www.cyberhaven.com Open in urlscan Pro
35.152.104.113  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQLr9v9WUudcewAAAZQeM-ezJP3AbUMP_mM7f31FFqlUyiKlcSbjiaMD9NRDrglIKxs-og

103 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Show response www.cyberhaven.com/engineering-blog/	85 KB 28 KB	309ms 106ms	Document text/html	35.152.104.113 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.152.104.113 Milan, Italy, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-152-104-113.eu-south-1.compute.amazonaws.com Software / Resource Hash 68024caeb774aa1e00e3388c3579df78ca485a9b10705e271d51dcaae0312d90 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers age 80929 alt-svc h3=":443"; ma=86400 cf-cache-status HIT cf-ray 8facb10bfee2eda7-MXP content-encoding gzip content-type text/html date Tue, 31 Dec 2024 19:31:44 GMT last-modified Mon, 30 Dec 2024 20:59:41 GMT surrogate-control max-age=432000 surrogate-key www.cyberhaven.com 64deefeac57fbbefc32df53d pageId:659f33bed6ad85bae1aa7e8e 659f33bed6ad85bae1aa7fe2 659f33bed6ad85bae1aa7e5e vary Accept-Encoding x-cluster-name eu-south-1-prod-hosting-red x-lambda-id 7319f65d-64ab-4a43-9456-5a8f2c2e5264
GET H3	200	cyberhaven-2-0.7fc24bcb1.min.css cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/	295 KB 55 KB	98ms 52ms	Stylesheet text/css	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d3873b4cb8cce5adf637f085d4577e3b4b0364cd7ae43609b618dbb08fe1027a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status HIT etag "82de427c01c3d2be069f258bb6d853cd" x-amz-version-id hpz1DhbA8Aw1Ayi1NAQ4WRcSqQ.1gd.J age 330825 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type text/css last-modified Fri, 27 Dec 2024 23:20:51 GMT vary Accept-Encoding priority u=0,i=?0 x-amz-id-2 YMGMa+pBf247/t69ndziBp/Q+mq4Dtq4K3IhnjNMGhTi1DQBtMrTbR7V0ggSfPomlfloAw5em2o= cache-control public, max-age=31536000, immutable x-amz-request-id 9WQSBWNT9G0XQ7WW cf-ray 8facb10cef71d379-FRA accept-ranges bytes access-control-allow-origin * content-length 56195 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	fs-cc.js Show response cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/	29 KB 11 KB	95ms 31ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/cookie-consent@1/fs-cc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash bdeed7650697bd478a6b0591a9ea29664b04a6681a4f9f7c4c2d3d10cdae42a7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"73ae-nwFPCwd3UXiTZ7YuAXjbCNGDpOw" age 22663 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230135-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 10845 x-jsd-version 1.15.0
GET H2	200	js.cookie.min.js Show response cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/	2 KB 1 KB	94ms 31ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/js-cookie@3.0.5/dist/js.cookie.min.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 582cc085dd8fea044917d1efde838e77e845262fd025bbfe0339f808607c81f6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"6c3-1s0eec7oePdhcVrYEdKeoGY3QW4" age 4881093 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230030-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 860 x-jsd-version 3.0.5
GET H2	200	readtime.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/	4 KB 2 KB	39ms 38ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-readtime@1/readtime.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 164406864a5606d7181ae4c6f6b48c19478bbc7377178b51c0f53c68a28fe58d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"f7c-CEGEZn4mJhUtZe0HPZGxMFBlZeE" age 8331 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230158-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 1918 x-jsd-version 1.2.3
GET H2	200	richtext.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/	8 KB 4 KB	32ms 31ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2147-I41v+oq443LPQB6aPqMil27q9QY" age 21485 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230147-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3918 x-jsd-version 1.10.2
GET H2	200	socialshare.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/	9 KB 4 KB	36ms 36ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-socialshare@1/socialshare.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash eafd7e17be354753ca120ef03d28aa45a37c423e89e9f2602e8fd5a24400f150 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"2385-rwl9CAsmlk954AGumYBzecK5wJE" age 9038 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220106-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 3619 x-jsd-version 1.3.1
GET H2	200	codehighlight.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/	4 KB 2 KB	43ms 42ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1254f8919b622330bce321d396d373e92655485778b03d3d1a04d493d44431ff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1182-meaOv3e3adqfyT4jIRjTa76pxz4" age 848 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230089-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 2031 x-jsd-version 1.5.2
GET H2	200	toc.js Show response cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/	22 KB 9 KB	33ms 33ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/@finsweet/attributes-toc@1/toc.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8f3080c9459e76305ed52789a727b30786b4d8e27da652424db04a22f42ad83d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"57aa-2Zkk0AqSUYYUIrrzTHESzGgsbdg" age 25730 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-etou8220054-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=604800, s-maxage=43200 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 8646 x-jsd-version 1.2.4
GET H2	200	jquery-3.5.1.min.dc5e7f18c8.js Show response d3e54v103j8qbb.cloudfront.net/js/	87 KB 32 KB	145ms 53ms	Script application/javascript	52.222.232.144 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=64deefeac57fbbefc32df53d Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.222.232.144 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-222-232-144.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3000 content-encoding br etag W/"dc5e7f18c8d36ac1d3d4753a87c98d0a" age 64699 access-control-allow-methods GET x-cache Hit from cloudfront x-amz-cf-id Jhm6lAYfnrNbQBq47ijU7138al6uDpRsaFeSZfTAnkPySMXkrTlz6Q== date Tue, 31 Dec 2024 01:33:25 GMT content-type application/javascript last-modified Mon, 20 Jul 2020 17:53:02 GMT vary accept-encoding cache-control max-age=84600, must-revalidate via 1.1 bb3ac1595bb014e3b09608a0358d33da.cloudfront.net (CloudFront) access-control-allow-origin * x-amz-cf-pop FRA56-P4 server AmazonS3
GET H3	200	cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Show response cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/	708 KB 173 KB	172ms 136ms	Script text/javascript	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/js/cyberhaven-2-0.03520d20b7fb49e779d23d8b6a2d3a31.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9c433a9098a5976b8d58b4371e89daafba4e0e9a05f5c880fe821355ba88684 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br cf-cache-status HIT etag W/"9792b65f944e5a2e92eae714f7201221" x-amz-version-id _GYyTxRjAFzEvmpHerpKKUquAFj9B32p age 216972 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type text/javascript last-modified Fri, 13 Dec 2024 17:48:45 GMT vary Accept-Encoding priority u=1,i=?0 x-amz-id-2 D2bsWaHyprSXvd87ue+PCwKZfSPnhiTzdxn/fJRHpvBk4DuC/lSOIvxw1bB0R4bnXgY2+4840u4CG7QbHlql0JpGqdVm0wnB cache-control public, max-age=31536000, immutable x-amz-request-id 289MC3GK1EGQP97Z cf-ray 8facb10cef73d379-FRA access-control-allow-origin * server cloudflare x-amz-server-side-encryption AES256
GET H2	200	form-124.js Show response hubspotonwebflow.com/assets/js/	10 KB 3 KB	179ms 66ms	Script application/javascript	66.33.60.129 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/form-124.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.129 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 10ef3ba5308697292067120aee8cea7f3341a9a5e691475bc4a29805a5194939 Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"392ca1f460caa2aa9439969a89f31c13" age 4151642 x-matched-path /assets/js/form-124.js access-control-allow-origin * date Tue, 31 Dec 2024 19:31:44 GMT content-disposition inline; filename="form-124.js" content-type application/javascript; charset=utf-8 server Vercel last-modified Wed, 13 Nov 2024 15:18:09 GMT x-vercel-id fra1::5r8p5-1735673504866-2be6ab2885f1
GET H2	200	gtm.js Show response www.googletagmanager.com/	412 KB 128 KB	163ms 76ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash bceb537eff109ff2629ed493e573f2ccf6c60170c8a091c9f14bb6405bcaf4ad Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],} expires Tue, 31 Dec 2024 19:31:45 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding last-modified Tue, 31 Dec 2024 18:00:00 GMT access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 129846 x-xss-protection 0 server Google Tag Manager
GET H3	200	676f447859d64b55526ac4ea_blog-hero-analysis.jpg cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	48 KB 49 KB	73ms 72ms	Image image/jpeg	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f447859d64b55526ac4ea_blog-hero-analysis.jpg Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 02aaf64a14db538fd05ce260e97c3f59f34a811893d73928062a45e84de742e1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-bgj h2pri etag "1a76135b309733c2491985966d6d0560" x-amz-version-id NJizZKGhA87OUnTBSjxtYx7nz4yGTCP8 cf-cache-status HIT age 320106 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type image/jpeg last-modified Sat, 28 Dec 2024 00:21:14 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 Qy3zrnZgmFsE/4dsuHi7OyUUHumWdIC39Esjw//AtgIAtK9oKqYj3qjTQshKhoYU8pG3K79yI+z+X9RwgX6NnA== cache-control max-age=31536000, must-revalidate x-amz-request-id 48X8RF9W2YEP8VSP cf-ray 8facb10dd8d4d379-FRA accept-ranges bytes access-control-allow-origin * content-length 49457 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	64ms 63ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237cb35841c0a2a5aeab_TWKLausanne-600.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bb3d04419609e6fa08a420ce68756b9bb81fc4ccde283575fb42ffc443e2caf3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "7017fb33ca20ea6252530f4175b595c6" x-amz-version-id nbgTfi_RoVFp7TQUfwt0fBsEIuZbE9lh age 1773322 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 gJhMn2Szeezt8PuGVLNAfz+oPTCXmHeCnPf6C14Hf6+WczXoQSvUeJv+ZErtYdEEW9GBl8NY4stVwvC3++0nIxMdwKCQXH9S1Eyr89nCsbk= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTCZ1ZWMJY9PQTZ cf-ray 8facb10de9143659-FRA accept-ranges bytes access-control-allow-origin * content-length 30936 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	81ms 80ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237db03e3fb9bb2a7e33_TWKLausanne-400.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3edff1ede4f95fec11b4ad510397682faac14c622267b92fe314f6860f6eba12 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "c74d82a73f65864871167b931348f7dd" x-amz-version-id 0K0YF9sKMHh27RzbO2HdYO7f4xfHi1Ni age 1773322 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 MCQEkNI9Skqtr9UHAlvblDXtXn39LUjYsuoQFWJpCnk8xjEAlGHCYc29sY+wKAKPHtqGdhoW3iD6nmRIMvp0B9f394igWsOQgIZcvgApZ8U= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVTC6W8VNHM33H8W cf-ray 8facb10de9173659-FRA accept-ranges bytes access-control-allow-origin * content-length 30952 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf53f_TWKLausanne-300.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	29 KB 30 KB	82ms 81ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf53f_TWKLausanne-300.