urlscan.io logo urlscan.io
SecurityTrails logo

go.crowdstrike.com Open in urlscan Pro
104.17.73.206  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we7okZCmRtC-da-RSVLWQ_...
Effective URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80Lxwv...
Submission: On March 29 via api from IE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 32 IPs in 3 countries across 29 domains to perform 85 HTTP transactions. The main IP is 104.17.73.206, located in and belongs to CLOUDFLARENET, US. The main domain is go.crowdstrike.com. The Cisco Umbrella rank of the primary domain is 279881.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 8th 2021. Valid for: a year.
This is the only time go.crowdstrike.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
13 104.17.73.206 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
6 2606:4700::68... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
3 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.16.96.80 13335 (CLOUDFLAR...)
10 151.101.65.137 54113 (FASTLY)
2 104.111.234.67 16625 (AKAMAI-AS)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
5 104.111.216.226 16625 (AKAMAI-AS)
4 2a04:4e42:400... 54113 (FASTLY)
1 192.28.144.124 15224 (OMNITURE)
5 199.15.214.165 15224 (OMNITURE)
2 8 2600:9000:226... ()
12 15 34.243.100.214 ()
2 2a03:2880:f01... ()
1 2 2.18.234.21 ()
1 69.173.144.139 ()
1 2 18.196.142.162 ()
1 185.64.189.110 ()
1 2a00:1288:80:... ()
1 141.226.228.48 ()
1 2 76.223.111.18 ()
1 2 3.124.34.143 ()
1 2 37.252.173.62 ()
1 34.98.64.218 ()
2 2 142.250.185.66 ()
1 2a03:2880:f11... ()
85 32
13    104.17.73.206 (None, )

ASN13335 (CLOUDFLARENET, US)
info.crowdstrike.com
go.crowdstrike.com
2    2606:4700::6811:63a (United States)

ASN13335 (CLOUDFLARENET, US)
www.crowdstrike.com
1    2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googleoptimize.com
6    2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
3    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
maxcdn.bootstrapcdn.com
3    2a06:98c1:3121::7 (United States)

ASN13335 (CLOUDFLARENET, US)
use.fontawesome.com
1    2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    104.16.96.80 (None, )

ASN13335 (CLOUDFLARENET, US)
281-obq-266.mktoweb.com
10    151.101.65.137 (United States)

ASN54113 (FASTLY, US)
res.cloudinary.com
2    104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com
munchkin.marketo.net
2    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2606:4700:10::6814:b844 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
5    104.111.216.226 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-216-226.deploy.static.akamaitechnologies.com
sjrtp-cdn.marketo.com
rtp-static.marketo.com
4    2a04:4e42:400::393 (United States)

ASN54113 (FASTLY, US)
res.cloudinary.com
1    192.28.144.124 (United States)

ASN15224 (OMNITURE, US)
281-obq-266.mktoresp.com
5    199.15.214.165 (United States)

ASN15224 (OMNITURE, US)
PTR: sjrtp1.marketo.com
sjrtp1.marketo.com
8    2600:9000:2260:6c00:6:9280:1080:93a1 (None, )

ASN- ()
s.adroll.com
15    34.243.100.214 (None, )

ASN- ()
d.adroll.com
2    2a03:2880:f01c:8012:face:b00c:0:3 (None, )

ASN- ()
connect.facebook.net
2    2.18.234.21 (None, )

ASN- ()
dsum-sec.casalemedia.com
1    69.173.144.139 (None, )

ASN- ()
pixel.rubiconproject.com
2    18.196.142.162 (None, )

ASN- ()
pixel.advertising.com
1    185.64.189.110 (None, )

ASN- ()
image2.pubmatic.com
1    2a00:1288:80:807::1 (None, )

ASN- ()
ads.yahoo.com
1    141.226.228.48 (None, )

ASN- ()
sync.taboola.com
2    76.223.111.18 (None, )

ASN- ()
eb2.3lift.com
2    3.124.34.143 (None, )

ASN- ()
x.bidswitch.net
2    37.252.173.62 (None, )

ASN- ()
ib.adnxs.com
1    34.98.64.218 (None, )

ASN- ()
us-u.openx.net
2    142.250.185.66 (None, )

ASN- ()
cm.g.doubleclick.net
1    2a03:2880:f11c:8083:face:b00c:0:25de (None, )

ASN- ()
www.facebook.com
Apex Domain
Subdomains		 Transfer
23 adroll.com
s.adroll.com
d.adroll.com
33 KB
15 crowdstrike.com
info.crowdstrike.com
go.crowdstrike.com — Cisco Umbrella Rank: 279881
www.crowdstrike.com — Cisco Umbrella Rank: 256666
272 KB
14 cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 3646
142 KB
10 marketo.com
sjrtp-cdn.marketo.com — Cisco Umbrella Rank: 102035
rtp-static.marketo.com — Cisco Umbrella Rank: 32000
sjrtp1.marketo.com — Cisco Umbrella Rank: 96718
123 KB
6 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 701
126 KB
3 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1333
84 KB
3 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 333
12 KB
2 doubleclick.net
cm.g.doubleclick.net
665 B
2 adnxs.com
ib.adnxs.com
2 KB
2 bidswitch.net
x.bidswitch.net
1 KB
2 3lift.com
eb2.3lift.com
744 B
2 advertising.com
pixel.advertising.com
522 B
2 casalemedia.com
dsum-sec.casalemedia.com
2 KB
2 facebook.net
connect.facebook.net
113 KB
2 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 132
137 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 6225
6 KB
2 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2956
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1059
31 KB
1 facebook.com
www.facebook.com
297 B
1 openx.net
us-u.openx.net
274 B
1 taboola.com
sync.taboola.com
90 B
1 yahoo.com
ads.yahoo.com
194 B
1 pubmatic.com
image2.pubmatic.com
591 B
1 rubiconproject.com
pixel.rubiconproject.com
239 B
1 mktoresp.com
281-obq-266.mktoresp.com — Cisco Umbrella Rank: 597867
311 B
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 1045
457 B
1 mktoweb.com
281-obq-266.mktoweb.com
68 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 409
33 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 2128
58 KB
0 outbrain.com Failed
sync.outbrain.com Failed
85 29
Domain Requested by
15 d.adroll.com 12 redirects s.adroll.com
14 res.cloudinary.com go.crowdstrike.com
12 go.crowdstrike.com info.crowdstrike.com
go.crowdstrike.com
281-obq-266.mktoweb.com
8 s.adroll.com 2 redirects go.crowdstrike.com
s.adroll.com
d.adroll.com
6 cdn.cookielaw.org go.crowdstrike.com
cdn.cookielaw.org
5 sjrtp1.marketo.com sjrtp-cdn.marketo.com
rtp-static.marketo.com
4 rtp-static.marketo.com sjrtp-cdn.marketo.com
3 use.fontawesome.com go.crowdstrike.com
use.fontawesome.com
3 cdnjs.cloudflare.com go.crowdstrike.com
2 cm.g.doubleclick.net 2 redirects
2 ib.adnxs.com 1 redirects
2 x.bidswitch.net 1 redirects
2 eb2.3lift.com 1 redirects
2 pixel.advertising.com 1 redirects
2 dsum-sec.casalemedia.com 1 redirects
2 connect.facebook.net d.adroll.com
connect.facebook.net
2 www.googletagmanager.com go.crowdstrike.com
2 munchkin.marketo.net go.crowdstrike.com
munchkin.marketo.net
2 www.crowdstrike.com go.crowdstrike.com
1 www.facebook.com
1 us-u.openx.net
1 sync.taboola.com
1 ads.yahoo.com
1 image2.pubmatic.com
1 pixel.rubiconproject.com
1 281-obq-266.mktoresp.com munchkin.marketo.net
1 sjrtp-cdn.marketo.com go.crowdstrike.com
1 geolocation.onetrust.com cdn.cookielaw.org
1 281-obq-266.mktoweb.com go.crowdstrike.com
1 ajax.googleapis.com go.crowdstrike.com
1 maxcdn.bootstrapcdn.com go.crowdstrike.com
1 stackpath.bootstrapcdn.com go.crowdstrike.com
1 www.googleoptimize.com go.crowdstrike.com
1 info.crowdstrike.com
0 sync.outbrain.com Failed
85 35
Subject Issuer Validity Valid
info.crowdstrike.com
Cloudflare Inc ECC CA-3		 2021-05-22 -
2022-05-21		 a year crt.sh
go.crowdstrike.com
Cloudflare Inc ECC CA-3		 2021-05-08 -
2022-05-07		 a year crt.sh
www.crowdstrike.com
DigiCert SHA2 High Assurance Server CA		 2020-06-09 -
2022-06-14		 2 years crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2021-06-01 -
2022-05-31		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-03-17 -
2022-06-09		 3 months crt.sh
281-obq-266.mktoweb.com
Cloudflare Inc ECC CA-3		 2022-02-19 -
2023-02-19		 a year crt.sh
*.cloudinary.com
Go Daddy Secure Certificate Authority - G2		 2020-05-27 -
2022-06-22		 2 years crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA		 2021-03-29 -
2022-04-06		 a year crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2022-01-12 -
2023-01-12		 a year crt.sh
*.marketo.com
DigiCert SHA2 Secure Server CA		 2021-03-29 -
2022-04-06		 a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-30 -
2022-11-30		 a year crt.sh
s.adroll.com
Amazon		 2021-08-02 -
2022-08-31		 a year crt.sh
adroll.mgr.consensu.org
Amazon		 2021-09-09 -
2022-10-08		 a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-01-05 -
2022-04-05		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Frame ID: 4D133CC1D7F46CAA6D9417CC0AFDC637
Requests: 86 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Register | Web Shell Intrusion Live Attack & Defend DemoBack ButtonFilter Button

