB
5 KB 25ms
23ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/25.b7a0bf53.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 03:18:04 GMT
content-encoding: gzip
age: 1637469
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 22 Nov 2021 19:33:19 GMT
server: nginx
etag: W/"808f7c7829001881a39cef6846a36ce0"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: Q2g0zIRf_FIeqHbwx92fc3AdT0lCB1K6
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 9QfM5Oh1ByufD4PGWshrNGg87wYrGfFX2Q3v1B5bDVMpVahZvwaNuQ==

GET
H2 200 16.fab21cf4.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 17 KB
7 KB 25ms
24ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/16.fab21cf4.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 04 Nov 2021 16:58:47 GMT
content-encoding: gzip
age: 3316226
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Wed, 03 Nov 2021 13:47:23 GMT
server: nginx
etag: W/"b451093ecfaa012f364641010ed13346"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: wCl6QNbYqV3zaB4E280GBYT.UNDnPeJC
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: dYForpShUWTzM0nvKPhxyz3oF2KpzZn2s8yTJ31u-ePHPw0-O0chQw==

GET
H2 200 7.30af169a.chunk.css
js.driftt.com/core/assets/css/ Frame E105 11 KB
3 KB 25ms
24ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/7.30af169a.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 01 Nov 2021 18:28:20 GMT
content-encoding: gzip
age: 3570053
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 01 Nov 2021 17:24:54 GMT
server: nginx
etag: W/"bd798c00af88b7523deb5a8065993250"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: i5VGTHkGJ3W10pB8.FdBO9KWoGwOWrOx
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: GAdZHT-b9mUhSIeoPM2S6jQ_lbZwRaWsShO6_Eq_HWBbptrTRE8akg==

GET
H2 200 7.892db701.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 69 KB
22 KB 25ms
24ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/7.892db701.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

a85e6cc00b6521151a066190dfa2f0983135171fbc1845b0acfe09fddb245a68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:53 GMT
server: nginx
etag: W/"59ff575cde5cbc57af07ef742efe8a77"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 6L5P_vHWmZADGUWpRUkNwqrHbIkXu6n5
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: Bb5rJqYcwRbf7kvxOyG4caGzJXMesfBI5F0IrU3S4VdZdxV5slGchw==

GET
H2 200 14.22abfce0.chunk.css
js.driftt.com/core/assets/css/ Frame E105 24 B
668 B 26ms
25ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/14.22abfce0.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 19:32:17 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
age: 11083015
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 24
last-modified: Fri, 06 Aug 2021 18:47:22 GMT
server: nginx
etag: "0c5dad92482d9a7c7c253510f5082465"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: TvxaskXeU1vX5QWjGFtspdoYt.ZZ_9cE
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: g3vq8fzXdzGoOs2g9EIM-2wZPO0CtQ-OC8OP5xgYUw2GzIuQN3oCOQ==

GET
H2 200 14.c25177a9.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 74 KB
19 KB 26ms
26ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/14.c25177a9.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

d3cf67b9a5c82810aad30bbe1e7213ebf0e45879501938a34acbd5a1b39b3773

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:21 GMT
server: nginx
etag: W/"18403c312bd271177d0f9589bf9f8e63"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: lOPAv9SDW_4LP.6rK6h_XISnbYxX1zW_
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 8QqKd_ummy9K9ARKniiZZmnxwEy3axi5VZ3Cl_AoxJXLMgTnEhroLg==

GET
H2 200 20.ead2182b.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 47 KB
13 KB 26ms
26ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/20.ead2182b.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:51 GMT
server: nginx
etag: W/"61892b29d94d646e4fe4c955206e953e"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: R.TDOsQ8XUx2f30jYVAP1aJfV9HUfplp
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p-BREJIzFnFvF1bXkJtethlEng-rnKfd6FIPUSBDx4VUM6TNZxT_7w==

GET
H2 200 12.2bc7e7e0.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 41 KB
13 KB 27ms
26ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/12.2bc7e7e0.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