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43e196dea1bb50052e39bb72d5146ca65dcbeddbb56ca9f939d85c39e152f219 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "b6399e7dcfa3936c0f20e75e8ea070c7" x-amz-version-id ZBYM2pzvY3d3.LCU5xbdDaV6IOyUyQV. age 1778192 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 m6ydf77jwkKftQxQBU+1M7YG7wNfzAtOdtxHC2HwfIJKxLWi12d9A5YS1hbQnKJVPkvqhNiPYyo= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id S0D843DW7FKQQXYN cf-ray 8facb10de9193659-FRA accept-ranges bytes access-control-allow-origin * content-length 30152 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	162ms 161ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e66d44d9e20361c433fb47_TWKLausanne-700.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 17e921e79da7db5200bf6306e57c9a561ff4dfa1215d250f15384aa0d23a1d23 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "698fbe394f26b24fe5bda79219e312ea" x-amz-version-id IB8aQpEKbkqJmVgCCA4g6ZnSKyG9yt.w age 990558 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 20:34:13 GMT x-amz-id-2 lWnJbBoYdD7v8nAlLgeBjKNMLGVzMxjjrSK0yEyJ4/DAyqXU6aLtiMepqs4AErNOc8hviv/0vj7qzy17gG6Az5fLNIwiAVP0CzNv3J3ZVNA= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id Q7X64X2SFZH10WMY cf-ray 8facb10de91c3659-FRA accept-ranges bytes access-control-allow-origin * content-length 31088 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	31 KB 32 KB	185ms 185ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237c520049c0328cf549_TWKLausanne-300Italic.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cf477dd7f1f2598513f268e5d86db59f2bf78cf5608b6d2b3bbede1ae015749d Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "1079ff010de8753eb2eea411463e0a91" x-amz-version-id OlnoJq_KD3p4L6Vhpcl.niE2c5DijABz age 1762920 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:25 GMT x-amz-id-2 CtRoGf0fu8vjwsk9g5jMaubzrfJ+qErHoNOnNfkVGIeVDyb1Y8ZOyc1MyU0EULHa/VVpuv19F0c= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id H0PJZEQK51F6QYXP cf-ray 8facb10de91d3659-FRA accept-ranges bytes access-control-allow-origin * content-length 31836 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	30 KB 31 KB	186ms 186ms	Font application/octet-stream	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/64e6237dee81e064c1dbbd48_TWKLausanne-800.woff2 Requested by Host: cdn.prod.website-files.com URL: https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6f80afcc11946f09caeaad7fdd4febb98bbb145a41e24bfd36bd482bdf70caa3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/css/cyberhaven-2-0.7fc24bcb1.min.css Response headers access-control-max-age 3000 cf-cache-status HIT etag "a1659b77956f1919811ab7b82c2276d5" x-amz-version-id YuICHYP_D8aK2yDWMfwtWbNeUZaHyz29 age 1778192 access-control-allow-methods GET, HEAD alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type application/octet-stream vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding last-modified Wed, 23 Aug 2023 15:19:26 GMT x-amz-id-2 P1Q3i9+ephkS6tkM7ppEHyk0CazjiDVvbQycOxzKRmlE4/0kfBKH/2djV9BYPTBYdHN/NH8ARZL9YS1fsmJ5/jrlxfmtwPWUEwihAsNp3hM= priority u=0,i=?0 cache-control max-age=31536000, must-revalidate x-amz-request-id DVT0KJSYE65TYGV5 cf-ray 8facb10de91e3659-FRA accept-ranges bytes access-control-allow-origin * content-length 30716 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f444c8108263f227e2659_Cyberhaven%20generic%20author.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	6 KB 7 KB	69ms 68ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f444c8108263f227e2659_Cyberhaven%20generic%20author.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 68e2330e1344b9b74b1fe80c5762cd25dc38d48e4729a68e9efb08dbd871342c Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "cc8175b9379835524077dbb651fc197f" x-amz-version-id Z7kNl.q4o2SWLNrLL6g88z625u7bIGzM age 320106 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:20:31 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ov4NQLfBHdAZF9TOgIKrXpnUY88Qs/dcrW9K7wQJQYQeYryhqSI9o+UwAWGTyn0dGTg5wChhLdoBEL/emH+7X5FadsBkGW3ZP6geHfvCP/k= cache-control max-age=31536000, must-revalidate x-amz-request-id 48XB49GWVZR1NZJE cf-ray 8facb10de8ffd379-FRA accept-ranges bytes access-control-allow-origin * content-length 6596 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	68 KB 69 KB	68ms 66ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb0539_676f4a9396033eb8cf6a1808_analysis-01b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash efd70a126766db0daeb2d0a39246bb00e2f5af423f2deceb8fb87febfe14970e Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "811b488ff94f4f0b1f857afb7930bec9" x-amz-version-id C86hd2YZSjKZzA88LiOcRnpQygUaeudY age 51389 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 DDrxYC2qlrdEhexHdG6s7Z+R/3REuezcM6Md535traQY3vxFInROKTawEqk1ypTe1+C3Z9ETAcc= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZJ5HCF7J11Y25H cf-ray 8facb10de903d379-FRA accept-ranges bytes access-control-allow-origin * content-length 70038 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png cdn.prod.website-files.com/64f0b4402cf68354b45974a0/	166 KB 167 KB	68ms 67ms	Image image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.prod.website-files.com/64f0b4402cf68354b45974a0/676f4ab951550a5babbb053c_676f4aa2c33fbdd3a98825d2_analysis-02b.png Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38949f97e6770288dcf96195e601480f85bf502a50da7a2a6907a932092ffd34 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "ecb0956c5cf844c67d6066e1516c449a" x-amz-version-id bmspAXoyD0XKi6M8Mov7dn7NUWsFM10o age 51385 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:44 GMT content-type image/png last-modified Sat, 28 Dec 2024 00:47:55 GMT vary Accept-Encoding priority u=3,i x-amz-id-2 ++QLBG/z6yn7VVAGKSHRgii8RQaPnUrHVmohLIgZuNErOwcTD/Zwig23TIP+/8v6o+IeKFK+/27AncA+Fb8tVz5CRnK5lF/eKt5njCxA/VU= cache-control max-age=84600, must-revalidate x-amz-request-id 56ZVTG2KN5E2DFA2 cf-ray 8facb10de905d379-FRA accept-ranges bytes access-control-allow-origin * content-length 170083 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	highlight.min.js Show response cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/	113 KB 40 KB	30ms 30ms	Script application/javascript	2a04:4e42:600::485 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/highlight.min.js Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 1828162a4978444dfe33f4cd1f977f17cd13cf7d0f413f8eb9bab9437239736d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"1c30f-0mStFr3znP7CsGwgIjuH/LN60ns" age 1098712 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript; charset=utf-8 x-served-by cache-fra-eddf8230041-FRA, cache-mxp6955-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 41100 x-jsd-version 11.4.0
GET H3	200	github-dark.min.css cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/	1 KB 998 B	33ms 32ms	Stylesheet text/css	151.101.129.229 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@11.4.0/build/styles/github-dark.min.css Requested by Host: cdn.jsdelivr.net URL: https://cdn.jsdelivr.net/npm/@finsweet/attributes-codehighlight@1/codehighlight.js Protocol H3 Security QUIC, , AES_256_GCM Server 151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 9f208d022102b1d0c7aebfecd8e42ca7997d5de636649d2b31ea63093d809019 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers * content-encoding br etag W/"523-oe0DT1osdtatoK9R3LMOLlr5NqA" age 1054893 x-content-type-options nosniff x-jsd-version-type version alt-svc h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400 x-cache HIT, HIT date Tue, 31 Dec 2024 19:31:45 GMT content-type text/css; charset=utf-8 x-served-by cache-fra-etou8220128-FRA, cache-mxp6950-MXP vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=31536000, s-maxage=31536000, immutable timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * content-length 619 x-jsd-version 11.4.0
GET H2	200	bda12b36-0455-47af-b8ba-9529bbb134fb.js Show response j.6sc.co/j/	4 KB 2 KB	452ms 345ms	Script application/javascript	23.50.131.152 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.50.131.152 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a23-50-131-152.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 73c5c9fb7e8e51a3af35769a05cac8b20493d7158c284c504f93eab13d0d53aa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip etag "2a619c6409aef52add1c19ae5d16a447" x-amz-version-id N26XcBiiU4KO8qPH4s3OdRIA551zYsKR expires Tue, 31 Dec 2024 20:01:45 GMT x-amz-cf-id knIeugceKYAUmi28Yd1mI7Acmi6V7K4m1CUPRCCRWBExYmK9ZGrjHA== date Tue, 31 Dec 2024 19:31:45 GMT last-modified Thu, 21 Sep 2023 21:57:20 GMT vary Accept-Encoding content-type application/javascript x-amz-meta-content-type application/json cache-control private, max-age=1800 accept-ranges bytes content-length 1444 x-amz-cf-pop FRA60-P8 server AmazonS3 x-amz-server-side-encryption AES256
POST H3	200	collect www.google.com/ccm/	0 0	131ms 49ms	Ping text/plain	142.250.186.164 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&scrsrc=www.googletagmanager.com&frm=0&rnd=1750876199.1735673505&auid=1099975824.1735673505&navt=n&npa=1&gtm=45He4cc1v832240631za200&gcd=13l3l3l2l1l1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735673505196&tfd=792&apve=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.164 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers
GET H2	200	js Show response www.googletagmanager.com/gtag/	422 KB 134 KB	69ms 68ms	Script application/javascript	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash e6e8e4ea6253f3997c60035f8f2f7b1b906b70084a6213af03fe4624c5755fb5 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding br report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],} expires Tue, 31 Dec 2024 19:31:45 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding access-control-allow-headers Cache-Control strict-transport-security max-age=31536000; includeSubDomains cache-control private, max-age=900 cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0 access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 136810 x-xss-protection 0 server Google Tag Manager
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	19 KB 8 KB	143ms 44ms	Script application/javascript	2a02:26f0:7100::1720:ee38 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::1720:ee38 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 6c0d4e3bd890a4bf01c9a301d3e3ff127af22636c4f94250cc230815eb701593 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding cache-control max-age=23018 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 7404 date Tue, 31 Dec 2024 19:31:45 GMT last-modified Wed, 18 Dec 2024 09:08:52 GMT content-type application/javascript;charset=utf-8 x-edgeconnect-midmile-rtt 0, 0, 0 x-edgeconnect-origin-mex-latency 470, 470, 470 x-amz-server-side-encryption AES256
GET H2	200	uwt.js Show response static.ads-twitter.com/	57 KB 16 KB	158ms 46ms	Script application/javascript	199.232.188.157 FASTLY
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 199.232.188.157 Munich, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers vary Accept-Encoding,Host cache-control no-cache content-encoding gzip etag "4328e910de583ad53b3a7a76455af005+gzip+gzip" accept-ranges bytes x-cache HIT, HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" content-length 15926 date Tue, 31 Dec 2024 19:31:45 GMT x-tw-cdn FT last-modified Tue, 29 Oct 2024 20:04:45 GMT content-type application/javascript; charset=utf-8 x-served-by cache-iad-kcgs7200099-IAD, cache-muc13936-MUC x-amz-server-side-encryption AES256