Page URL History Show full URLs

  1. https://info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we... Page URL
  2. https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • (?:a|s)\.adroll\.com
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

85
Requests

82 %
HTTPS

44 %
IPv6

29
Domains

35
Subdomains

32
IPs

3
Countries

1237 kB
Transfer

3453 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we7okZCmRtC-da-RSVLWQ_pMu38_Icb8OW2E=/MjgxLU9CUS0yNjYAAAGDc6ydY9AfnMDXdXp_IJS_h6hqY0b4jjQKYERrxkHdlDRPoZT8tsPPZhjLMmKw63G69VZKS54 Page URL
  2. https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63
  • https://s.adroll.com/j/exp/5Q4Q33H4BRCRBAXODNJYP6/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 64
  • https://s.adroll.com/j/pre/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/fpconsent.js HTTP 302
  • https://s.adroll.com/j/pre/index.js
Request Chain 67
  • https://d.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&pv=88527251324.2217&cookie=&adroll_s_ref=https%3A//info.crowdstrike.com/&keyw= HTTP 302
  • https://s.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/JK7SIYBXVFBL3G4JSDFST7.js
Request Chain 70
  • https://d.adroll.com/cm/index/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616&C=1
Request Chain 71
  • https://d.adroll.com/cm/n/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expires=365
Request Chain 72
  • https://d.adroll.com/cm/onevideo/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
  • https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
Request Chain 73
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Request Chain 74
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Request Chain 75
  • https://d.adroll.com/cm/r/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Request Chain 76
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Request Chain 77
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://eb2.3lift.com/xuid?mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Request Chain 78
  • https://d.adroll.com/cm/b/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Request Chain 79
  • https://d.adroll.com/cm/x/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://ib.adnxs.com/setuid?entity=172&code=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Request Chain 81
  • https://d.adroll.com/cm/o/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6 HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=d1498fcee053fad525324d79dadb421a
Request Chain 82
  • https://d.adroll.com/cm/g/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6&google_nid=adroll5 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=0UmPzuBT-tUlMk152ttCGg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=0UmPzuBT-tUlMk152ttCGg&google_tc= HTTP 302
  • https://d.adroll.com/cm/g/in

85 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
MjgxLU9CUS0yNjYAAAGDc6ydY9AfnMDXdXp_IJS_h6hqY0b4jjQKYERrxkHdlDRPoZT8tsPPZhjLMmKw63G69VZKS54
info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we7okZCmRtC-da-RSVLWQ_pMu38_Icb8OW2E=/ 		516 B
985 B 		Document
General
Check archive.org
Download Go to
Full URL
https://info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we7okZCmRtC-da-RSVLWQ_pMu38_Icb8OW2E=/MjgxLU9CUS0yNjYAAAGDc6ydY9AfnMDXdXp_IJS_h6hqY0b4jjQKYERrxkHdlDRPoZT8tsPPZhjLMmKw63G69VZKS54
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Tue, 29 Mar 2022 12:56:52 GMT
content-type
text/html
cache-control
private, no-cache, no-store, max-age=0
x-content-type-options
nosniff
vary
Accept-Encoding
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6f38c49b5e9b9073-FRA
content-encoding
gzip
Primary Request web-shell-live-attack-defend-demo-mar-30.html
go.crowdstrike.com/ 		76 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Requested by
Host: info.crowdstrike.com
URL: https://info.crowdstrike.com/dc/Otckpue8p1wAbi_2J5fO7j2Y5otQG-ACvDr0UJTzrvzyC5V5VHRblPq0IGgFvmp9r_ETZE4we7okZCmRtC-da-RSVLWQ_pMu38_Icb8OW2E=/MjgxLU9CUS0yNjYAAAGDc6ydY9AfnMDXdXp_IJS_h6hqY0b4jjQKYERrxkHdlDRPoZT8tsPPZhjLMmKw63G69VZKS54
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33d0bdb78ee36a471d45a2141fdbd5a1878892ee904d4a465e94afd85c63f111
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://info.crowdstrike.com/