0bf25c908c1290efef93757e032d7d9b6329348af7d24cf8ad6ae8400543a714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Thu, 09 Dec 2021 14:50:48 GMT
content-encoding: gzip
age: 299905
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 09 Dec 2021 14:08:20 GMT
server: nginx
etag: W/"4e5b47ac99b22392d5a4734fab93000d"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: P2wsQKh7MZNx5UgC_6V2IutNaEbhKyaZ
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: 7auJfvlKTiCxfpoHpLjZUVz6klgIpANZQxeVIZ0v100FnrvKl3d-cQ==

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 194ms
194ms Image
image/gif 104.111.233.140
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A13%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A12%20GMT%22%2C%22timeSpent%22%3A%221008%22%2C%22totalTimeSpent%22%3A%226014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.233.140 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-233-140.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://research.checkpoint.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Date: Mon, 13 Dec 2021 02:09:13 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H2 200 22.e10510b6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 42 KB
12 KB 15ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/22.e10510b6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Sun, 05 Dec 2021 03:00:11 GMT
content-encoding: gzip
age: 688142
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Thu, 02 Dec 2021 19:39:10 GMT
server: nginx
etag: W/"a99459752bee496e4af7c45277fd9c26"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: .p1WPnsH8XGSlb.mHBXCMu26rOKTD1WF
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: p0owf9add1Z2vvyFiO5RLlW5BGrekSC9qCnIpal6GwIwCefH889iig==

GET
H2 200 24.49c6961c.chunk.css
js.driftt.com/core/assets/css/ Frame E105 8 KB
2 KB 16ms
15ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/24.49c6961c.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 18 Oct 2021 07:58:46 GMT
content-encoding: gzip
age: 4817427
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Fri, 15 Oct 2021 18:19:47 GMT
server: nginx
etag: W/"f80cd64e339375567091159cb077b941"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: t3wd1L70.jr_F45fRiZ9jDIt4M2lflSx
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: kA9Wynj5xSwpsjSzJBpflyiWsBJosz1Fn4oVJ-UAIV5byKyIbICW-Q==

GET
H2 200 24.abe2922c.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 12 KB
5 KB 16ms
15ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/24.abe2922c.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

4d85222516f652c200ef03b89b4b755c6a54210c75ca599fb53e0a05d677e197

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:52 GMT
server: nginx
etag: W/"04cf8ee37950ab9133d56182ac42f2d5"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: AKRAE85zxgA0Hp9dPNB1SHfTVkCdBA_K
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: iiEtZ0f196DNqPN8nplCw7BXzk2SLfUFPviB_FBEHWvJtMvnXg7yyA==

GET
H2 200 18.c695453b.chunk.css
js.driftt.com/core/assets/css/ Frame E105 365 B
1010 B 16ms
16ms Stylesheet
text/css 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/css/18.c695453b.chunk.css

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 18:05:58 GMT
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
age: 6595395
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 365
last-modified: Mon, 27 Sep 2021 17:53:27 GMT
server: nginx
etag: "06b2963b029c0824382815165bfea73e"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: 2nl84_Ynkb7J4eflOi4MBL9RG1iL8udX
access-control-allow-origin: *
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
accept-ranges: bytes
content-type: text/css
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: KSLCnYiTLGkSK6yLxQTvP9VcV7m4AxA1p-rVDUVf1IxZnyXYTYCiWw==

GET
H2 200 18.d26db4f6.chunk.js Show response
js.driftt.com/core/assets/js/ Frame E105 84 KB
24 KB 18ms
17ms Script
application/javascript 13.224.96.51

General

Check archive.org

Show headers Download Go to

Full URL

https://js.driftt.com/core/assets/js/18.d26db4f6.chunk.js

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/runtime~main.a6344017.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.224.96.51 -, , ASN (),