GET H2	200	hotjar-3169094.js Show response static.hotjar.com/c/	13 KB 6 KB	179ms 78ms	Script application/javascript	18.66.102.53 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.102.53 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-102-53.fra56.r.cloudfront.net Software / Resource Hash 85614f482b4df62aee6036babd3cadf391b7b4d7821fe0ea672ba55822904a85 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=60 content-encoding br etag W/548283dddd2f6446f829851cfc8f7813 cross-origin-resource-policy cross-origin x-content-type-options nosniff x-cache-hit 1 via 1.1 11e35514d631a9a9566fd489de935c06.cloudfront.net (CloudFront) access-control-allow-origin * x-cache Miss from cloudfront x-amz-cf-id 5jyLAoMwMnbqPeqvGht8eHqXJEn35wNab3D1I_1vWXdOBcw9QpnTaQ== date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript; charset=UTF-8 vary Accept-Encoding x-amz-cf-pop FRA56-P2
GET H2	200	2985.js Show response script.crazyegg.com/pages/scripts/0115/	7 KB 3 KB	132ms 44ms	Script text/javascript	2606:4700::6813:9308 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/scripts/0115/2985.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0d810efe03fa42a406546c8b52a2b9623d2625938f7e1048fba55a71f99eafa Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 10893 alt-svc h3=":443"; ma=86400 date Tue, 31 Dec 2024 19:31:45 GMT content-type text/javascript last-modified Tue, 31 Dec 2024 16:23:02 GMT vary Accept-Encoding cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8facb1102d95bad6-MXP accept-ranges bytes access-control-allow-origin * content-length 2480 ce-version 11.5.340 server cloudflare
GET H2	200	pixel.js Show response www.redditstatic.com/ads/	43 KB 13 KB	105ms 31ms	Script application/javascript	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/pixel.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=60 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip etag "1a001f3a066bff47a766099b87253911" report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish, 1.1 varnish accept-ranges bytes content-length 12220 date Tue, 31 Dec 2024 19:31:45 GMT last-modified Mon, 18 Nov 2024 21:16:35 GMT content-type application/javascript vary Accept-Encoding,Origin server snooserv x-amz-server-side-encryption AES256
GET H3	200	fbevents.js Show response connect.facebook.net/en_US/	239 KB 61 KB	112ms 52ms	Script application/x-javascript	157.240.252.13 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra3.fbcdn.net Software / Resource Hash 24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-szXCEgUn' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-szXCEgUn' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality GOOD; q=0.7, rtt=50, rtx=0, c=23, mss=1232, tbw=4479, tp=9, tpl=0, uplat=1, ullat=-1 pragma public x-fb-debug ml8laEl/GB4Ntvr1/Vi3UiAxLP2Hto/+60yDvvWo6ik9zzWgOLmebGHcf8id7eGYg5j1BNn/2y1UQc8HUVOC6A== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top content-length 62282 x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	ga.js Show response ssl.google-analytics.com/	45 KB 17 KB	160ms 47ms	Script text/javascript	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ssl.google-analytics.com/ga.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip age 5642 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:215:0"}],} x-content-type-options nosniff expires Tue, 31 Dec 2024 19:57:43 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 17:57:43 GMT last-modified Tue, 12 Dec 2023 18:09:08 GMT content-type text/javascript vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload cache-control public, max-age=7200 cross-origin-resource-policy cross-origin content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:215:0 cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 17168 server Golfe2
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/	16 KB 5 KB	326ms 219ms	Script application/javascript	2600:9000:2670:4400:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2670:4400:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Clearbit / Resource Hash 11e852bb791058078812ff8c0780eee92054fbaad4e03ca2f4263576ee487ac7 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip etag W/"baf7329e47c04b0ab497040e04f53af5" x-envoy-response-flags - x-content-type-options nosniff via 1.1 b83db9a9904a8f97beb31f810804b6e4.cloudfront.net (CloudFront) x-cache Miss from cloudfront x-amz-cf-id oyLaF_2AJAmti3TC8YXg6T0sz-YCLkY4vp1-Cf2BxKM4GfXNPSSvxg== date Tue, 31 Dec 2024 19:31:44 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit x-amz-cf-pop FRA56-P9
GET H3	200	62febdf93e32fb008eef5596 Show response ws.zoominfo.com/pixel/	3 KB 2 KB	369ms 307ms	Script text/javascript	104.16.117.43 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/62febdf93e32fb008eef5596 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 2e30362b2c194170674e1a25fe136884e6177bf9bcbd05fecbdc7302b2bbb32e Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Response headers x-robots-tag noindex, nofollow content-encoding gzip cf-cache-status DYNAMIC x-content-type-options nosniff alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:45 GMT content-type text/javascript vary Accept-Encoding priority u=3,i=?0 access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url access-control-allow-credentials true via 1.1 google cf-ray 8facb110bb9bdcd0-FRA access-control-allow-origin * x-powered-by Express server cloudflare
GET H3	200	warmly.js Show response opps-widget.getwarmly.com/	1 KB 2 KB	151ms 88ms	Script text/javascript	188.114.96.9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b64ac9b7bf876d9264e9eebf36cc6385fcc3519947a89c5846dda7e04f7a070e Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status BYPASS etag W/"4c09ae33bcd4d090ac6377d96d5856783350463d2be8c5e352371aa9207cbc00-br" x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nmjGgK5O%2Bu53op9%2BRRm74f%2B7QWhLT%2FMWzDfMNrO4lwrV8gxqC%2BLD2MOGwp6ceS589px2MIlgtGka1z9sZDm%2FwU8HyF56sYEjsRToLRs4PudtnQ%2B%2F%2BeyJBm9OKEKEM3LctNE00s4dwACOt2oe"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache MISS server-timing cfL4;desc="?proto=QUIC&rtt=42073&min_rtt=41489&rtt_var=9651&sent=12&recv=9&lost=0&retrans=0&sent_bytes=4168&recv_bytes=4357&delivery_rate=13347&cwnd=12000&unsent_bytes=0&cid=9e669da3641a154c&ts=91&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 31 Dec 2024 19:31:45 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230177-FRA x-cache-hits 0 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control no-cache, no-store, must-revalidate nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=3,i=?0 x-timer S1735673505.424215,VS0,VE30 referrer-policy origin-when-cross-origin cf-ray 8facb110de6bd265-FRA access-control-allow-origin * server cloudflare
GET H2	200	5298086.js Show response js-na1.hs-scripts.com/	2 KB 1 KB	120ms 46ms	Script application/javascript	2606:4700::6810:8ad1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-na1.hs-scripts.com/5298086.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:8ad1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0b026ed9aa9cb515d72554e36d54fb27e986e1a6f8b0718d4879908008b0de05 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-max-age 3600 content-encoding gzip cf-cache-status HIT age 5363 x-content-type-options nosniff date Tue, 31 Dec 2024 19:31:45 GMT x-hubspot-correlation-id c4b204fe-b298-43c7-84e3-1507a0d73b04 content-type application/javascript;charset=utf-8 vary origin, Accept-Encoding last-modified Tue, 31 Dec 2024 16:36:43 GMT access-control-allow-credentials true cf-ray 8facb110ec02ed2d-MXP accept-ranges bytes access-control-allow-origin https://www.cyberhaven.com content-length 652 server cloudflare
GET H2	200	array.js Show response us-assets.i.posthog.com/static/	175 KB 62 KB	217ms 141ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/array.js Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 194433cfcf698601025b3b524cabab64841800b5467ec6e199de7f9169b5fd34 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 25 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8facb110fda3ed97-MXP access-control-allow-origin * date Tue, 31 Dec 2024 19:31:45 GMT content-type text/javascript; charset="utf-8" last-modified Tue, 31 Dec 2024 16:10:33 GMT vary Accept-Encoding server cloudflare
GET H2	200	web gtm-server.cyberhaven.com/measurement/	35 B 386 B	484ms 393ms	Image image/gif	34.8.125.141 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://gtm-server.cyberhaven.com/measurement/web?event_name=page_view&event_id=1735673859756_17356744055551&page_location=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension%3Ffbclid%3Dnull%26li_fat_id%3Dnull Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.8.125.141 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 141.125.8.34.bc.googleusercontent.com Software Google Frontend / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache via 1.1 google expires Thu, 01 Jan 1970 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT content-type image/gif server Google Frontend
GET H2	200	sw_iframe.html www.googletagmanager.com/static/service_worker/4cc0/ Frame 96FA	0 0	162ms 52ms	Document text/html	2a00:1450:4001:813::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.cyberhaven.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-TVS7L5L Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes age 283586 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control public, max-age=31536000 content-encoding br content-length 1476 content-type text/html cross-origin-opener-policy same-origin; report-to="analytics-container-tag-serving" cross-origin-resource-policy cross-origin date Sat, 28 Dec 2024 12:45:19 GMT expires Sun, 28 Dec 2025 12:45:19 GMT last-modified Thu, 12 Dec 2024 10:18:00 GMT report-to {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]} server sffe service-worker-allowed /static/service_worker vary Accept-Encoding x-content-type-options nosniff x-xss-protection 0
POST H2	204	collect region1.analytics.google.com/g/	0 0	148ms 54ms	Fetch text/plain	2001:4860:4802:34::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-WLE78NS0JZ&gtm=45je4cc1v890707664z8832240631za200zb832240631&_p=1735673504905&_gaz=1&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=391008345.1735673505&ul=it-it&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EA&_s=1&sid=1735673505&sct=1&seg=0&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&ep.clean_url=www.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.clean_path=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&ep.level1=engineering-blog&ep.level2=cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tfd=927 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT content-type text/plain server Golfe2
POST H2	204	collect stats.g.doubleclick.net/g/	0 548 B	164ms 54ms	Ping text/plain	2a00:1450:400c:c0c::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-WLE78NS0JZ&cid=391008345.1735673505&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-WLE78NS0JZ&l=dataLayer&cx=c&gtm=45He4cc1v832240631za200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin access-control-allow-credentials true content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0 report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],} expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin https://www.cyberhaven.com cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT content-type text/plain server Golfe2
GET H2	200	ga-audiences www.google.it/ads/	42 B 408 B	170ms 52ms	Image image/gif	2a00:1450:4001:828::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.it/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-WLE78NS0JZ&cid=391008345.1735673505&gtm=45je4cc1v890707664z8832240631za200zb832240631&aip=1&dma=1&dma_cps=syphamo&gcd=13l3l3l2l1l1&npa=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1336030742 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate timing-allow-origin * pragma no-cache cross-origin-resource-policy cross-origin x-content-type-options nosniff expires Fri, 01 Jan 1990 00:00:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-length 42 date Tue, 31 Dec 2024 19:31:45 GMT x-xss-protection 0 content-type image/gif server cafe