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-type
text/html; charset=utf-8
strict-transport-security
max-age=31536000; includeSubDomains
p3p
CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT"
x-asset-type
LP
vary
*,Accept-Encoding
x-content-type-options
nosniff
x-cache-status
BYPASS
x-mkto-nginx-cache
false
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
6f38c4a50c3b9bf5-FRA
content-encoding
gzip
forrester-wave-edr-2020.css
go.crowdstrike.com/rs/281-OBQ-266/images/ 		38 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/forrester-wave-edr-2020.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b5e0ff171b8ed34e77c634e96ac3a768930fa958f6250ffc78ba2f232551cb4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
135
content-length
5913
last-modified
Sat, 12 Mar 2022 03:53:54 GMT
server
cloudflare
etag
"81b9a-97c6-5d9fd655dfd39"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4a8fcdb9bf5-FRA
expires
Tue, 29 Mar 2022 16:56:53 GMT
english-datalayer.js
www.crowdstrike.com/wp-content/custom_js/marketo-dataLayer/ 		141 B
871 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.crowdstrike.com/wp-content/custom_js/marketo-dataLayer/english-datalayer.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:63a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fe3fe2ff12f2874356b7ade29b1f0eb26e1ef1fac52ed3dac8b3644b9cc3983
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options ALLOW-FROM https://crowdstrike.lookbookhq.com/
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
via
1.1 8e24576ebf8b347c902c6c8cb2ee4948.cloudfront.net (CloudFront)
x-content-type-options
nosniff
cf-cache-status
HIT
age
5111
cf-polished
origSize=185
cf-ray
6f38c4a93da890ec-FRA
x-cache
Hit from cloudfront
cf-bgj
minify
content-encoding
br
vary
Accept-Encoding
x-xss-protection
1; mode=block
referrer-policy
strict-origin-when-cross-origin
last-modified
Wed, 13 Nov 2019 20:30:53 GMT
server
cloudflare
x-frame-options
ALLOW-FROM https://crowdstrike.lookbookhq.com/
etag
W/"4b795f31ec9b1bfcfbe0736627f8c55b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-version-id
Cq.hK.lmVIJOMT2KhTxYG6XST2vGxyxt
access-control-allow-origin
https://www.crowdstrike.jp
cache-control
public, max-age=3600
content-security-policy
upgrade-insecure-requests
x-amz-cf-pop
HEL50-C1
content-type
application/javascript
x-amz-cf-id
VoSl2WYkEgrZKiMy-XbPx75hHbjFaNMShp_XfF3IBa4eHqvSfcUzcw==
expires
Tue, 29 Mar 2022 16:56:53 GMT
optimize.js
www.googleoptimize.com/ 		253 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleoptimize.com/optimize.js?id=GTM-N8HXDD2
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f549c460a61c682eced15c311125b3920cdc0d4384a932319f901942be857d33
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
58637
x-xss-protection
0
expires
Tue, 29 Mar 2022 12:56:54 GMT
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8305d86074fdee76ef38a7e264f3ac0bfab4051d8f13625b4bbd5396120b1fe1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
dVKVlVU+J+RB4CMcqf9NTw==
age
4009
vary
Accept-Encoding
content-length
6678
x-ms-lease-status
unlocked
last-modified
Tue, 29 Mar 2022 02:30:14 GMT
server
cloudflare
etag
0x8DA112C0E32F122
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
02cc7dca-601e-0142-3220-43b5a7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4a93ed19277-FRA
slick.min.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/slick.min.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50ad448a8a5720bf8a5617db15af31ae60163de06331576f60c6244c012ffc72
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2001843
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
394
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:16:21 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fd5-559"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5UDlf%2F6t2a2TRCM1QvWEMR2u8Ff013MKgUgtCcUQr0qqwBkmysgM5hGCbE%2FjoDZ3HG89I1a3tyZY%2B69L6htdMvSf%2BxkVx4FdOygxoy7YFMv3EfLVhPXMVFkV4mbufHG%2BNp9%2BHh1o%2B8J%2BQWv9TFZfk4u"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6f38c4a92ed668ec-FRA
expires
Sun, 19 Mar 2023 12:56:53 GMT
slick-theme.min.css
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/ 		2 KB
978 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/slick-theme.min.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e21aa5b0d3fd28cebed9e03c5544f4924e11b0c453792ed018720cf8c679b0b6
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
2805051
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
657
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:16:21 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fd5-956"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o7pQRz933agSp5YWvB8uiSyyi%2FCAAArXKsYjjXyvMZ2T9ts7BIA2I69V8IqAVPMOAOOn3y2D%2FfmAsBAX2b1%2Bsq745TiHrB1t5%2Btl2XUGveCRuVG1LGINBfQtY3jBhYngG0UHGzqPlIO5R1XZ%2Fptdgl6%2B"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6f38c4a92ed768ec-FRA
expires
Sun, 19 Mar 2023 12:56:53 GMT
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/ 		150 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.2.1/css/bootstrap.min.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
601
age
2499394
cdn-cachedat
08/03/2021 19:30:51
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver
1.0
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:07 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
cce9c5ff73dc20dc1ebaf2e1e7ec20b4
cf-ray
6f38c4a93c84917c-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/ 		28 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.6.1/css/font-awesome.min.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
632, 617, 617
age
2515993
cdn-cachedat
2021-06-08 21:36:06
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:54 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
0da3e6fa0421515cbcf5425517fc7012
cf-ray
6f38c4a92f6c9b33-FRA
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
d5e5cdfb8c.css
use.fontawesome.com/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/d5e5cdfb8c.css
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b475e3d6e54a1a29de8a823a088379ef721939cbba91252b2ba46afa84a972f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
3134
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
95XPP9MJW0531A6T
x-amz-id-2
kt+kEYYSytbB1kmOxd6AwbFrlBBlUN/NdJAgpNTqm0S/hfpfjQfiQhgrVnyPbDMzETabBHE7Riw=
last-modified
Thu, 01 Jul 2021 15:23:54 GMT
server
cloudflare
etag
W/"6a2be14c1cc338b422fe8018dd72e211"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mNc7wF5nbdWpjDkaZ%2FUNCvpQ8vQR1V5vzCzvq11n250CarZCOdoICPGOiI4c6etQ%2FOC59%2F9UluWqe2ZE73v8tTzoQIkB4kVvcrXraWEmE3DMiGEqIqqH%2BWqcs2nv1izrmw9DtcF67cB5N9X58AZFC4g1"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=1800
cf-ray
6f38c4a93bc790e8-FRA
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.11.3/ 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 10:32:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
8660
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
33507
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 29 Mar 2023 10:32:34 GMT
forms2.min.js
281-obq-266.mktoweb.com/js/forms2/js/ 		205 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://281-obq-266.mktoweb.com/js/forms2/js/forms2.min.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.96.80 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Mon, 07 Mar 2022 19:28:07 GMT
server
cloudflare
age
653
etag
"610f2-3326e-5d9a5dd2b7fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
6f38c4a93f0490c0-FRA
expires
Tue, 29 Mar 2022 16:56:53 GMT
crowd-strike-transparent-logo.svg
go.crowdstrike.com/rs/281-OBQ-266/images/ 		6 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/crowd-strike-transparent-logo.svg
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae3c68a56b7228ea789b10706a57610d9829b254d278a81e4f35f843ee3de9dd
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 12 Mar 2022 02:37:15 GMT
server
cloudflare
age
135
etag
W/"818d0-16f8-5d9fc534a200d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
6f38c4aa4f759bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
forms2.min.js
go.crowdstrike.com/js/forms2/js/ 		205 KB
68 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/js/forms2/js/forms2.min.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Mon, 07 Mar 2022 19:28:07 GMT
server
cloudflare
age
1888
etag
"520b38-3326e-5d9a5dd2b7fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=14400
cf-ray
6f38c4a9de8f9bf5-FRA
vary
Accept-Encoding
expires
Tue, 29 Mar 2022 16:56:54 GMT
cs-asset-computer1.png
go.crowdstrike.com/rs/281-OBQ-266/images/ 		48 KB
48 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/cs-asset-computer1.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
50598b629423470348dd8e77c69edb5c0c77574717a6ce41477f467b224a13e6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 12 Mar 2022 06:45:08 GMT
server
cloudflare
age
135
etag
"81d34-be76-5d9ffc9c7b35e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4aa4f779bf5-FRA
content-length
48758
expires
Tue, 29 Mar 2022 16:56:54 GMT
logo-App__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-App__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
1fa707e9d8bb2f930ec5589b9eb2815d03971aec9d64af865cea7416475d0025
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-App__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
2076
last-modified
Tue, 09 Jul 2019 10:18:33 GMT
server
Cloudinary
etag
"a7923afe66ba667344f8f8ba7d7da234"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-Sony__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-Sony__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
b8d9b64b5a583b2de85ce067045720552abd13522d50702dfe0cea6ed4f2c484
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-Sony__2x.webp"
server-timing
fastly;dur=2;cpu=1;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
1158
last-modified
Tue, 09 Jul 2019 10:18:35 GMT
server
Cloudinary
etag
"73704624c98cd655e185813685e153be"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-Rackspace__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-Rackspace__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
2fa2d37f2180647f50837fbdf279552af05238e02f00cd303286a08249438620
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-Rackspace__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
2382
last-modified
Tue, 09 Jul 2019 10:18:38 GMT
server
Cloudinary
etag
"7b7a900034c147b7b5a6d9990aa92229"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo__Hyatt__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo__Hyatt__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
07aabc963d310ef96705555daa1a2e3efcea456c89d1b6ce8093a7000a2611be
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo__Hyatt__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
2284
last-modified
Tue, 09 Jul 2019 10:35:26 GMT
server
Cloudinary
etag
"a1c634c38095c829d8ff1cbd1ce5fc47"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-TribuneMedia__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-TribuneMedia__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
019cc0bde64fb303144d69cb42f847525000ea293386695fd94b37aec750a5af
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-TribuneMedia__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
2590
last-modified
Tue, 09 Jul 2019 10:18:42 GMT
server
Cloudinary
etag
"6b3b1623da612af9225111733d1b3ec1"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-CreditSuisse__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-CreditSuisse__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
c3e67ab21659e2e30197b0b132bde9d3b3de59178572654e3ac37b6343b8afcb
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-CreditSuisse__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
3394
last-modified
Tue, 09 Jul 2019 10:18:44 GMT
server
Cloudinary
etag
"4ba725a69c2c8310011200093e63c91c"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-Sega__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-Sega__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
9275f5a7f0e7d65aabf66476ebd0f75902cb709c07c8c2077a2866b5af3d6eea
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-Sega__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
3124
last-modified
Tue, 09 Jul 2019 10:18:48 GMT
server
Cloudinary
etag
"b70fa87d5dcd672a8407cead97775068"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-WeillCornerMedicine__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-WeillCornerMedicine__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
268e87c005b86b84ec5955db73fe30abaa4adb3e8c0961da7f34231976a93c50