Reverse DNS

Software

nginx /

Resource Hash

9d7afdf8d1c1a87187c0ac284ec079f86acdbc289484bc8d4066dd4035b51d8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://js.driftt.com/core?embedId=wxbvs5zxy7iy&region=US&forceShow=false&skipCampaigns=false&sessionId=0fef3cda-c510-4c5f-9eec-7ed93493511d&sessionStarted=1639361353.445&campaignRefreshToken=df81e5fb-7b84-4eb1-b8e6-700d4bfc5643&hideController=false&pageLoadStartTime=1639361347381&mode=CHAT&driftEnableLog=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date: Mon, 06 Dec 2021 16:07:51 GMT
content-encoding: gzip
age: 554482
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
last-modified: Mon, 06 Dec 2021 15:09:51 GMT
server: nginx
etag: W/"676cfbeadf3745138265730781f5f098"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
x-amz-version-id: QXlXpncoHQvFxp5turnNkFrpF0Tp7Na2
via: 1.1 3a17ea4b3f6bdbc694c3ec0645d21b5e.cloudfront.net (CloudFront)
cache-control: max-age=31536000
access-control-allow-credentials: true
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript; charset=utf-8
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id: pzEAYn2CUgSMyIWlBldgnJBSQKWKAcNyYJ68uqXuIF_fYImTgpOVSw==

OPTIONS
H2 200 v2
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame 0
0 782ms
550ms Preflight
text/plain 3.94.218.138

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 -, , ASN (),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: authorization,content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 13 Dec 2021 02:09:14 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftbc7f19b461c8aeb58ea7f29f419
content-length: 13
x-envoy-upstream-service-time: 446
server: istio-envoy

POST
H2 200 v2 Show response
metrics.api.drift.com/monitoring/metrics/widget/init/ Frame E105 25 B
122 B 116ms
116ms XHR
application/json 3.94.218.138

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics.api.drift.com/monitoring/metrics/widget/init/v2

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.94.218.138 -, , ASN (),

Reverse DNS

Software

istio-envoy /

Resource Hash

f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Authorization
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 13 Dec 2021 02:09:14 GMT
server: istio-envoy
requestid: a911b36ae013afe3
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 12
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 25
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

POST
H2 200 ping Show response
bootstrap.api.drift.com/widget_bootstrap/ Frame E105 126 B
223 B 104ms
104ms XHR
application/json 54.147.21.139

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping

Requested by

Host: js.driftt.com
URL: https://js.driftt.com/core/assets/js/42.3b1c2441.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 -, , ASN (),

Reverse DNS

Software

istio-envoy /

Resource Hash

824981bc5be809a3a3a6bf79a173e41965671b0fcefa6b10eed1c38751ff38d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: application/json, text/plain, */*
Referer: https://js.driftt.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type: application/json

Response headers

date: Mon, 13 Dec 2021 02:09:14 GMT
server: istio-envoy
requestid: d241f674fdd41fba
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-max-age: 1209600
access-control-allow-credentials: true
x-envoy-upstream-service-time: 3
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
content-length: 126
access-control-expose-headers: X-Results-Total-Count,X-Page-Info

OPTIONS
H2 200 ping
bootstrap.api.drift.com/widget_bootstrap/ Frame 0
0 325ms
107ms Preflight
text/plain 54.147.21.139

General

Check archive.org

Show headers Download Go to

Full URL

https://bootstrap.api.drift.com/widget_bootstrap/ping

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.147.21.139 -, , ASN (),

Reverse DNS

Software

istio-envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://js.driftt.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 13 Dec 2021 02:09:14 GMT
access-control-allow-origin: *
access-control-allow-headers: origin, content-type, accept, authorization, auth-token, uber-trace-id, x-amzn-oidc-data, x-version
access-control-allow-credentials: true
access-control-expose-headers: X-Results-Total-Count,X-Page-Info
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS, HEAD, PATCH
access-control-max-age: 1209600
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain
allow: POST,OPTIONS
requestid: driftada3b53402dbe66795d827130d4
content-length: 13
x-envoy-upstream-service-time: 1
server: istio-envoy