GET H2	200	config Show response pixel-config.reddit.com/pixels/t2_kk14jgkb/	3 B 124 B	107ms 36ms	XHR application/json	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Full URL https://pixel-config.reddit.com/pixels/t2_kk14jgkb/config Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=14400 content-encoding gzip via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 27 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/json
GET H2	200	t2_kk14jgkb_telemetry Show response www.redditstatic.com/ads/conversions-config/v1/pixel/config/	86 B 700 B	104ms 39ms	XHR application/json	2a04:4e42:400::396 FASTLY
General Check archive.org Show headers Download Go to Full URL https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_kk14jgkb_telemetry Requested by Host: www.redditstatic.com URL: https://www.redditstatic.com/ads/pixel.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::396 , United States, ASN54113 (FASTLY, US), Reverse DNS Software snooserv / Resource Hash 98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=300 nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02} content-encoding gzip report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes access-control-allow-origin * content-length 98 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/json vary Accept-Encoding,Origin server snooserv
GET H2	200	rp.gif alb.reddit.com/	42 B 637 B	215ms 129ms	Image image/gif	151.101.1.140 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://alb.reddit.com/rp.gif?ts=1735673505340&id=t2_kk14jgkb&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=b50bd7fe-bafc-4f46-9aba-1eeb75886908&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc= Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.1.140 San Francisco, United States, ASN54113 (FASTLY, US), Reverse DNS Software Varnish / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers nel {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3} retry-after 0 cross-origin-resource-policy cross-origin report-to {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]} via 1.1 varnish accept-ranges bytes content-length 42 date Tue, 31 Dec 2024 19:31:45 GMT content-type image/gif server Varnish
GET H3	200	www.cyberhaven.com.json Show response script.crazyegg.com/pages/data-scripts/0115/2985/site/	1 KB 755 B	109ms 54ms	XHR application/json	104.19.147.8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://script.crazyegg.com/pages/data-scripts/0115/2985/site/www.cyberhaven.com.json?t=1 Requested by Host: script.crazyegg.com URL: https://script.crazyegg.com/pages/scripts/0115/2985.js Protocol H3 Security QUIC, , AES_128_GCM Server 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d4af7e91a4c056bf85e9d51f2d798b7e6a2da59c029ee455a7fa6fb7c7996058 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers access-control-expose-headers CE-Version content-encoding gzip cf-cache-status HIT age 11323 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:45 GMT content-type application/json last-modified Tue, 31 Dec 2024 16:23:02 GMT vary Accept-Encoding priority u=1,i cache-control public, max-age=300, s-maxage=1209600 timing-allow-origin * cf-ray 8facb110dd2191fc-FRA accept-ranges bytes access-control-allow-origin * content-length 474 ce-version 11.5.340 server cloudflare
GET H2	200	insight.old.min.js Show response snap.licdn.com/li.lms-analytics/	40 KB 14 KB	41ms 41ms	Script application/javascript	2a02:26f0:7100::1720:ee38 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.old.min.js Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100::1720:ee38 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 8a27dc7b44ebe886390bfa0a9beeea36ea5a3f37479f0e0836b6c9b80d9b35ed Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=26234 content-encoding gzip x-cdn AKAM x-content-type-options nosniff accept-ranges bytes content-length 14628 date Tue, 31 Dec 2024 19:31:45 GMT last-modified Mon, 02 Dec 2024 10:13:56 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding x-amz-server-side-encryption AES256
GET H2	200	adsct t.co/1/i/	43 B 628 B	326ms 230ms	Image image/gif	162.159.140.229 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=dfb67dd3-c811-48d4-a728-2d332e2a465c&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=5bc469ea-37b8-41e4-82da-7e74ffded36b&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.229 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=0 x-transaction-id cd1ba4c9363dbc02 cache-control no-cache, no-store, max-age=0 x-connection-hash 73afab5b5e7e518e81c04698bcc09d12c65feb5672e8727c9e5afb0f05c19374 cf-cache-status DYNAMIC cf-ray 8facb1115d4671b5-FRA x-response-time 174 content-length 43 date Tue, 31 Dec 2024 19:31:45 GMT content-type image/gif;charset=utf-8 perf 7402827104 server cloudflare tsa_o
GET H2	200	adsct analytics.twitter.com/1/i/	43 B 725 B	260ms 147ms	Image image/gif	104.244.42.131 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/1/i/adsct?bci=4&dv=Europe%2FRome%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2628%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=dfb67dd3-c811-48d4-a728-2d332e2a465c&integration=gtm&p_id=Twitter&p_user_id=0&pl_id=5bc469ea-37b8-41e4-82da-7e74ffded36b&tw_document_href=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tw_iframe_status=0&txn_id=o99zx&type=javascript&version=2.3.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.131 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=631138519 x-transaction-id 1d1dbd33f4420d74 cache-control no-cache, no-store, max-age=0 x-connection-hash ecd7ded4f0ec1a2e2a43859fa29fcdb55b82c279c62df18072c38e855f514697 x-response-time 101 content-length 43 date Tue, 31 Dec 2024 19:31:45 GMT perf 7402827104 content-type image/gif;charset=utf-8 server tsa_o
GET H3	200	321517546861767 Show response connect.facebook.net/signals/config/	69 KB 14 KB	226ms 225ms	Script application/x-javascript	157.240.252.13 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/321517546861767?v=2.9.179&r=stable&domain=www.cyberhaven.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS xx-fbcdn-shv-01-fra3.fbcdn.net Software / Resource Hash eb24f0f3a43ff4aac43ed08c045e810d847652a5393b3db67de9f6c055deebc5 Security Headers Name Value Content-Security-Policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-pFvKOiAo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding gzip report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" priority u=3,i x-frame-options DENY strict-transport-security max-age=31536000; preload; includeSubDomains reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;script-src 'nonce-pFvKOiAo' *.fbcdn.net *.facebook.net blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';img-src 'self' data: blob: facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script'; cache-control public, max-age=1200 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups x-fb-connection-quality GOOD; q=0.7, rtt=52, rtx=0, c=77, mss=1232, tbw=70495, tp=65, tpl=0, uplat=174, ullat=0 pragma public x-fb-debug cSSu48b3EDZIZi0+auJqqxuEr53M8xDwyRhK7ikOmHfSM1gD6uvk4SPYJf59I3NJPlTd+/T8JO6+N0sCDjEKCA== cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	__utm.gif ssl.google-analytics.com/r/	35 B 410 B	56ms 55ms	Image image/gif	2a00:1450:4001:829::2008 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2135758302&utmhn=www.cyberhaven.com&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=it-it&utmje=0&utmfl=-&utmhid=293376079&utmr=-&utmp=%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&utmht=1735673505396&utmac=UA-XXXYYYZZZ-1&utmcc=__utma%3D154243370.391008345.1735673505.1735673505.1735673505.1%3B%2B__utmz%3D154243370.1735673505.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=28125047&utmredir=1&utmu=qhAgAAAAAAAAAAAAAAABAAAE~ Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-cache, no-store, must-revalidate pragma no-cache cross-origin-resource-policy cross-origin report-to {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:169:0"}],} x-content-type-options nosniff content-security-policy-report-only script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:169:0 expires Fri, 01 Jan 1990 00:00:00 GMT access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to=coop_reporting content-length 35 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 31 Dec 2024 19:31:45 GMT last-modified Sun, 17 May 1998 03:00:00 GMT content-type image/gif server Golfe2
GET H2	200	modules.60031afbf51fb3e88a5b.js Show response script.hotjar.com/	223 KB 56 KB	152ms 52ms	Script application/javascript	13.33.187.74 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js Requested by Host: static.hotjar.com URL: https://static.hotjar.com/c/hotjar-3169094.js?sv=7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.33.187.74 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-33-187-74.fra60.r.cloudfront.net Software / Resource Hash e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none content-encoding br etag "b4a1a7933e55e780894c3f39b1aca0b4" age 1150838 x-content-type-options nosniff x-cache Hit from cloudfront x-amz-cf-id oqV7qWubptc_B1JUIkJJb2NS7nGrHIp2N1ASD27dyjEbp6278-Qing== date Wed, 18 Dec 2024 11:51:07 GMT content-type application/javascript; charset=utf-8 last-modified Wed, 18 Dec 2024 11:50:24 GMT vary Accept-Encoding strict-transport-security max-age=2592000; includeSubDomains cache-control max-age=31536000 cross-origin-resource-policy cross-origin via 1.1 ad82d8a80f2c6497aad660c7722475c0.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin * content-length 56408 x-amz-cf-pop FRA60-P9
GET H2	200	attribution_trigger Show response px.ads.linkedin.com/	2 B 814 B	293ms 191ms	XHR application/json	2620:1ec:21::14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://px.ads.linkedin.com/attribution_trigger?pid=1962740&time=1735673505406&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2 Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.old.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept * Referer https://www.cyberhaven.com/ Response headers x-li-pop afd-prod-ltx1-x content-encoding gzip x-fs-uuid 00062a95fabf44d5c95844296ac5ccd1 x-msedge-ref Ref A: 715CFD12DA68435AA666432345A5D78F Ref B: ZRHEDGE1018 Ref C: 2024-12-31T19:31:45Z x-li-fabric prod-ltx1 x-restli-protocol-version 1.0.0 access-control-allow-methods GET, OPTIONS x-li-uuid AAYqlfq/RNXJWEQpasXM0Q== x-li-proto http/2 access-control-allow-origin * x-cache CONFIG_NOCACHE date Tue, 31 Dec 2024 19:31:45 GMT content-type application/json access-control-allow-headers *
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recen...	0 267 B	365ms 206ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQLr9v9WUudcewAAAZQeM-ezJP3AbUMP_mM7f31FFqlUyiKlcSbjiaMD9NRDrglIKxs-og Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers linkedin-action 1 x-li-pop afd-prod-lor1-x x-msedge-ref Ref A: EBA77B2C48934CD2BA73620F37EDAC8F Ref B: MIL30EDGE1209 Ref C: 2024-12-31T19:31:45Z x-li-fabric prod-lor1 x-li-uuid AAYqlfrGlrZWwSjBR2FyiA== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript Redirect headers linkedin-action 1 x-li-pop afd-prod-lor1-x location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1962740&time=1735673505406&li_fat_id=none&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&tm=gtmv2&e_ipv6=AQLr9v9WUudcewAAAZQeM-ezJP3AbUMP_mM7f31FFqlUyiKlcSbjiaMD9NRDrglIKxs-og x-msedge-ref Ref A: C1FCF059CAA14FE2BC6BE4AF4202D5A6 Ref B: ZRHEDGE1419 Ref C: 2024-12-31T19:31:45Z x-li-fabric prod-lor1 x-li-uuid AAYqlfrA/ZYMfTB7bxqeSA== x-li-proto http/2 x-cache CONFIG_NOCACHE content-length 0 date Tue, 31 Dec 2024 19:31:44 GMT