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-WeillCornerMedicine__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.465Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
5202
last-modified
Tue, 09 Jul 2019 10:18:54 GMT
server
Cloudinary
etag
"083b4b10960ba8191a329086e4bcf7e1"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-SanDiego__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-SanDiego__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
dd1606ed1fe4c221ae17eb4547270c3b68548eebef97bd9879ec4c2927e8da54
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-SanDiego__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.460Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
4962
last-modified
Tue, 09 Jul 2019 10:18:58 GMT
server
Cloudinary
etag
"bd3384234d134dc27f2287541ef823f4"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
logo-Greenhill__2x.png
res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://res.cloudinary.com/spiralyze/image/upload/f_auto/CrowdStrike/SMB-Landing-Page/logo-Greenhill__2x.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
bbd4765e8ae0368bee457acf3afe18021c87d385c9b559a10bc8fe0814fa9209
Security Headers
Name Value
Strict-Transport-Security max-age=604800
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
content-disposition
inline; filename="logo-Greenhill__2x.webp"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.465Z;desc=hit,rtt;dur=7
vary
Accept,User-Agent
content-length
1794
last-modified
Tue, 09 Jul 2019 10:18:59 GMT
server
Cloudinary
etag
"895473a3e0b04c64821b5a3278ebd617"
strict-transport-security
max-age=604800
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing,Vary,X-Content-Type-Options
cache-control
private, no-transform, immutable, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
crowd-strike-logo-white.svg
go.crowdstrike.com/rs/281-OBQ-266/images/ 		6 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/crowd-strike-logo-white.svg
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96c84bed8c7eae0007923d714a0fc726308304da44213c762ed304587b7498a0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 12 Mar 2022 02:38:34 GMT
server
cloudflare
age
170
etag
W/"560dd5-16f8-5d9fc57fd33e9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=14400
cf-ray
6f38c4aa4f7b9bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
slick.min.js
cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/ 		43 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.9.0/slick.min.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
492400
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9564
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:16:21 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fd5-ab69"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=famSMmSZi6hGzGflgKIV5wBZri8gKvkXHtRekunp3oWfBGyHySGuiU%2B%2F2zERUI6mVjHHHp7U7gn0Ocq3FnJYmaYg5QPEx6HmOnuv%2FGSioIbFBwbtxnLhEuYMZZrJRu%2BGu2n%2B35WwL8zQ%2BHQ1SFIrySYT"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6f38c4aa4da0904c-FRA
expires
Sun, 19 Mar 2023 12:56:54 GMT
email-decode.min.js
go.crowdstrike.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
825 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 24 Mar 2022 11:29:35 GMT
server
cloudflare
etag
W/"623c561f-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800, public
cf-ray
6f38c4aa3f579bf5-FRA
vary
Accept-Encoding
expires
Thu, 31 Mar 2022 12:56:54 GMT
set-ctm-cookies.js
www.crowdstrike.com/wp-content/custom_js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.crowdstrike.com/wp-content/custom_js/set-ctm-cookies.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:63a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers
munchkin.js
munchkin.marketo.net// 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net//munchkin.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 Oct 2021 01:24:07 GMT
Server
AkamaiNetStorage
ETag
"461ce1cffaadfebf2e7659745618ba8e:1635470647.434977"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
753
stripmkttok.js
go.crowdstrike.com/js/ 		2 KB
785 B 		Script
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/js/stripmkttok.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
2351
content-length
678
last-modified
Mon, 07 Mar 2022 19:28:07 GMT
server
cloudflare
etag
"61c18-602-5d9a5dd2b7fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4aa4f739bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
gtm.js
www.googletagmanager.com/ 		331 KB
91 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5V5LPNC
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
63de13a9d85453064d4611aca758a131ecfe0da2814574709a2baa7de7bf9ed7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
92947
x-xss-protection
0
last-modified
Tue, 29 Mar 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 29 Mar 2022 12:56:54 GMT
gtm.js
www.googletagmanager.com/ 		136 KB
46 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-W4TT8S
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d2b4e5c25fc2ddd56f562ca4119fd99a93a1e3b44579fdae80ca1048cd2dd84f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46307
x-xss-protection
0
last-modified
Tue, 29 Mar 2022 12:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 29 Mar 2022 12:56:54 GMT
bee15b7c-b632-450e-9003-9c8b60b3b978.json
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/bee15b7c-b632-450e-9003-9c8b60b3b978.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3db6b20b5ba1a07142116a9016091e3c6423cd49e80a0824fd6c7893946767c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
0dq4Z3ysibGwnYZH/2aVqQ==
age
987
vary
Accept-Encoding
content-length
1381
x-ms-lease-status
unlocked
last-modified
Wed, 07 Apr 2021 19:21:17 GMT
server
cloudflare
etag
0x8D8F9FA5129656B
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0d1489e3-401e-0155-48c1-1175c4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4aa08329128-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
font-awesome-css.min.css
use.fontawesome.com/releases/v4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v4.7.0/css/font-awesome-css.min.css
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/d5e5cdfb8c.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://use.fontawesome.com/d5e5cdfb8c.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
5464337
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id
6GFEKMY757AZVMJR
x-amz-id-2
a1rJqww5kk6lKRIdMoYuvo+3HD7E3szcwTrKVVU4ncyVGl1400tEbljwaRkXSznguGC14aUQGXY=
last-modified
Wed, 30 Jun 2021 15:26:48 GMT
server
cloudflare
etag
W/"36082410df2ef7f83932219089dc1443"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EFbD6oLoAtl4TFLqu5ddrSUns3j6cToUhkfZecQZrjgXMpl6N0GSi%2BQAfuHnX6ucI7pFgMmlFJbsL9f6oGqP2xwDbonwH%2BJQTc6st6pBPYgopkrEvEqgwAvvRPD2FvwOKFemPKtMkiO0bb6LfWPdOhba"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
6f38c4a99c5590e8-FRA
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		182 B
457 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:b844 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept
application/json
Referer
https://go.crowdstrike.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
strict-transport-security
max-age=31536000; includeSubDomains; preload
cf-ray
6f38c4aa69a29bd6-FRA
access-control-allow-headers
Content-Type
rtp.js
sjrtp-cdn.marketo.com/rtp-api/v1/ 		151 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.216.226 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-226.deploy.static.akamaitechnologies.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
837a2268259f95d9790fc719656755edb40bf0b5d03816ac175d643cab2f48c8
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Strict-Transport-Security
max-age=63113904
Content-Encoding
gzip
Last-Modified
Tue, 15 Mar 2022 17:47:47 GMT
Server
Jetty(7.3.1.v20110307)
Date
Tue, 29 Mar 2022 12:56:54 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript; charset=UTF-8
Cache-Control
public, max-age=1
Connection
keep-alive
Content-Length
42260
forms2.css
go.crowdstrike.com/js/forms2/css/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/js/forms2/css/forms2.css
Requested by
Host: 281-obq-266.mktoweb.com
URL: https://281-obq-266.mktoweb.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
Security Headers
Name Value
Strict-Transport-Security max-age=63113904
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
4432
vary
Accept-Encoding
content-length
2623
last-modified
Mon, 07 Mar 2022 19:28:07 GMT
server
cloudflare
etag
"40cf9-3437-5d9a5dd2b7fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63113904
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4aad87c9bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
forms2-theme-plain.css
go.crowdstrike.com/js/forms2/css/ 		828 B
335 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://go.crowdstrike.com/js/forms2/css/forms2-theme-plain.css
Requested by
Host: 281-obq-266.mktoweb.com
URL: https://281-obq-266.mktoweb.com/js/forms2/js/forms2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3171
content-length
246
last-modified
Mon, 07 Mar 2022 19:28:07 GMT
server
cloudflare
etag
"40cf5-33c-5d9a5dd2b7fc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4aad87f9bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
Tungsten-Book.woff
res.cloudinary.com/spiralyze/raw/upload/v1562065467/CrowdStrike/fonts/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://res.cloudinary.com/spiralyze/raw/upload/v1562065467/CrowdStrike/fonts/Tungsten-Book.woff
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::393 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
56be880b9328c424571b88c71256b667b1067224b65894b53ff87e2b7ea5d7f7
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://go.crowdstrike.com/
Origin
https://go.crowdstrike.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
last-modified
Tue, 02 Jul 2019 11:04:28 GMT
server
Cloudinary
etag
"e3e787b5a895ada372626c9dfd1e793b"
strict-transport-security
max-age=604800
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=2592000
content-disposition
attachment; filename="Tungsten-Book.woff"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.422Z;desc=hit,rtt;dur=11
accept-ranges
bytes
timing-allow-origin
*
content-length
24824
Karla-Bold.woff
res.cloudinary.com/spiralyze/raw/upload/v1595921533/CrowdStrike/fonts/font/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://res.cloudinary.com/spiralyze/raw/upload/v1595921533/CrowdStrike/fonts/font/Karla-Bold.woff
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::393 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
b48f9a93f560e3bb3df8ae5000432c9f1c9fcc7e2d8526b43ae65de72af13691
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://go.crowdstrike.com/
Origin
https://go.crowdstrike.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
last-modified
Tue, 28 Jul 2020 07:32:14 GMT
server
Cloudinary
etag
"6df3a5009ae6eaae69815fcc73bf5444"
strict-transport-security
max-age=604800
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=2592000
content-disposition
attachment; filename="Karla-Bold.woff"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.422Z;desc=hit,rtt;dur=11
accept-ranges
bytes
timing-allow-origin
*
content-length
10860
Karla-Regular.woff
res.cloudinary.com/spiralyze/raw/upload/v1595921535/CrowdStrike/fonts/font/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://res.cloudinary.com/spiralyze/raw/upload/v1595921535/CrowdStrike/fonts/font/Karla-Regular.woff
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::393 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
b64183b20a1b5ab56761fb503e7197c641ae2a61e065bf5452a4fa5c0afd9c78
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://go.crowdstrike.com/
Origin
https://go.crowdstrike.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
last-modified
Tue, 28 Jul 2020 07:32:16 GMT
server
Cloudinary
etag
"01a0e35a8edf1e2fe0a8287643153c10"
strict-transport-security
max-age=604800
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=2592000
content-disposition
attachment; filename="Karla-Regular.woff"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.422Z;desc=hit,rtt;dur=11
accept-ranges
bytes
timing-allow-origin
*
content-length
12020
crowdstrike.ttf
res.cloudinary.com/spiralyze/raw/upload/v1578641445/CrowdStrike/Logo%20Fonts/ 		65 KB
65 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://res.cloudinary.com/spiralyze/raw/upload/v1578641445/CrowdStrike/Logo%20Fonts/crowdstrike.ttf
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::393 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Cloudinary /
Resource Hash
748bdf6d3bdc5e521d2d27f95cda8dd8b370ee48d950bb8594a897ff18d97799
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