GET wxbvs5zxy7iy.json
embeds.driftcdn.com/embeds/ Frame E105 0
0

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: embeds.driftcdn.com
URL: https://embeds.driftcdn.com/embeds/wxbvs5zxy7iy.json

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=af1e717890f3605d16fc823643e05b8c&svisitor=36bb1002af0b000043abb661fa020000454f0e00&session=d39d61ef-a137-4168-8ec9-b6fcdd464daf&event=active_time_track&q=%7B%22currentTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A14%20GMT%22%2C%22lastTrackTime%22%3A%22Mon%2C%2013%20Dec%202021%2002%3A09%3A13%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%227014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Latest%20Research%20by%20our%20Team%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22When%20old%20friends%20meet%20again%3A%20why%20Emotet%20chose%20Trickbot%20for%20rebirth%20-%20Check%20Point%20Research%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fresearch.checkpoint.com%2F2021%2Fwhen-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth%2F&pageViewId=83942a20-f89e-4225-81c6-1883ce3b3fda&an_uid=0

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

20 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.checkpoint.com/	1969-12-31 23:59:59	Name: referralURL Value:
.checkpoint.com/	1970-01-20 16:53:53	Name: _ga Value: GA1.2.1687260925.1639361348
.checkpoint.com/	1970-01-19 23:24:07	Name: _gid Value: GA1.2.476371934.1639361348
.6sc.co/	1970-01-20 16:53:53	Name: 6suuid Value: 36bb1002af0b000043abb661fa020000454f0e00
.checkpoint.com/	1970-01-19 23:22:41	Name: _dc_gtm_UA-194688-3 Value: 1
research.checkpoint.com/	1970-01-19 23:32:46	Name: _an_uid Value: 0
research.checkpoint.com/	1970-01-20 16:53:53	Name: _gd_visitor Value: 744aa086-2019-446d-8ba1-eeafa39f3fc0
research.checkpoint.com/	1970-01-19 23:22:55	Name: _gd_session Value: d39d61ef-a137-4168-8ec9-b6fcdd464daf
research.checkpoint.com/	1970-01-20 16:53:53	Name: _gd_svisitor Value: 36bb1002af0b000043abb661fa020000454f0e00
.checkpoint.com/	1970-01-20 16:53:53	Name: _mkto_trk Value: id:750-DQH-528&token:_mch-checkpoint.com-1639361348306-60344
.twitter.com/	1970-01-20 16:53:53	Name: personalization_id Value: "v1_4bdS1vid4u19+LNwGmzGLA=="
.linkedin.com/	1970-01-20 00:05:53	Name: UserMatchHistory Value: AQJ5nsW97VxXJQAAAX2xjQL_5MvnvTp-5NreCsTe3e_NX1b0SJb38fX8DcSeOPwI8kyIO_RAmnCXNQ
.linkedin.com/	1970-01-20 00:05:53	Name: AnalyticsSyncHistory Value: AQJ3JQCE8GkSKwAAAX2xjQL_D-RIPqG8RnSgGbvt2fDYEZsIsrdBcvcGN5eHcIJofmyImJMDXZrA9is4X0ePpw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 16:54:35	Name: bcookie Value: "v=2&1f4841db-0c4b-473f-8b99-7b485d3077c9"
.linkedin.com/	1970-01-19 23:24:07	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2370:u=1:x=1:i=1639361348:t=1639447748:v=2:sig=AQEpX3pvos7e6A8VbRFsU7wwTP0JOrlI"
.checkpoint.com/	1970-01-20 01:32:17	Name: _fbp Value: fb.1.1639361348443.630306060
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 16:54:35	Name: bscookie Value: "v=1&20211213020908c4a37f40-8177-4338-84d8-2265dcf10c16AQFChnjo-aE3ltZ7w9zZ4Kyhw9a8dxbj"
.linkedin.com/	1970-01-20 16:51:58	Name: li_gc Value: MTswOzE2MzkzNjEzNDg7MjswMjEzjqyWqeK/DAbanoAUsIXo49xY7ODybgWmnI+PwaQoUw==