GET H2	200	config.js Show response us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/	963 B 774 B	439ms 439ms	Script application/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/array/phc_xjBlifGuJIVny2AT9hEuGP8N265nGHp6Z04D9KykSmS/config.js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 224f0faed26a56018f3d6f3d5e8fe2dda990c262ca0903c723145d2b47d1b108 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status EXPIRED x-content-type-options nosniff date Tue, 31 Dec 2024 19:31:46 GMT content-type application/javascript vary Origin, Referer, Accept-Encoding last-modified Tue, 31 Dec 2024 19:31:46 GMT x-frame-options SAMEORIGIN cache-control max-age=300 cross-origin-opener-policy same-origin x-envoy-upstream-service-time 22 referrer-policy same-origin allow GET, HEAD, OPTIONS cf-ray 8facb1121ee6ed97-MXP accept-ranges bytes access-control-allow-origin * content-length 553 server cloudflare
POST H2	200	/ Show response us.i.posthog.com/decide/	861 B 836 B	510ms 130ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/decide/?v=3&ip=1&_=1735673505601&ver=1.203.1&compression=base64 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash c28e2af4e14aafdc9b247281d5aa398e81f6c95a1543caa0fdc786ffe4552856 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/x-www-form-urlencoded Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 8 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Tue, 31 Dec 2024 19:31:46 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
POST H2	200	/ Show response us.i.posthog.com/e/	13 B 415 B	502ms 128ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/e/?ip=1&_=1735673505605&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash 7d4afed20a912db310862a5294bcf8fb6269c76a292908ddc1fbd496456eff56 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 7 access-control-allow-credentials true x-content-type-options nosniff referrer-policy same-origin access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin https://www.cyberhaven.com date Tue, 31 Dec 2024 19:31:46 GMT content-type application/json vary Accept-Encoding server envoy access-control-allow-headers X-Requested-With,Content-Type
GET H3	200	/ www.facebook.com/tr/	0 19 B	95ms 44ms	Image text/plain	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1735673505627&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735673505627.3965440628522033&ler=empty&cdl=API_unavailable&it=1735673505388&coo=false&eid=1735673859756_17356744055551&tm=1&exp=j3&rqm=GET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=31536000; includeSubDomains x-fb-connection-quality EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4526, tp=10, tpl=0, uplat=0, ullat=0 cross-origin-resource-policy cross-origin access-control-allow-credentials true access-control-allow-origin alt-svc h3=":443"; ma=86400 content-length 0 date Tue, 31 Dec 2024 19:31:45 GMT content-type text/plain server proxygen-bolt priority u=3,i
GET H3	200	/ www.facebook.com/privacy_sandbox/pixel/register/trigger/	67 B 194 B	244ms 193ms	Image image/png	157.240.0.35 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=321517546861767&ev=PageView&dl=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&rl=&if=false&ts=1735673505627&sw=1600&sh=1200&v=2.9.179&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1735673505627.3965440628522033&ler=empty&cdl=API_unavailable&it=1735673505388&coo=false&eid=1735673859756_17356744055551&tm=1&exp=j3&rqm=FGET Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H3 Security QUIC, , AES_128_GCM Server 157.240.0.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS edge-star-mini-shv-02-fra3.facebook.com Software / Resource Hash aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a Security Headers Name Value Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=15552000; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers content-encoding zstd report-to {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7454660940548007518"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"} x-content-type-options nosniff expires Sat, 01 Jan 2000 00:00:00 GMT alt-svc h3=":443"; ma=86400 attribution-reporting-register-trigger {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[{"key_piece":"0x388744eefc87a3b9","source_keys":["1"]}],"aggregatable_values":{"1":10922},"aggregatable_source_registration_time":"exclude","filters":{"3":["5988309531205427"]},"debug_reporting":true,"debug_key":"1736519979091989247"} date Tue, 31 Dec 2024 19:31:45 GMT content-type image/png vary Accept-Encoding x-fb-debug nlB/NHUZKRerzj9B5uizQ6uyssRHHGcib6WK8jsZcJed+Fo03hW1teknXUpAqmYwCyb2Rmg8tLHOhLmeML8ALQ== priority u=3,i x-frame-options DENY strict-transport-security max-age=15552000; preload reporting-endpoints coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7454660940548007518", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/" content-security-policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net 'unsafe-inline' blob: data: 'self' 'wasm-unsafe-eval';style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster: *.oculuscdn.com https://paywithmybank.com/ https://*.paywithmybank.com/;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data:;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; cache-control private, no-store, no-cache, must-revalidate x-fb-connection-quality EXCELLENT; q=0.9, rtt=41, rtx=0, c=23, mss=1232, tbw=4894, tp=13, tpl=0, uplat=149, ullat=0 cross-origin-opener-policy same-origin-allow-popups pragma no-cache cross-origin-resource-policy cross-origin permissions-policy accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy" document-policy force-load-at-top x-xss-protection 0 origin-agent-cluster ?1
GET H2	200	6si.min.js Show response j.6sc.co/	68 KB 19 KB	42ms 42ms	Script application/javascript	23.50.131.152 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: j.6sc.co URL: https://j.6sc.co/j/bda12b36-0455-47af-b8ba-9529bbb134fb.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.50.131.152 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a23-50-131-152.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 91c20c70d36b608cf919e894b0ac9e32298d6b3ac3ca59c45a85e7c44161d170 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control private, proxy-revalidate, max-age=10800 content-encoding gzip etag "6763d39f-1110f" x-content-type-options nosniff expires Tue, 31 Dec 2024 22:31:45 GMT accept-ranges bytes content-length 18919 date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript vary Accept-Encoding server nginx/1.14.0 (Ubuntu) last-modified Thu, 19 Dec 2024 08:04:47 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	0 44 B	632ms 301ms	Script application/javascript	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 x-envoy-response-flags - x-content-type-options nosniff content-length 0 date Tue, 31 Dec 2024 19:31:46 GMT content-type application/javascript;charset=utf-8 server Clearbit
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/	168 KB 45 KB	589ms 259ms	Script application/javascript	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_f66c385ed3fdc603b0d55a943ee4cb81/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash 9be0e78d405feaf2f28eaa33d8f8b0c298c5385a546d825fba34e81aed740be0 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload cache-control private, max-age=600 content-encoding gzip x-envoy-response-flags - x-content-type-options nosniff date Tue, 31 Dec 2024 19:31:45 GMT content-type application/javascript;charset=utf-8 vary Accept-Encoding server Clearbit
GET H2	200	collectedforms.js Show response js.hscollectedforms.net/	70 KB 25 KB	125ms 51ms	Script application/javascript	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hscollectedforms.net/collectedforms.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers x-request-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-encoding gzip cf-cache-status HIT x-amz-version-id 8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_ etag W/"ceb8bcb73e5536d8416735a3977d227a" cache-tag staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod x-content-type-options nosniff x-cache Hit from cloudfront x-evy-trace-listener listener_https x-amz-cf-id 8WfkRX3JAvexG5l-W6G4VtYiAK3XggMdfy0nlP-0JfveLJ71QnecPQ== x-hubspot-correlation-id 343e1c98-bbab-4efa-88f4-aac0c775a7f7 content-type application/javascript; charset=utf-8 last-modified Mon, 09 Dec 2024 13:03:17 UTC x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control s-maxage=600, max-age=300 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-4w2hc x-envoy-upstream-service-time 5 x-hs-target-asset collected-forms-embed-js/static-1.1112/bundles/project.js server cloudflare x-evy-trace-virtual-host all x-amz-server-side-encryption AES256 access-control-max-age 3000 access-control-allow-methods GET x-hs-cache-status MISS date Tue, 31 Dec 2024 19:31:45 GMT vary Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8ef5bfb0bfdeedcb-FRA via 1.1 e21fbbed60133ff896ee44224814dc5c.cloudfront.net (CloudFront) cf-ray 8facb1130a15edc3-MXP access-control-allow-origin * x-evy-trace-route-configuration listener_https/all x-amz-cf-pop IAD12-P3
GET H2	200	conversations-embed.js Show response js.usemessages.com/	94 KB 27 KB	113ms 39ms	Script application/javascript	2606:4700::6810:4d8e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.usemessages.com/conversations-embed.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4d8e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d2b03470a7d1ae7aba4f78432a23655d3e5092f63312f3dcc3bd1f3e2ed7ec5 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all x-request-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-encoding gzip cf-cache-status HIT etag W/"4dfe3f6f9786f2063afe9a04ac031914" x-amz-version-id fDaori16DhigsoRwsdU7m4W4sxmAcg6S cache-tag staticjsapp-conversations-embed-web-prod,staticjsapp-prod age 28 x-content-type-options nosniff x-cache Hit from cloudfront x-hs-cache-status HIT x-amz-cf-id j-SnkIpB8dxYR4_xkUb1_co81133geiWWU2BVr0S_m3zvz2sOR5wuw== date Tue, 31 Dec 2024 19:31:45 GMT x-hubspot-correlation-id 84fd835d-eadb-4cfc-b2ae-2ef9ea5adaa2 content-type application/javascript; charset=utf-8 last-modified Tue, 17 Dec 2024 16:16:40 UTC vary accept-encoding x-evy-trace-listener listener_https x-amz-replication-status COMPLETED x-evy-trace-route-service-name envoyset-translator cache-control max-age=600 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-mglm2 x-envoy-upstream-service-time 0 content-security-policy-report-only frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-embed/static-1.19372/bundles/project.js&cfRay=8f76c22c89cd8fd6-FRA via 1.1 b77313059f3d50280ced20238b151620.cloudfront.net (CloudFront) cf-ray 8facb1130cc9ee63-MXP x-evy-trace-route-configuration listener_https/all x-hs-target-asset conversations-embed/static-1.19372/bundles/project.js x-amz-cf-pop IAD12-P3 server cloudflare x-amz-server-side-encryption AES256