Referer
https://go.crowdstrike.com/
Origin
https://go.crowdstrike.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
last-modified
Fri, 10 Jan 2020 07:30:46 GMT
server
Cloudinary
etag
"6998916b53d0356181123a825bb89569"
strict-transport-security
max-age=604800
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Disposition,ETag,Server-Timing
cache-control
public, no-transform, immutable, max-age=2592000
content-disposition
attachment; filename="crowdstrike.ttf"
server-timing
fastly;dur=1;cpu=0;start=2022-03-29T12:56:54.422Z;desc=hit,rtt;dur=11
accept-ranges
bytes
timing-allow-origin
*
content-length
66532
CrowdCastImage.jpg
go.crowdstrike.com/rs/281-OBQ-266/images/ 		121 KB
121 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/CrowdCastImage.jpg
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c0f6027a3a89ee8c6a145155ffb7724c12da7810796e0faaaaf2b18a23002a42
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
135
last-modified
Sat, 12 Mar 2022 03:53:58 GMT
content-length
123830
cf-bgj
h2pri
server
cloudflare
etag
"81b9c-1e3b6-5d9fd6598ef10"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/jpeg
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4aad8809bf5-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
fontawesome-webfont.woff2
use.fontawesome.com/releases/v4.7.0/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://use.fontawesome.com/releases/v4.7.0/fonts/fontawesome-webfont.woff2
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/d5e5cdfb8c.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://use.fontawesome.com/d5e5cdfb8c.css
Origin
https://go.crowdstrike.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
access-control-allow-methods
GET
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
2376868
cf-ray
6f38c4aadef19137-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
77160
x-amz-id-2
Wrf2hQBroziPiWhkmHtIDlUNa19h9hMFaoVzp0YMsw1meKCPbry9vjQcYeBHiO6JB6Fngml0FeA=
last-modified
Wed, 30 Jun 2021 15:26:48 GMT
server
cloudflare
etag
"af7ae505a9eed503f8b8e6982036873e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age
3000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L7ajhhMbnaeMlKkh4lOpzFMuIcrKy6vQFQAl2Cj2pyAeNRPgHF14hLyX%2BR3jQjMH9HoJO0uxPhe5F%2FloTV2kqcEBsofDLysiQGdRxDx8MjeEsLjUNRts5Dk8Ac8wQM95qd3znRSHJW4c3Kn2uz65gw5P"}],"group":"cf-nel","max_age":604800}
x-amz-request-id
4NC5BCQQJSJ2S06H
access-control-allow-origin
*
cache-control
max-age=31556926
accept-ranges
bytes
content-type
application/font-woff2
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/6.16.0/ 		374 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
353bcd41d11cc5a2bcb6763c269e41ac785c06ace29ac10053bb7c0fa3bf1ecf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
dGCXlveaBvO7BI0nfZKP+g==
age
3911
vary
Accept-Encoding
content-length
85065
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:31:04 GMT
server
cloudflare
etag
0x8D910C57D52F14C
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
a073d3b2-301e-007c-71cf-1145d3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4aac9329277-FRA
munchkin.js
munchkin.marketo.net/161/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net//munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-234-67.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Thu, 07 Jul 2022 12:56:54 GMT
en.json
cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/fbaee1c5-1b1f-4091-b49b-dcc9bef72337/ 		100 KB
19 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/bee15b7c-b632-450e-9003-9c8b60b3b978/fbaee1c5-1b1f-4091-b49b-dcc9bef72337/en.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f965cc4d17aaab0b2a6f98210c67b8c9eb3dadced70ceccefb6f6c0a58682c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
tLqOVOA4kC8joLgXeSDt0Q==
age
9148
vary
Accept-Encoding
content-length
19263
x-ms-lease-status
unlocked
last-modified
Wed, 07 Apr 2021 19:21:34 GMT
server
cloudflare
etag
0x8D8F9FA5BC2BB66
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9dd3de7d-f01e-00a6-20c1-11e0f8000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4ab0a5f9128-FRA
expires
Tue, 29 Mar 2022 16:56:54 GMT
dropdown-arrow.png
go.crowdstrike.com/rs/281-OBQ-266/images/ 		175 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://go.crowdstrike.com/rs/281-OBQ-266/images/dropdown-arrow.png
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/rs/281-OBQ-266/images/forrester-wave-edr-2020.css
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.17.73.206 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
06961925265a88facff6078d9ff1aa58dbae04ba9d6a732510b39bb0bcdf7615
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/rs/281-OBQ-266/images/forrester-wave-edr-2020.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:54 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
last-modified
Sat, 12 Mar 2022 03:53:57 GMT
server
cloudflare
age
135
etag
"81b9b-af-5d9fd659702e0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
6f38c4ab291e9bf5-FRA
content-length
175
expires
Tue, 29 Mar 2022 16:56:54 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/6.16.0/assets/ 		12 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/assets/otFlat.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eb1fa7363d6e4772f7c49d67f031d68f209e66de6c3c05aade6fdc57a02505c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
DKM3/i+7h7Fs8cEMor3s2A==
age
986
vary
Accept-Encoding
content-length
2938
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:30:47 GMT
server
cloudflare
etag
0x8D910C572DA86E8
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
6ba30df8-301e-0151-0bc1-118046000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4ab8b4d9128-FRA
otPcTab.json
cdn.cookielaw.org/scripttemplates/6.16.0/assets/v2/ 		46 KB
12 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/6.16.0/assets/v2/otPcTab.json
Requested by
Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.16.0/otBannerSdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a02b434edb84f078f67ae040f565f6258b91dfa3f16ad8e305392cfe5d18e8c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 29 Mar 2022 12:56:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
2Zi7TemSsXHh6hY5sI0Yeg==
age
986
vary
Accept-Encoding
content-length
11890
x-ms-lease-status
unlocked
last-modified
Thu, 06 May 2021 19:30:50 GMT
server
cloudflare
etag
0x8D910C574C4FC1A
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
01dd8176-c01e-00e1-25eb-2c3f93000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=14400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
6f38c4ab8b4f9128-FRA
truncated
/ 		817 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Content-Type
image/svg+xml
visitWebPage
281-obq-266.mktoresp.com/webevents/ 		2 B
311 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://281-obq-266.mktoresp.com/webevents/visitWebPage?_mchNc=1648558614434&_mchCn=web-shell-live-attack-defend-demo-mar-30&_mchId=281-OBQ-266&_mchTk=_mch-crowdstrike.com-1648558614431-26497&mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ&_mchWs=j1RR&_mchHo=go.crowdstrike.com&_mchPo=&_mchRu=%2Fweb-shell-live-attack-defend-demo-mar-30.html&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Finfo.crowdstrike.com%2F&_mchQp=mkt_tok%3DMjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
dff565f3-6394-4906-9c10-6529a497fd21
jquery.min.js
rtp-static.marketo.com/rtp/libs/jquery/1.8.3/ 		91 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/jquery/1.8.3/jquery.min.js
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.216.226 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-226.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Sep 2015 11:20:15 GMT
Server
AkamaiNetStorage
ETag
"3576a6e73c9dccdbbc4a2cf8ff544ad7:1441624815"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
33467
jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/ 		22 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.216.226 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-226.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Nov 2017 08:57:42 GMT
Server
AkamaiNetStorage
ETag
"7f5b0bee9b1f7af8413b351cbceca223:1510045062"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
text/css
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
3752
trw
sjrtp1.marketo.com/gw1/ 		0
434 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp1.marketo.com/gw1/trw?aid=crowdstrike&ref=https%3A%2F%2Finfo.crowdstrike.com%2F&trwv.uid=crowdstrike-1648558614511-2932b71e&trwv.vc=1&trwsa.sid=crowdstrike-1648558614514-d959f78e&trwsb.cpv=1&ctzo=-00:00&uri=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html%3Fmkt_tok%3DMjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ&ma=id%3A281-OBQ-266%26token%3A_mch-crowdstrike.com-1648558614431-26497&pm=&viewedTypes=&rts=1648558614518
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.15.214.165 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
sjrtp1.marketo.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:55 GMT
Cache-Control
no-cache
Server
Jetty(7.3.1.v20110307)
Connection
close
Content-Length
0
Strict-Transport-Security
max-age=63113904
Content-Type
application/x-javascript; charset=UTF-8
ga-integration-2.0.4.js
rtp-static.marketo.com/rtp/libs/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.216.226 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-226.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Thu, 03 Jun 2021 07:56:23 GMT
Server
AkamaiNetStorage
ETag
"cfd84ea6865e772828527b0485a0eb7e:1622706982.648039"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
5540
msg
sjrtp1.marketo.com/gw1/ 		0
493 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp1.marketo.com/gw1/msg?a=2&sid=crowdstrike-1648558614514-d959f78e&aid=crowdstrike&ma=id%3A281-OBQ-266%26token%3A_mch-crowdstrike.com-1648558614431-26497&viewedTypes=&0.2783899513146537&rts=1648558614570
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.15.214.165 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
sjrtp1.marketo.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:55 GMT
Content-Encoding
gzip
Server
Jetty(7.3.1.v20110307)
Transfer-Encoding
chunked
Connection
close
Content-Type
text/javascript; charset=UTF-8
Cache-Control
no-cache
Strict-Transport-Security
max-age=63113904
jquery-custom-ui.min.js
rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/ 		126 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.216.226 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-216-226.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Jan 2018 12:54:21 GMT
Server
AkamaiNetStorage
ETag
"5a9f8dd85d85afd20544bd437a505338:1515502461"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Access-Control-Max-Age
86400
Access-Control-Allow-Credentials
false
Connection
keep-alive
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Content-Length
35484
msg
sjrtp1.marketo.com/gw1/ 		0
493 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp1.marketo.com/gw1/msg?a=2&sid=crowdstrike-1648558614514-d959f78e&aid=crowdstrike&ma=id%3A281-OBQ-266%26token%3A_mch-crowdstrike.com-1648558614431-26497&viewedTypes=&0.5392062823705923&rts=1648558615647
Requested by
Host: sjrtp-cdn.marketo.com
URL: https://sjrtp-cdn.marketo.com/rtp-api/v1/rtp.js?aid=crowdstrike
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.15.214.165 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
sjrtp1.marketo.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:56 GMT
Content-Encoding
gzip
Server
Jetty(7.3.1.v20110307)
Transfer-Encoding
chunked
Connection
close
Content-Type
text/javascript; charset=UTF-8
Cache-Control
no-cache
Strict-Transport-Security
max-age=63113904
visitor
sjrtp1.marketo.com/gw1/rtp/api/v1_1/ 		282 B
922 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sjrtp1.marketo.com/gw1/rtp/api/v1_1/visitor?sid=crowdstrike-1648558614514-d959f78e&aid=crowdstrike&1648558616145
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.15.214.165 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
sjrtp1.marketo.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
05151c7368e8adeba4787a1dfb0daee5a021e3f5332e352a37d2fbde0ebb6011
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Mar 2022 12:56:56 GMT
Content-Encoding
gzip
Last-Modified
Tue Mar 29 07:56:56 CDT 2022
Server
Jetty(7.3.1.v20110307)
Strict-Transport-Security
max-age=63113904
Content-Type
application/json;charset=UTF-8
Access-Control-Allow-Origin
https://go.crowdstrike.com
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Transfer-Encoding
chunked
Connection
close
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sgm
sjrtp1.marketo.com/gw1/ga/ 		278 B
730 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://sjrtp1.marketo.com/gw1/ga/sgm?sid=crowdstrike-1648558614514-d959f78e&1648558616146
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
199.15.214.165 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
sjrtp1.marketo.com
Software
Jetty(7.3.1.v20110307) /
Resource Hash
d8165325d4b59e6db44ff20c1c7aa7308534c9bb942e09f52ca9ef51ec2691b0
Security Headers
Name Value
Strict-Transport-Security max-age=63113904