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

750-dqh-528.mktoresp.com
analytics.twitter.com
b.6sc.co
bootstrap.api.drift.com
buttons-config.sharethis.com
c.6sc.co
cdn.onesignal.com
code.jquery.com
connect.facebook.net
embeds.driftcdn.com
epsilon.6sense.com
fonts.googleapis.com
fonts.gstatic.com
img.onesignal.com
j.6sc.co
js.driftt.com
l.sharethis.com
metrics.api.drift.com
munchkin.marketo.net
onesignal.com
platform-api.sharethis.com
platform-cdn.sharethis.com
px.ads.linkedin.com
px4.ads.linkedin.com
research.checkpoint.com
sc1.checkpoint.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
stats.g.doubleclick.net
t.co
use.fontawesome.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
b.6sc.co
embeds.driftcdn.com
104.111.231.109
104.111.233.140
104.111.234.67
104.244.42.195
104.244.42.5
108.174.10.14
13.224.96.103
13.224.96.51
141.193.213.20
151.101.12.157
18.198.109.212
185.33.220.242
192.28.144.124
2001:4de0:ac18::1:a:2a
2600:9000:2190:2c00:c:abe:f440:93a1
2600:9000:2190:2e00:1d:85c3:6640:93a1
2606:4700:3031::ac43:d645
2606:4700::6812:e234
2620:1ec:21::14
2a00:1450:4001:808::200a
2a00:1450:4001:80f::2008
2a00:1450:4001:811::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::200e
2a00:1450:400c:c08::9d
2a02:26f0:6c00::210:ba20
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
3.94.218.138
35.158.71.178
54.147.21.139
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
09de3245965e90dfc9ac24b906c86c1025768ad5e347361145a48c36448a7ab8
0bf25c908c1290efef93757e032d7d9b6329348af7d24cf8ad6ae8400543a714
0fc686423c26cb1030032fd7e4f2dd664c4b08517a8990c0b46269dd4e01910b
0fe8bcbcd24ab838fbbd773001253fc0353956e81c5ba9c8e23951ebdbae305a
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1612e3d01a9389defe81c28b91ee18b7b1f97b54f39dd8aa651667c25bce28e2
170ef28b6e95640173ac6371097814b19627a79e1ac132ac8166b6af52b0c1c1
1998582382fbf956231d65be84b76e08c0c86e5ced8a99c703bdec416d876d76
1bae747c7fd090f56608956a97c870391e1c43f89d24d5766129b75628985c1e
1e84c10c157e2274814bccf7475c42275d2f5dfdfaacfd7070510034bfccecbb
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
27e3e60081926b895d5615743273a67f3280908e74e364f789df932ddc0661e8
2b4d9e531f3302ad49380ce5e5e160925956edb55179c63ee2bac32ab040d1a5
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34959e43e6ecf368807a84f92ad9aa6e2dcd5f0c5c1e57da55e8f3248d9d9255
3643b2c826a615065303aa44b8f463eb854d77934f5f25dc1f74f60d4698f9f0
41f7afd6088c39cdc0d6f910f7f4b6afbf6a2133533847e960a8ca906fabc1c6
444ee2a405e57ede9ef10e17bb58c0351c39e9d21203f242b55a77fd07d30784
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
4a9b0b449b77fd3cf250284f9c232b20dd193d8c538f059350594bc865847da9
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4d85222516f652c200ef03b89b4b755c6a54210c75ca599fb53e0a05d677e197
4da3e3aa30b5b06390d7e7e3fcfb16d648909eb429d161c2748bd6d79a7ec5fb
515f3e6178dfe19c3ca5a2319e50164de34932dc890b600f03d7c1fbfe06c245