GET H2	200	5298086.js Show response js.hs-analytics.net/analytics/1735662900000/	68 KB 25 KB	271ms 198ms	Script text/javascript	2606:4700::6810:a0a8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-analytics.net/analytics/1735662900000/5298086.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash deff21bdd3cf5ec27f508fe5d3e13bcd67ffb7dda68e07d97582cddc6ab4e7f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-amz-server-side-encryption AES256 x-request-id eeba329f-072e-4d70-99f5-6bde19d1f44d content-encoding gzip cf-cache-status REVALIDATED etag W/"db94dc959471013f74dd433982c87807" x-amz-version-id null expires Tue, 31 Dec 2024 19:36:45 GMT x-evy-trace-listener listener_https date Tue, 31 Dec 2024 19:31:45 GMT x-hubspot-correlation-id eeba329f-072e-4d70-99f5-6bde19d1f44d content-type text/javascript last-modified Wed, 06 Nov 2024 18:35:26 GMT vary origin, Accept-Encoding x-amz-id-2 xLC66VY8XCzsyoAp06ioGzA0exbjXxW3yBtW+zFD9PwgtLNgaM03hzGv4RA3AlCc5uXTJ0g2X33lVTFfOMt/AspRpU59U2MeFsWbOiDQcRA= x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-ds2fh x-envoy-upstream-service-time 52 access-control-allow-credentials false x-amz-request-id XNN149A4GM0HF9D1 cf-ray 8facb1132d990d64-MXP x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	banner.js Show response js.hs-banner.com/v2/5298086/	71 KB 26 KB	467ms 196ms	Script text/javascript	2606:4700:4400::6812:28f0 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js.hs-banner.com/v2/5298086/banner.js Requested by Host: js-na1.hs-scripts.com URL: https://js-na1.hs-scripts.com/5298086.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:28f0 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1f5bfd29b1b65351bdeec611c0f02131e5a8a7336e2d87075b15dff2b7f3f8f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-evy-trace-virtual-host all access-control-max-age 604800 x-request-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea access-control-expose-headers x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing content-encoding gzip cf-cache-status REVALIDATED etag W/"70c5670e6d77885ece19beb74afe4af5" x-amz-version-id GcEt1rgO1vU4WsJ6afMIGzER7IXMa_OI access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD expires Tue, 31 Dec 2024 19:36:46 GMT x-evy-trace-listener listener_https date Tue, 31 Dec 2024 19:31:46 GMT x-hubspot-correlation-id 5d5c3310-3db7-4dd2-b9fb-d7217260cbea content-type text/javascript; charset=UTF-8 last-modified Thu, 24 Oct 2024 19:19:32 GMT vary origin, Accept-Encoding x-amz-id-2 MQCYBvG4V5+djwpG0cU2tMuf/xfG+OQ3887eGE3FR+ewuikvYiayuXnhJbexmo5WsCK+SjZoz4I= access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id x-evy-trace-route-service-name envoyset-translator cache-control max-age=300,public timing-allow-origin * x-evy-trace-served-by-pod iad02/analytics-js-proxy-td/envoy-proxy-58b4c4568d-85276 x-envoy-upstream-service-time 156 access-control-allow-credentials true x-amz-request-id 6NB4N8W9R5GSAPVD cf-ray 8facb1147cc6ed2c-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-amz-server-side-encryption AES256
GET H2	200	getuidj Show response secure.adnxs.com/	11 B 705 B	322ms 44ms	XHR application/json	37.252.172.123 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US), Reverse DNS 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.23.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control no-store, no-cache, private pragma no-cache accept-ch Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness access-control-allow-credentials true x-proxy-origin 192.145.127.221; 192.145.127.221; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com expires Sat, 15 Nov 2008 16:00:00 GMT access-control-allow-origin https://www.cyberhaven.com an-x-request-uuid 5efa3225-ffef-48ac-8f7a-7fa9618acdb6 content-length 11 p3p policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" date Tue, 31 Dec 2024 19:31:45 GMT x-xss-protection 0 content-type application/json; charset=utf-8 server nginx/1.23.4
GET H/1.1	200 OK	/ Show response c.6sc.co/	7 B 332 B	319ms 41ms	XHR text/html	95.101.111.184 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 95.101.111.184 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-184.deploy.static.akamaitechnologies.com Software / Resource Hash fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers Access-Control-Max-Age 86400 Connection keep-alive Access-Control-Allow-Credentials true Access-Control-Allow-Methods GET,POST Access-Control-Allow-Origin https://www.cyberhaven.com Content-Length 7 Date Tue, 31 Dec 2024 19:31:45 GMT Content-Type text/html Access-Control-Allow-Headers *
GET H2	200	/ Show response ipv6.6sc.co/	18 B 312 B	328ms 50ms	XHR text/html	2a02:26f0:480:23::1726:62a7 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Full URL https://ipv6.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:23::1726:62a7 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS Software / Resource Hash 96f703972fc7351119d3bbbb88af01e318ab565db315d272e00f37d7a6666407 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store pragma no-cache 6si-ipv6 2001:ac8:24:44::14 expires Tue, 31 Dec 2024 19:31:46 GMT server-timing cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1735673505790_388391907_1187102807_22_1040_48_207_219";dur=1 access-control-allow-origin https://www.cyberhaven.com content-length 18 date Tue, 31 Dec 2024 19:31:46 GMT content-type text/html vary Origin
GET H2	200	public Show response api.hubspot.com/livechat-public/v1/message/	3 KB 2 KB	316ms 315ms	XHR application/json	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=59071661edfb444f937730fe52dd4d10&traceId=59071661edfb444f937730fe52dd4d10 Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e4bad6ed3f8697fdab3823e357d618a4cd36411d50f6cb951d2291fbfeb1bc0b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 X-HubSpot-Messages-Uri https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ Response headers content-encoding gzip cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZZqhdOKT8reHsTA3x%2FfblvpKo7bNvXAEBKEo1zxm6GMInXgHj0s5v8Twh2ZGIWsn83q%2BCVp%2FQp2PuxWT2wEHZ0AYrxKnPoYJrliielYD1lkNnrgmCRb2zz%2BLXy%2BYKlBxcopYeoKLEdHN0Jya%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff date Tue, 31 Dec 2024 19:31:46 GMT x-hubspot-correlation-id 215ecdf8-140c-4fbc-b8bd-4f1b157a5391 content-type application/json;charset=utf-8 vary origin, Accept-Encoding access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri strict-transport-security max-age=31536000; includeSubDomains; preload cache-control no-cache, no-store, no-transform, must-revalidate, max-age=0 nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} access-control-allow-credentials false cf-ray 8facb1156993ed24-MXP access-control-allow-origin https://www.cyberhaven.com content-length 1375 server cloudflare
GET H2	200	json Show response forms.hscollectedforms.net/collected-forms/v1/config/	133 B 638 B	145ms 136ms	XHR application/json	2606:4700::6810:6ffe CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=5298086&utk= Requested by Host: js.hscollectedforms.net URL: https://js.hscollectedforms.net/collectedforms.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:6ffe , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 51cde42c03bdfd44328fe282089cbd8e3ee5185c09d38ac0814480d824de684a Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, */* Referer https://www.cyberhaven.com/ Response headers x-robots-tag none access-control-max-age 180 x-request-id 7874c056-4da4-4d52-9932-c35b29f9a335 content-encoding br cf-cache-status DYNAMIC access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD x-content-type-options nosniff x-evy-trace-listener listener_https date Tue, 31 Dec 2024 19:31:45 GMT x-hubspot-correlation-id 7874c056-4da4-4d52-9932-c35b29f9a335 content-type application/json;charset=utf-8 vary Accept-Encoding access-control-allow-headers * x-evy-trace-route-service-name envoyset-translator cache-control max-age=0 x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-vjbmr x-envoy-upstream-service-time 7 cf-ray 8facb1138adeedc3-MXP access-control-allow-origin https://www.cyberhaven.com x-evy-trace-route-configuration listener_https/all server cloudflare x-evy-trace-virtual-host all
GET H2	200	details Show response epsilon.6sense.com/v3/company/	738 B 656 B	190ms 86ms	XHR application/json	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash 9d3d1562c7ca9da6bacad14844adfc7dcfd6f9f0bd0016f1ef70845ae0c00bf0 Request headers Authorization Token 555171e6d4c91ba269d673d31c487f9d31fe33c9 X-6s-CustomID WebTag bda12b36-0455-47af-b8ba-9529bbb134fb Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-expose-headers X-6si-Region timing-allow-origin https://6sense.com content-encoding gzip x-6si-region access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 394 date Tue, 31 Dec 2024 19:31:46 GMT content-type application/json vary Origin, Accept-Encoding
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	226ms 130ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:46 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:46 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	224ms 128ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22218d4ca0f0d30c4801ecd3d056a7fae0%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setEpsilonKey%5C%22%2C%5C%22value%5C%22%3A%5C%22555171e6d4c91ba269d673d31c487f9d31fe33c9%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22bda12b36-0455-47af-b8ba-9529bbb134fb%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22%5Btrue%2Cnull%2C3%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:46 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:46 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	200	public api.hubspot.com/livechat-public/v1/message/ Frame	0 0	323ms 146ms	Preflight text/plain	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.hubspot.com/livechat-public/v1/message/public?portalId=5298086&conversations-embed=static-1.19372&mobile=false&messagesUtk=59071661edfb444f937730fe52dd4d10&traceId=59071661edfb444f937730fe52dd4d10 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept */* Access-Control-Request-Headers x-hubspot-messages-uri Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false access-control-allow-headers Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent, X-HubSpot-Messages-Uri access-control-allow-methods GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD access-control-allow-origin https://www.cyberhaven.com allow HEAD,GET,OPTIONS cf-cache-status DYNAMIC cf-ray 8facb11478a0ed24-MXP content-length 18 content-type text/plain; charset=utf-8 date Tue, 31 Dec 2024 19:31:46 GMT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jFmqLy8Qat2hCVopRoT9WXrW1Q6NbJdYjPU1WM48HqFg4S1XaMA64i4PDERn%2BoZSg%2BeRW90VPbKov%2BTtibWHdxlMrx%2BzpVN%2BbC%2BCvzH8fRwSR4RVRIbm2HgD%2BseaVL811SZNC2XBUwGa4dDU8Q%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding x-content-type-options nosniff x-hubspot-correlation-id f00e3637-8367-4e4d-afe1-9e4210b0cedb
OPTIONS H2	200	details epsilon.6sense.com/v3/company/ Frame	0 0	181ms 52ms	Preflight	75.2.108.141 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://epsilon.6sense.com/v3/company/details Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 75.2.108.141 , United States, ASN16509 (AMAZON-02, US), Reverse DNS afe865822f884bb48.awsglobalaccelerator.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers authorization,x-6s-customid Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers authorization,x-6s-customid access-control-allow-methods OPTIONS,GET access-control-allow-origin https://www.cyberhaven.com access-control-expose-headers X-6si-Region access-control-max-age 1800 content-length 0 date Tue, 31 Dec 2024 19:31:46 GMT timing-allow-origin https://6sense.com x-6si-region