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:56 GMT
Server
Jetty(7.3.1.v20110307)
Strict-Transport-Security
max-age=63113904
Content-Type
text/json;charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
close
Content-Length
278
roundtrip.js
s.adroll.com/j/ 		46 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: go.crowdstrike.com
URL: https://go.crowdstrike.com/web-shell-live-attack-defend-demo-mar-30.html?mkt_tok=MjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3f80e3803b6486311257b63b959fabf99632544f1029bbfa62e9717b568c3fd9

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
6ZZsOBoEbwzOeepp2GIOk0cPLSsuE1fT
Content-Encoding
gzip
Etag
W/"dd4d01eb8e2b2b680edcacf986dfde9d"
Age
2913
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Last-Modified
Mon, 21 Mar 2022 13:03:50 GMT
Server
AmazonS3
Date
Tue, 29 Mar 2022 12:08:26 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
jCA2udHVDHg4FsfTFEgwAP2nKC_CVaeppJJqiiFUtwfhlhV-271xGg==
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/5Q4Q33H4BRCRBAXODNJYP6/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
762 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
Yo1foR6FJ6WFFBWqTYM2cazsDqVdFv1D
Via
1.1 9b182fbbf070d660a2561c354cfc9980.cloudfront.net (CloudFront)
Etag
"5816cced8568d223aa09d889f300692b"
Age
33325
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
28
Last-Modified
Thu, 03 Mar 2022 22:40:46 GMT
Server
AmazonS3
Date
Tue, 29 Mar 2022 03:42:42 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
SrDs0Xgyog9GH49QzwDHoREe5g4H3Tv5yzbG9OR0ygaOo3J-HY1HmA==