52997a640c38c5915b6105ad464bf2bf8121f3fe40c72d70791f54c4be95971a
55b4a8ebd4ce4144242d6bb9d0ebb65a01b2759e67243ed5badc3ac96c6fd396
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578cda2391db4e4d761ae5c4f05c03614d0ea8fec0b260edc036cc0bbdfcdd93
57e48df5586242df165fa8424ae8cb9e360c8e81b6a711736bf1f395a2c02a2f
58332a4cc75a697eafeb1b4d9cb66326d6a29acb2f98afc1de3f1ef2401be056
5c833b1818762f1e134fbb158447fb0b92f2b018b15aa36f2e2405213f830d38
5dbaf0a4ff0f8ac8c1b67550eee84390b089604ffaf71183e417636c7e183ac5
5f5012132c752db2433e17712d91ef8689f1bc95167b2720e23224c2ae62e009
6048e330c0f362be46b20de45d35a5ace57a04be04a29da10448d6949f6f69ce
679f94121a8eef76a85fd8f18c08770809552ffee58555121d61da7b0366e59b
6c166626718a3f6b92a1e3b0d9c726c0c21e0f3ca92221066ab4a0a8d174a38e
71f918c131027703d4692c7e7cc9d46fc09554fc2b211e60f12e8fea8360deb7
768d97ec0916217ae82c70aeda3a61b9b0dab344edc4a3240a4f7cd94af00307
7727399fe5d8441829176e6a661b540efaac1680120a1d7fb1235e258d70770b
787a1ead7327243569f14b82fdfecfdfc2533b17a2bc212a93b367c81d77e77e
7888a75eac5f8b9dc4c448f10e8dc9030fcae612cb236f1a9e9700d56ae6ef34
791d8c8cb135d3d53915096e999d3857b6ee16966c20a019f38699f09f6aa2ff
7c93346d4f681a0be90d1dfc19346382a4700f1810f41caa54415688dee1777f
7e0c4a1ed3d232553d98c82ea0e04cee8975d0a67df819e161f96e7c32179e8c
7f5bd223eafa1c6d1aff21c91c6bfb825f7f36830d97eef41c432681ed671f85
824981bc5be809a3a3a6bf79a173e41965671b0fcefa6b10eed1c38751ff38d6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
847eb36b4dc4b05f94052dcd98077319e74d882334a106bb9ca451ba211c9c2c
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
953d6908ab55929254e46c77e5c751a6e2df7ab84430f134edc3bb62d8f7d32f
9a83c65bdd0ff9488af9d25720686457ea7295c9c44f9f1d285a0c9ec89bab99
9d4dd6f74048362b427d4bb83d6cd9364dd4a2451c1caf482be84ec54a79fac9
9d7afdf8d1c1a87187c0ac284ec079f86acdbc289484bc8d4066dd4035b51d8a
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a22d6b8782097b7cd9588ab582e119bfd6290278275661e9d0f96b2baec0cb8e
a3075e2c162e41c4962a4221ae035dd607d895bd424e87aa4065a044c43763e4
a59bba774218f207179b30aa8bbd21bad0f7355a52321e08138bd77a308c27d5
a5e4d82414a2ca26ea7d94c8586c3c32363073ecb1214c884d302439f420913c
a85e6cc00b6521151a066190dfa2f0983135171fbc1845b0acfe09fddb245a68
a8da941d8a446516c824ebc9fb77b42e6b92c6deed1daed266bd821ed27bc516
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
acadd76a335e98061ef67610e2cc701027232396e26b593a2af78a6f027cef75
ae3754c54a0880a98a94c423d3e67f39b5b6f3c63516dafa33866e3e74c9f97d
af0ad47815cfcb0fc8402cf431dd782af68f2ba05752c66d9bb11a4354f65754
b0257060098cdc51166f35b62e7dd8f0c5f8d6cfa319901c0c51a629537e02fd
b1fd89254c5a1e26226d533849c501ce8d17f47d4271e907f0084d7a25f1f242
b23807a4c5d90afca0dc47d688c0a05302779429dab75f5e6182562dcc2970f6
b3e92729562bf7aa805f612b4f909f640cdcfe2ccdc9ee6cf78f710491208e78
b57b08b644c46020873648d2ef72bcedb87ba742cb0823e6bf62480f8f51f6d9
b7cfb1c9430d90b22b3f4497543a4cfef719dc40a3cce130cad766171abe8bbe