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	128ms 128ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A24%3A44%3A%3A14%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A14&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "615ccf10-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:46 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:46 GMT content-type image/gif last-modified Tue, 05 Oct 2021 22:17:52 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	recorder.js Show response us-assets.i.posthog.com/static/	112 KB 40 KB	424ms 424ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/recorder.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ec3f8ef2aa975a22f11d5d3592111d857a5917287a00ca6cf191d72859354d75 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 7 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8facb1154b04ed97-MXP access-control-allow-origin * date Tue, 31 Dec 2024 19:31:46 GMT content-type text/javascript; charset="utf-8" last-modified Tue, 31 Dec 2024 16:10:33 GMT vary Accept-Encoding server cloudflare
GET H2	200	dead-clicks-autocapture.js Show response us-assets.i.posthog.com/static/	14 KB 5 KB	144ms 144ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/dead-clicks-autocapture.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6efafe07fd29b04ec60906d17ea4e89d6c0601d49ff2f160e06d709060bbcee2 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=14400 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 4 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8facb1154b07ed97-MXP access-control-allow-origin * date Tue, 31 Dec 2024 19:31:46 GMT content-type text/javascript; charset="utf-8" last-modified Tue, 31 Dec 2024 16:10:34 GMT vary Accept-Encoding server cloudflare
GET H2	200	web-vitals.js Show response us-assets.i.posthog.com/static/	10 KB 4 KB	137ms 137ms	Script text/javascript	2606:4700:10::6816:3bb5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://us-assets.i.posthog.com/static/web-vitals.js?v=1.203.1 Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:3bb5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 7196c8f501e096262228f56c988d4fb9e4b2e3e331e411f40c30e6889f282fb9 Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers cache-control public, max-age=300 cross-origin-opener-policy same-origin content-encoding gzip x-envoy-upstream-service-time 8 cf-cache-status REVALIDATED referrer-policy same-origin x-content-type-options nosniff cf-ray 8facb1154b09ed97-MXP access-control-allow-origin * date Tue, 31 Dec 2024 19:31:46 GMT content-type text/javascript; charset="utf-8" last-modified Tue, 31 Dec 2024 16:10:33 GMT vary Accept-Encoding server cloudflare
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	343ms 239ms	XHR application/json	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_f66c385ed3fdc603b0d55a943ee4cb81/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software Clearbit / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type text/plain Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000; includeSubDomains; preload access-control-max-age 7200 access-control-expose-headers content-encoding gzip x-envoy-response-flags - access-control-allow-credentials true access-control-allow-methods GET, POST, OPTIONS content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://checkout.stripe.com https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com https://*.commandbar.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://*.commandbar.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://*.commandbar.com https://api.segment.io https://checkout.stripe.com https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self' https://*.commandbar.com https://checkout.stripe.com; img-src 'self' https://*.commandbar.com https://*.stripe.com data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; x-content-type-options nosniff access-control-allow-origin https://www.cyberhaven.com date Tue, 31 Dec 2024 19:31:46 GMT content-type application/json vary Accept-Encoding, Origin server Clearbit
GET H2	200	59071661edfb444f937730fe52dd4d10 app.hubspot.com/conversations-visitor/5298086/threads/utk/ Frame 0543	0 0	296ms 224ms	Document text/html	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://app.hubspot.com/conversations-visitor/5298086/threads/utk/59071661edfb444f937730fe52dd4d10?uuid=94caf78333404ab9af17af2085787a54&mobile=false&mobileSafari=false&hideWelcomeMessage=false&hstc=&domain=cyberhaven.com&inApp53=false&messagesUtk=59071661edfb444f937730fe52dd4d10&url=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&inline=false&isFullscreen=false&globalCookieOptOut=&isFirstVisitorSession=true&isAttachmentDisabled=false&isInitialInputFocusDisabled=false&enableWidgetCookieBanner=false&isInCMS=false&hideScrollToButton=true&isIOSMobile=false Requested by Host: js.usemessages.com URL: https://js.usemessages.com/conversations-embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options no-sniff Request headers Referer https://www.cyberhaven.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials false age 1648 cache-control max-age=600 cache-tag staticjsapp-conversations-visitor-ui-web-prod,staticjsapp-prod cf-cache-status DYNAMIC cf-ray 8facb117d842bab7-MXP content-encoding gzip content-security-policy-report-only script-src 'self' www.hubspot.com *.hsappstatic.net *.hs-analytics.net *.hs-banner.com *.hsforms.net *.hsleadflows.net *.hs-scripts.com *.hubspotfeedback.com *.usemessages.com js.hubspot.com *.hsadspixel.net *.hscollectedforms.net js-agent.newrelic.com bam.nr-data.net bam-cell.nr-data.net *.google-analytics.com www.googletagmanager.com data: 'unsafe-inline' 'unsafe-eval' blob: connect.facebook.net www.gstatic.cn www.gstatic.com www.google.com www.recaptcha.net *.fullstory.com fullstory.com apis.google.com snap.licdn.com; report-uri https://send.hsbrowserreports.com/csp/report?resource=conversations-visitor-ui/static-1.21823/html/index.html&cfRay=8facb117d842bab7&reqUrl=https%3A%2F%2Fapp.hubspot.com%2Fconversations-visitor%2F5298086%2Fthreads%2Futk%2F59071661edfb444f937730fe52dd4d10%3Fuuid%3D94caf78333404ab9af17af2085787a54%26mobile%3Dfalse%26mobileSafari%3Dfalse%26hideWelcomeMessage%3Dfalse%26hstc%3D%26domain%3Dcyberhaven.com%26inApp53%3Dfalse%26messagesUtk%3D59071661edfb444f937730fe52dd4d10%26url%3Dhttps%253A%252F%252Fwww.cyberhaven.com%252Fengineering-blog%252Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension%26inline%3Dfalse%26isFullscreen%3Dfalse%26globalCookieOptOut%3D%26isFirstVisitorSession%3Dtrue%26isAttachmentDisabled%3Dfalse%26isInitialInputFocusDisabled%3Dfalse%26enableWidgetCookieBanner%3Dfalse%26isInCMS%3Dfalse%26hideScrollToButton%3Dtrue%26isIOSMobile%3Dfalse&referrer=https%3A%2F%2Fwww.cyberhaven.com%2F&cfenv=prod&pdt=2024-12-31&csp=ro content-type text/html; charset=utf-8 date Tue, 31 Dec 2024 19:31:46 GMT etag W/"b8f9fe8ad9e4092aeea781e04fec6a18" last-modified Tue, 17 Dec 2024 16:16:40 UTC report-to {"group":"default","max_age":86400,"endpoints":[{"url":"https://send.hsbrowserreports.com/csp/reports"}]} reporting-endpoints default="https://send.hsbrowserreports.com/csp/reports?cfRay=8facb117d842bab7&resource=conversations-visitor-ui/static-1.21823/html/index.html" server cloudflare strict-transport-security max-age=31536000; includeSubDomains; preload vary origin, Accept-Encoding via 1.1 16d910967d343c8da7828222a653755e.cloudfront.net (CloudFront) x-amz-cf-id CEeTEQlV_uovyqANGCeNm0nh8HON3EcowZZW7XNRk7k0K-_Pq6_cxw== x-amz-cf-pop IAD12-P3 x-amz-replication-status COMPLETED x-amz-server-side-encryption AES256 x-amz-version-id 24F3qSFEfO6fRp.eLi3Ppt0Y6EJoUbPQ x-cache Hit from cloudfront x-content-type-options no-sniff x-envoy-upstream-service-time 4 x-evy-trace-listener listener_https x-evy-trace-route-configuration listener_https/all x-evy-trace-route-service-name envoyset-translator x-evy-trace-served-by-pod iad02/app-td/envoy-proxy-856d8787d5-56k8s x-evy-trace-virtual-host all x-hs-cache-status MISS x-hs-target-asset conversations-visitor-ui/static-1.21823/html/index.html x-hs-worker-debug-mode false x-hubspot-correlation-id 15f79e75-f027-458d-a0d3-1f47294eb25c x-request-id 15f79e75-f027-458d-a0d3-1f47294eb25c
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 258 B	129ms 129ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A14&v=1.1.31 Requested by Host: www.cyberhaven.com URL: https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "60bb2e15-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:46 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:46 GMT content-type image/gif last-modified Sat, 05 Jun 2021 07:56:05 GMT server nginx/1.14.0 (Ubuntu)
GET H2	200	blockedDomains.json Show response hubspotonwebflow.com/assets/js/	98 KB 23 KB	64ms 64ms	Fetch application/json	66.33.60.129 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://hubspotonwebflow.com/assets/js/blockedDomains.json Requested by Host: hubspotonwebflow.com URL: https://hubspotonwebflow.com/assets/js/form-124.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 66.33.60.129 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Vercel / Resource Hash 944352d0198c673b45a699471c970aef85458ea3c58a3ed825b0f0e4f33f999c Security Headers Name Value Strict-Transport-Security max-age=63072000 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers strict-transport-security max-age=63072000 cache-control public, max-age=0, must-revalidate content-encoding br x-vercel-cache HIT etag W/"04708d47dd194d37b8231a65de7a66f1" age 7035895 x-matched-path /assets/js/blockedDomains.json access-control-allow-origin * date Tue, 31 Dec 2024 19:31:47 GMT content-disposition inline; filename="blockedDomains.json" content-type application/json; charset=utf-8 server Vercel last-modified Thu, 10 Oct 2024 20:46:42 GMT x-vercel-id fra1::w579p-1735673507101-c125920e1efe
GET H2	200	__ptq.gif track.hubspot.com/	45 B 931 B	228ms 155ms	Image image/gif	2606:4700::6810:7674 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=it-it&bfp=151041951&v=1.1&a=5298086&pu=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&cts=1735673507078&vi=db84bb058512d9ad89b52feb31e9d93d&nc=true&u=208653005.db84bb058512d9ad89b52feb31e9d93d.1735673507076.1735673507076.1735673507076.1&b=208653005.1.1735673507077&cc=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers x-robots-tag none x-request-id 41ef61dc-c54c-4c4a-9057-6a62d69fff7c cf-cache-status DYNAMIC report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=om%2BWR6NdX6w3yhjzCTs8FsuancImgOe4QBkoDWi4Uz94P1prTG5PM%2BFRUELirlnSENafWU5Euf2A6nsOJtd2%2BDYYA0Roc4gHtgd7vfK%2B2o%2BIhlAoJShKoDnx3K3fi7YLKTgzPna0p1KY62g73J67"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff x-evy-trace-listener listener_https p3p CP="NOI CUR ADM OUR NOR STA NID" date Tue, 31 Dec 2024 19:31:47 GMT x-hubspot-correlation-id 41ef61dc-c54c-4c4a-9057-6a62d69fff7c content-type image/gif vary origin, Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload x-evy-trace-route-service-name envoyset-translator cache-control no-cache, no-store, no-transform nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} x-evy-trace-served-by-pod iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-8lhqm x-envoy-upstream-service-time 7 access-control-allow-credentials false cf-ray 8facb11bcbf6bab1-MXP x-evy-trace-route-configuration listener_https/all content-length 45 server cloudflare x-evy-trace-virtual-host all