Redirect headers

Date
Tue, 29 Mar 2022 10:13:01 GMT
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Age
9834
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
Dqp_6D3j462fqdHsBxIXy8QCjEPOpx1GEOpkws9yLClf1MIsEH-NCQ==
index.js
s.adroll.com/j/pre/
Redirect Chain
  • https://s.adroll.com/j/pre/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/fpconsent.js
  • https://s.adroll.com/j/pre/index.js
0
733 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/index.js
Protocol
HTTP/1.1
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
nQEe8wQ7h0ROt7P4GJfDfstto6x684Hy
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
65307
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Wed, 15 Jan 2020 23:54:18 GMT
Server
AmazonS3
Date
Mon, 28 Mar 2022 18:48:30 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
V6mzyQc0ww4t4kTzn6k8M9x_heY6HJAwebp-bWR2-kAS11xSx2Vnkw==

Redirect headers

Date
Tue, 29 Mar 2022 06:16:22 GMT
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Age
24034
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Server
AmazonS3
Location
https://s.adroll.com/j/pre/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/xml
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
FlvgVMh1NYENgj54yEs5jQSJlgCXvw420nPDvBkc_nq6lGlhk3lRVw==
index.js
s.adroll.com/j/pre/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/ 		0
786 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/pre/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
Z4H4XOuwpS8Zkn3Lrv7amU7kJNTn5yu9
Via
1.1 64effe17e30169a2d4da2d11e4e0ebda.cloudfront.net (CloudFront)
Etag
"d41d8cd98f00b204e9800998ecf8427e"
Age
1354
X-Amz-Server-Side-Encryption
AES256
X-Cache
Hit from cloudfront
Connection
keep-alive
Content-Length
0
Last-Modified
Sun, 27 Mar 2022 21:35:17 GMT
Server
AmazonS3
Date
Tue, 29 Mar 2022 12:40:30 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
8OVjMaEiWDHuzDUPguRS5IMzdZGpzWX3RJTIHam1_mL0Q2KQ5ePYtQ==
5Q4Q33H4BRCRBAXODNJYP6
d.adroll.com/consent/check/ 		448 B
917 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d.adroll.com/consent/check/5Q4Q33H4BRCRBAXODNJYP6?arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&_s=33dc8002b21413eb8e07aa5af1a9258e&_b=2
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.243.100.214 -, , ASN (),
Reverse DNS
Software
nginx/1.20.0 /
Resource Hash
1fa6d3f228dbd9a0c69dae168c3e2dd9da66073ec02902294c9fac0e105617cc

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-type
application/javascript
content-length
448
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
JK7SIYBXVFBL3G4JSDFST7.js
s.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/
Redirect Chain
  • https://d.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-de...
  • https://s.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/JK7SIYBXVFBL3G4JSDFST7.js
5 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/JK7SIYBXVFBL3G4JSDFST7.js
Protocol
HTTP/1.1
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
67809befb28f573eb88d1657a115a651e952a2fc761bbaa7b21716ee9c757268

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
.ARP4BO7srRW3j5E7dKwZEwDsfvnqLGI
Content-Encoding
gzip
Etag
W/"3b89cb41055f68d2f88c066ca7a2a717"
Age
3352
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Last-Modified
Wed, 02 Feb 2022 19:32:44 GMT
Server
AmazonS3
Date
Tue, 29 Mar 2022 12:09:29 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
S53QPkUMbK3ZDZdSt-IeTIDVo5-afPMuIUYX8St96SFQpesBr-cNWg==

Redirect headers

date
Tue, 29 Mar 2022 12:56:56 GMT
x-segment-display-name
Visitors to Unsegmented Pages
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
x-rule-type
p
content-length
0
pragma
no-cache
x-conversion-value
0.00
server
nginx/1.20.0
x-rule
*
x-segment-eid
JK7SIYBXVFBL3G4JSDFST7
location
https://s.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT/JK7SIYBXVFBL3G4JSDFST7.js
cache-control
no-store, no-cache, must-revalidate
x-pixel-eid
3VD6P4Z5VVGIDCI2DJK7LT
x-segment-name
*
x-advertisable-eid
5Q4Q33H4BRCRBAXODNJYP6
x-conversion-currency
fbevents.js
connect.facebook.net/en_US/ 		99 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&pv=88527251324.2217&cookie=&adroll_s_ref=https%3A//info.crowdstrike.com/&keyw=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26320
x-xss-protection
0
pragma
public
x-fb-debug
2FZNFHD3xGzjXcgVDFs05NkoeMswXM1MyrQ0rZGhJdoj77dagjXWvccqBTuNBi0CvQxbGdpzoR3bOva3nnStaQ==
x-fb-trip-id
686109401
x-frame-options
DENY
date
Tue, 29 Mar 2022 12:56:56 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
sendrolling.js
s.adroll.com/j/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.adroll.com/j/sendrolling.js
Requested by
Host: d.adroll.com
URL: https://d.adroll.com/pixel/5Q4Q33H4BRCRBAXODNJYP6/3VD6P4Z5VVGIDCI2DJK7LT?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&pv=88527251324.2217&cookie=&adroll_s_ref=https%3A//info.crowdstrike.com/&keyw=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2260:6c00:6:9280:1080:93a1 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
134568be83d33ab28a55e78e8e8ac638ac6a57ff1bfc62bb5bc4e93fee39e20f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

X-Amz-Version-Id
56vkttxJ9HswNfxezFOgxCSsrCP_VjWS
Content-Encoding
gzip
Etag
W/"c317a5be7d65fa0c4d68d9735af020e4"
Age
793
X-Amz-Server-Side-Encryption
AES256
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Connection
keep-alive
Vary
Accept-Encoding
Via
1.1 e1f830ecc47fb90176664a66bea2c9de.cloudfront.net (CloudFront)
Last-Modified
Wed, 23 Mar 2022 16:12:44 GMT
Server
AmazonS3
Date
Tue, 29 Mar 2022 12:43:44 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600
Access-Control-Allow-Credentials
false
X-Amz-Cf-Pop
TXL50-P3
Access-Control-Allow-Headers
*
X-Amz-Cf-Id
yIRBT7iObU5n8cI5QDwTky5AIvlISW7LCiD81fWW9dBtCPrLwrmcOA==
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://d.adroll.com/cm/index/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q...
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616&C=1
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616&C=1
Protocol
HTTP/1.1
Server
2.18.234.21 -, , ASN (),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Mar 2022 12:56:56 GMT
Server
Apache
Vary
Is-Traffic-Usersync
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Tue, 29 Mar 2022 12:56:56 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 29 Mar 2022 12:56:56 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expiration=1680094616&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
333
Expires
Tue, 29 Mar 2022 12:56:56 GMT
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://d.adroll.com/cm/n/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expires=365
0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expires=365
Protocol
HTTP/1.1
Server
69.173.144.139 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
6f9fd0201ed801884e5299d5aabca094
Content-Type
image/gif

Redirect headers

location
https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&expires=365
pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
124
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
sync
pixel.advertising.com/ups/55980/
Redirect Chain
  • https://d.adroll.com/cm/onevideo/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5...
  • https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
  • https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
0
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
Protocol
H2
Server
18.196.142.162 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:56 GMT
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location
https://pixel.advertising.com/ups/55980/sync?uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true
date
Tue, 29 Mar 2022 12:56:56 GMT
content-length
0
strict-transport-security
max-age=31536000
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
cookie-sync
sync.outbrain.com/
Redirect Chain
  • https://d.adroll.com/cm/outbrain/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5...
  • https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
0
0
Pug
image2.pubmatic.com/AdServer/
Redirect Chain
  • https://d.adroll.com/cm/pubmatic/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXy...
42 B
591 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
Protocol
H2
Server
185.64.189.110 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 06:13:49 GMT
cache-control
no-store, no-cache, private
x-lat
amspug0024:0:383
server
nginx
content-type
image/gif; charset=utf-8
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDYmdGw9MTI5NjAw&piggybackCookie=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA
pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
212
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
v1
ads.yahoo.com/cms/
Redirect Chain
  • https://d.adroll.com/cm/r/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
0
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
Protocol
H2
Server
2a00:1288:80:807::1 -, , ASN (),
Reverse DNS
Software
ATS /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store
x-content-type-options
nosniff
server
ATS
strict-transport-security
max-age=15552000
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection
1; mode=block