ba83c227cde7d4c34fb514ccd483305e8dfef365e6b2b70a126f2d73adaa1691
ba8d88ea5f494982cae457a29fd31a03869293680fbf2cf1b17138b8c48d6b69
bb3d017273ed487674d9766d8401cf458228596adcc0c3a6024f44ae715090db
bfdf771a88510602e591de3b4f605bbc87b53800129f5dee8d926a66da8328c0
c0f7ef8329ae6da56bd269492901fb024a05d7b67e977995a82b506af4b3b030
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c2d8b5ed5baf711d51629607797e32e5ff638637a0091598427eac4908dbae47
c87e0e31334c6998b90c83d48eff6252a248120d32b376414965e1421203c901
cb8c2b19fd9b56c41db14bd71b5c0616c1ba4e99b08c8e75084cf695f74b7120
cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca
cda9b31d709444e003d3adbfbdec43f093e405b36841fde5c1d187e439585219
d3cf67b9a5c82810aad30bbe1e7213ebf0e45879501938a34acbd5a1b39b3773
dadbb59b37bfea4c78c6e15c8cbb96dfba84526e43a0767dc244fd062a841aba
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
dc03d7d27d7a8aea9c3adae49b9c60179da40637b907e08be97cae8428edfa20
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd09e3ba26066abe27c4dad57c8e0c8a63fe23a0bc87e63bcab94f25e9096459
dd7da6e06a4f7997ad3f918923972a7d96c6dd23ca13f7f107b7cc45da665c98
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e2fc570495ce9f73780336d692d1caf5d299d81a0208243f97dacb7f345cdf15
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e40b6eae9d66c60b9c750da70da6b2bc5d35c2ae9689cc1e9547e300fac4a3ba
ec3a84e593065a50cd77ce9fba273b4196936940c0813ca248b045df2e2c8eff
eee6d8fe37122ba1538560131fe5c95f9a4b6c45e2059076a7a92513fcb12f20
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efc737b4f58cfe73a9bd0e57d7570365701381da31e628b269e7217a0ce3359d
efd598dd7ed5344fcd7bf5c92b1e5743915899137ea95901e634212a41fc2b68
f27be3c0e561adce25bf4f49eeb96763d5e9d8710210198867970df0501e57cb
f48829864ffd155da0360e19be956282b6875173f8990394e93bc7c30c97a3ed
f69f074cc1ecce0a1c4d713e7d4f1a4460f6fe600100330fcb2418881e710d79
f8c91e009d219173c41b4c0b6e43ad28081f7580df6cb99a76aa0a476390ca47
f94ce8666bf003756c16b56edad5a0121b3516222d4f093bdb771afabfb2cc5f
f978da291f493e64d4420d2cfab5c2bdc736c53f11c8d61c6da1efdb7df1155d
fa110ac06915e913fea0ad440e557cd75b95101504acc6a865efb5d7f0f34d95
fb372bf086a350fc14b803de31af04857aaf0b0e18bf7de76737715efa2ce57f
fe2df9f6df4b4a8d7174d259f563b8d9e28e4c03f8f4092fd9db6044e0e64c32
fed785a6a8ca96fb67230fec5d85f9c508db49f4075aa0ef284af56cd89813e3

research.checkpoint.com Open in urlscan Pro 141.193.213.20 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

150 Requests

98 %HTTPS

50 %IPv6

27 Domains

38 Subdomains

32 IPs

4 Countries

1736 kBTransfer

4873 kBSize

20 Cookies

46 Outgoing links

Redirected requests

150 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

research.checkpoint.com Open in urlscan Pro
141.193.213.20 Public Scan

Screenshot
Live screenshot

Full Image

150
Requests

98 %
HTTPS

50 %
IPv6

27
Domains

38
Subdomains

32
IPs

4
Countries

1736 kB
Transfer

4873 kB
Size

20
Cookies

150 HTTP transactions
0 data transactions