GET H3	200	6515e83924723987bacc4b6b_favicon.png cdn.prod.website-files.com/64deefeac57fbbefc32df53d/	2 KB 2 KB	52ms 52ms	Other image/png	104.18.160.117 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.prod.website-files.com/64deefeac57fbbefc32df53d/6515e83924723987bacc4b6b_favicon.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 35f594c6250e4f6beb23551ea8b2128ca0faa451998403ac7859bc51873b3cf2 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cf-cache-status HIT etag "7f9532364c9c4bd7e55de7b330a315d7" x-amz-version-id 2PFNNcwh85NMJaJS3FT9RI.EWY5iSVaq age 1380806 alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Tue, 31 Dec 2024 19:31:47 GMT content-type image/png last-modified Thu, 28 Sep 2023 20:55:22 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 DXBM/QZjP7VP0udFWwQW1Ne7Ln2t4YKWVp1eFwUKXXpTzGxa2UJL/gJOzqOckRkg147HE3WbLM62S9LLMIF80Un+8HW3s9kvXNDcEiWLLzw= cache-control max-age=31536000, must-revalidate x-amz-request-id RFQT0G6005M45KPE cf-ray 8facb11b6c92d379-FRA accept-ranges bytes access-control-allow-origin * content-length 1946 server cloudflare x-amz-server-side-encryption AES256
GET H3	200	widget-tA7EQKQY.js Show response opps-widget.getwarmly.com/	598 KB 183 KB	95ms 51ms	Script text/javascript	188.114.96.9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/warmly.js?clientId=f2eeeaf3dd4d1d31a3b45c6065708bf0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.9 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bc6d50d5d2484099d6743c7978504b4d781fdb3974629742ec15c7772798f0bf Security Headers Name Value Content-Security-Policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://www.cyberhaven.com Referer https://www.cyberhaven.com/ Response headers content-encoding zstd cf-cache-status HIT etag W/"f7b80d857423a14c3abd182b35f25ecc8b513bdee66a9c0e3e8bec251b8b6b47-br" age 1595 x-permitted-cross-domain-policies none report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WYUzUBIsbXf26uOvjJ89zeu9sftAaP4JdoDLV%2FaxZV%2BMrXWxbZXYi0Zdgo0QToUXvPOKhj3VhA6uluWsnSs0wmZvwUS2o6gA4%2FI%2FXy6KlJ5p%2FkOQabzESZvrmRpJR4LyRjMN45qgqNc8Tqew"}],"group":"cf-nel","max_age":604800} x-content-type-options nosniff alt-svc h3=":443"; ma=86400 x-cache HIT server-timing cfL4;desc="?proto=QUIC&rtt=41292&min_rtt=41291&rtt_var=15487&sent=9&recv=6&lost=0&retrans=0&sent_bytes=2155&recv_bytes=4073&delivery_rate=33844&cwnd=12000&unsent_bytes=0&cid=dde1b08b912ecd97&ts=52&x=1", cfExtPri, cfHdrFlush;dur=0 date Tue, 31 Dec 2024 19:31:47 GMT content-type text/javascript; charset=utf-8 last-modified Fri, 27 Dec 2024 00:16:04 GMT x-served-by cache-fra-eddf8230050-FRA x-cache-hits 96 x-frame-options SAMEORIGIN strict-transport-security max-age=15552000; includeSubDomains vary x-fh-requested-host, accept-encoding content-security-policy default-src * 'unsafe-eval' 'unsafe-inline' data: blob: ws: wss: filesystem:; frame-ancestors 'self' https://*.tourial.com; cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=1,i=?0 x-timer S1735261732.027078,VS0,VE0 referrer-policy origin-when-cross-origin cf-ray 8facb11c1a8cdbc3-FRA access-control-allow-origin * server cloudflare
POST H3	200	sessions.createSession Show response opps-api.getwarmly.com/api/sessions/trpc/	2 KB 2 KB	286ms 231ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash f8b44091a71432c394bb2015723e925d371dde149515868aa9c1cdc8b4f40bf1 Request headers x-warmly-user-identifier x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 315a8675-2ae1-4e51-8bf3-ce558dd54f35 X-Warmly-Target session-server User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 2089 date Tue, 31 Dec 2024 19:31:47 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	sessions.createSession opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	259ms 161ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.createSession Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 31 Dec 2024 19:31:47 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	128ms 128ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A46%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%222002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A14&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "63f020a0-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:47 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:47 GMT content-type image/gif last-modified Sat, 18 Feb 2023 00:49:36 GMT server nginx/1.14.0 (Ubuntu)
OPTIONS H2	204	sessions.trackScriptAdded opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	509ms 509ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 31 Dec 2024 19:31:48 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET		cs a.usbrowserspeed.com/	0 0
POST H3	200	sessions.trackScriptAdded Show response opps-api.getwarmly.com/api/sessions/trpc/	65 B 82 B	172ms 171ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.trackScriptAdded Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 9c12e61b34f0f9c3aa0a83bac14d6ecc6f3913f33435cf85894c11510b4a8656 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 315a8675-2ae1-4e51-8bf3-ce558dd54f35 content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 65 date Tue, 31 Dec 2024 19:31:48 GMT content-type application/json; charset=utf-8 vary Origin
GET H3	200	chat.getMessages Show response opps-api.getwarmly.com/api/sessions/trpc/	31 B 47 B	168ms 168ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%222273ce89-734a-47de-b642-bf43ebdf779f%22%7D%7D Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash 2485e74dd82a729476c358bb9ad59c0322ee42bfeeac9805606cb9da39a47f98 Request headers x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 x-warmly-widget-version 1.1 x-warmly-fingerprint 315a8675-2ae1-4e51-8bf3-ce558dd54f35 content-type application/json X-Warmly-Target session-server Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31 date Tue, 31 Dec 2024 19:31:48 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H2	204	chat.getMessages opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	160ms 160ms	Preflight	2600:1901:0:9ec5:: GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/chat.getMessages?input=%7B%22json%22%3A%7B%22sessionId%22%3A%222273ce89-734a-47de-b642-bf43ebdf779f%22%7D%7D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:1901:0:9ec5:: Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version Access-Control-Request-Method GET Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-target,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 31 Dec 2024 19:31:48 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
POST H2	200	/ Show response us.i.posthog.com/s/	15 B 248 B	812ms 801ms	Fetch application/json	54.172.146.235 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://us.i.posthog.com/s/?ip=1&_=1735673508600&ver=1.203.1&compression=gzip-js Requested by Host: us-assets.i.posthog.com URL: https://us-assets.i.posthog.com/static/array.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.172.146.235 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-54-172-146-235.compute-1.amazonaws.com Software envoy / Resource Hash 0c40bafcfdc8adc6db63a6a5bfdb3dd5201798e6163fc674dc2fcbdb2a4134f1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type text/plain Referer https://www.cyberhaven.com/ Response headers x-envoy-upstream-service-time 444 access-control-allow-credentials true access-control-allow-origin https://www.cyberhaven.com content-length 15 date Tue, 31 Dec 2024 19:31:49 GMT content-type application/json vary origin, access-control-request-method, access-control-request-headers server envoy
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	127ms 127ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A48%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A47%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%223002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A14&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:48 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:48 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)
POST H3	200	sessions.updateHubspotUserToken Show response opps-api.getwarmly.com/api/sessions/trpc/	33 B 49 B	171ms 170ms	Fetch application/json	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Requested by Host: opps-widget.getwarmly.com URL: https://opps-widget.getwarmly.com/widget-tA7EQKQY.js Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash ded6935dc09c7888de1b41c8ab7cebf82223c044f9eced4628c8236962fec3c5 Request headers x-warmly-session-id 2273ce89-734a-47de-b642-bf43ebdf779f x-warmly-user-identifier 38cd6f2f-5cd2-4c77-8941-81a434a1088e x-warmly-referer https://www.cyberhaven.com/engineering-blog/cyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension Referer https://www.cyberhaven.com/ x-warmly-widget-version 1.1 x-warmly-fingerprint 315a8675-2ae1-4e51-8bf3-ce558dd54f35 X-Warmly-Target session-server x-warmly-session-source session_cache User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 content-type application/json Response headers backend-name backend-session access-control-allow-credentials true via 1.1 google access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33 date Tue, 31 Dec 2024 19:31:49 GMT content-type application/json; charset=utf-8 vary Origin
OPTIONS H3	204	sessions.updateHubspotUserToken opps-api.getwarmly.com/api/sessions/trpc/ Frame	0 0	157ms 156ms	Preflight	34.110.157.101 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://opps-api.getwarmly.com/api/sessions/trpc/sessions.updateHubspotUserToken Protocol H3 Security QUIC, , AES_128_GCM Server 34.110.157.101 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 101.157.110.34.bc.googleusercontent.com Software / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version Access-Control-Request-Method POST Origin https://www.cyberhaven.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers content-type,x-warmly-fingerprint,x-warmly-referer,x-warmly-session-id,x-warmly-session-source,x-warmly-target,x-warmly-user-identifier,x-warmly-widget-version access-control-allow-methods GET,HEAD,PUT,PATCH,POST,DELETE access-control-allow-origin https://www.cyberhaven.com alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 backend-name backend-session date Tue, 31 Dec 2024 19:31:49 GMT vary Origin, Access-Control-Request-Headers via 1.1 google
GET H2	200	img.gif b.6sc.co/v1/beacon/	43 B 257 B	130ms 129ms	Image image/gif	95.101.111.170 AKAMAI-ASN1 Akama...
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=218d4ca0f0d30c4801ecd3d056a7fae0&svisitor=null&visitor=15c03cf8-d3b7-4ff2-8370-1bb506955f89&session=79864b12-82cf-4917-8b47-757269061141&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A49%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2031%20Dec%202024%2019%3A31%3A48%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224002%22%7D&isIframe=false&m=%7B%22description%22%3A%22%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.cyberhaven.com%2Fengineering-blog%2Fcyberhavens-preliminary-analysis-of-the-recent-malicious-chrome-extension&pageViewId=71adc444-3628-4636-862e-65bf3bbd2b24&an_uid=0&webTagId=bda12b36-0455-47af-b8ba-9529bbb134fb&ipv6=2001%3Aac8%3A24%3A44%3A%3A14&v=1.1.31 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 95.101.111.170 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL), Reverse DNS a95-101-111-170.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://www.cyberhaven.com/ Response headers cache-control max-age=0, no-cache, no-store etag "5e502810-2b" pragma no-cache x-content-type-options nosniff expires Tue, 31 Dec 2024 19:31:49 GMT accept-ranges bytes content-length 43 date Tue, 31 Dec 2024 19:31:49 GMT content-type image/gif last-modified Fri, 21 Feb 2020 18:57:20 GMT server nginx/1.14.0 (Ubuntu)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

a.usbrowserspeed.com

URL

https://a.usbrowserspeed.com/cs?pid=4dd5c5fae59ce3249cf6f13469fbc883b27c8135ce5092e6a3b38092dc07d387&puid=2273ce89-734a-47de-b642-bf43ebdf779f&r=%0A%20%20%20%20https%3A%2F%2Fapi.immagnify.com%2Fv1%2Fintegrations%2Ffxf%2Fwebhook%2FkhlFEhkHvc%3Fhem%3D%24%7BHEM_SHA256_LOWERCASE%7D%26up_id%3D%24%7BUP_ID%7D%26puid%3D2273ce89-734a-47de-b642-bf43ebdf779f%26ip%3D%24%7BIP%7D%0A%20%20