Redirect headers

location
https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA
pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
165
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
rtb-h
sync.taboola.com/sg/adroll-network/1/
Redirect Chain
  • https://d.adroll.com/cm/taboola/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q...
  • https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
0
90 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Protocol
H2
Server
141.226.228.48 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:56 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
13712

Redirect headers

location
https://sync.taboola.com/sg/adroll-network/1/rtb-h?taboola_hm=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
111
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
xuid
eb2.3lift.com/
Redirect Chain
  • https://d.adroll.com/cm/triplelift/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable...
  • https://eb2.3lift.com/xuid?mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e
  • https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
37 B
355 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
Protocol
H2
Server
76.223.111.18 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
/xuid?ld=1&mid=4714&xuid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE&dongle=c85e&gdpr=1&cmp_cs=&us_privacy=
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
sync
x.bidswitch.net/ul_cb/
Redirect Chain
  • https://d.adroll.com/cm/b/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://x.bidswitch.net/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
43 B
495 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Protocol
HTTP/1.1
Server
3.124.34.143 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Tue, 29 Mar 2022 12:56:56 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

Location
https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Date
Tue, 29 Mar 2022 12:56:56 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
bounce
ib.adnxs.com/
Redirect Chain
  • https://d.adroll.com/cm/x/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://ib.adnxs.com/setuid?entity=172&code=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Protocol
HTTP/1.1
Server
37.252.173.62 -, , ASN (),
Reverse DNS
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 29 Mar 2022 12:56:56 GMT
X-Proxy-Origin
185.213.155.162; 185.213.155.162; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
31e007bb-a7a1-4e31-a090-b36d4b20972e
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 29 Mar 2022 12:56:56 GMT
X-Proxy-Origin
185.213.155.162; 185.213.155.162; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid
cf546d74-946d-4695-a1f9-51c6abbc72a7
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D172%26code%3DZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
out
d.adroll.com/cm/l/ 		42 B
180 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/l/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4BRCRBAXODNJYP6
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.243.100.214 -, , ASN (),
Reverse DNS
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-transform,public,max-age=300,s-maxage=900
server
nginx/1.20.0
content-length
42
vary
Cookie
content-type
image/gif
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://d.adroll.com/cm/o/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://us-u.openx.net/w/1.0/sd?id=537103138&val=d1498fcee053fad525324d79dadb421a
43 B
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?id=537103138&val=d1498fcee053fad525324d79dadb421a
Protocol
H2
Server
34.98.64.218 -, , ASN (),
Reverse DNS
Software
OXGW/17.2.1 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Mar 2022 12:56:57 GMT
via
1.1 google
server
OXGW/17.2.1
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?id=537103138&val=d1498fcee053fad525324d79dadb421a
pragma
no-cache
date
Tue, 29 Mar 2022 12:56:56 GMT
cache-control
no-store, no-cache, must-revalidate
server
nginx/1.20.0
content-length
87
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
in
d.adroll.com/cm/g/
Redirect Chain
  • https://d.adroll.com/cm/g/out?adroll_fpc=103beaf62a60f3fb3a0c069e455da3d3-1648558616757&arrfrr=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&advertisable=5Q4Q33H4...
  • https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=0UmPzuBT-tUlMk152ttCGg
  • https://cm.g.doubleclick.net/pixel?google_sc=&google_nid=artb&google_hm=0UmPzuBT-tUlMk152ttCGg&google_tc=
  • https://d.adroll.com/cm/g/in
42 B
538 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.adroll.com/cm/g/in
Protocol
H2
Server
34.243.100.214 -, , ASN (),
Reverse DNS
Software
nginx/1.20.0 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 29 Mar 2022 12:56:57 GMT
server
nginx/1.20.0
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control
no-store, no-cache, must-revalidate
content-type
image/gif
content-length
42
x-result
g.-1.-1.-1

Redirect headers

pragma
no-cache
date
Tue, 29 Mar 2022 12:56:57 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://d.adroll.com/cm/g/in
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
225
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
346813882393432
connect.facebook.net/signals/config/ 		307 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/346813882393432?v=2.9.57&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
dc846ef5ba4e1654ac7b14fd221269b8b17693cebe6ccc81dc6b12db4972227c
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
WDVr5dN8XRE+BzuYF1fDG1GpLA9kpJ7L0GwYuaDkOhFFCVoEJZP53spvd0Y1gNfHJzFGPO0PBBoZa0Pm2IS1wg==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Tue, 29 Mar 2022 12:56:56 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/ 		44 B
297 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=346813882393432&ev=PageView&dl=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html&rl=https%3A%2F%2Finfo.crowdstrike.com%2F&if=false&ts=1648558616980&cd[segment_eid]=JK7SIYBXVFBL3G4JSDFST7&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=29&fbp=fb.1.1648558616979.460465106&it=1648558616876&coo=false&dpo=LDU&dpoco=0&dpost=0&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de -, , ASN (),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://go.crowdstrike.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Tue, 29 Mar 2022 12:56:57 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Tue, 29 Mar 2022 12:56:57 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
sync.outbrain.com
URL
https://sync.outbrain.com/cookie-sync?p=adroll&uid=ZDE0OThmY2VlMDUzZmFkNTI1MzI0ZDc5ZGFkYjQyMWE

Verdicts & Comments Add Verdict or Comment

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| structuredClone object| oncontextlost object| oncontextrestored object| dataLayer object| OneTrustStub function| OptanonWrapper function| $ function| jQuery function| rtp object| mktoPreFillFields object| MktoForms2 number| setMktoFormsInterval string| OnetrustActiveGroups string| OptanonActiveGroups object| otStubData function| cs_jQuery string| adroll_adv_id string| adroll_pix_id function| getCookie string| new_window_location_search object| dictionary string| key string| cookiemonster function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin object| jQuery111307069618646439724 object| jQuery11240052722969782285745 object| Optanon object| OneTrust object| google_tag_manager object| google_optimize function| onYouTubeIframeAPIReady object| MunchkinTracker function| getInternetExplorerVersion function| consoleMessage function| makeGetRequest function| createCORSRequest object| ITLocalStorageAPI object| InsighteraUtil object| iiq object| ibq object| trackObj function| isCurrentSession function| addDynamicScript function| rtpRCMD object| AITag object| aiq object| AIConfig function| setButtonWidthHeight function| getDirectionForWidgetSide function| updateWidget function| initialize function| showWidgetCampaign function| hide function| injectContent function| execute function| destroy object| InsighteraWidget function| setTimeoutFunction object| exp_2_year function| loadRichMediaImage object| csUtms string| eventMethod function| eventHandler string| messageEvent object| msg function| alignElementPosition function| applyAttributeHeightToPics function| revertAttributeHeightToPics boolean| __adroll_loaded string| __mktTokVal

9 Cookies

Domain/Path Name / Value
info.crowdstrike.com/ Name: BIGipServerab_mailtracking_80
Value: !lxXI2yze7NRasI/aQbCLRqc3TBcuimsPXeoFijwek47y8lRqugxK5qkXebD3hDdMLuGN6oGc4zObkuA=
.info.crowdstrike.com/ Name: __cf_bm
Value: eo_RjCsYJjbqGNclPYaGAf2B6tlLs5YdwiYwFHsuqoU-1648558612-0-AXt25GS+bzoLDUnFNSFYY2X/6RjvrcuHu5ip0/hRy75xJh0/0374WXhLbbe53N3amsQUBcWAOHicSFjQMvPrCJg=
go.crowdstrike.com/ Name: BIGipServerab01web-nginx-app_https
Value: !0oZfEG//99FVyy7aQbCLRqc3TBcuikWssP7B9BoBPathYgQ1JQCj6Q0KoNlDQkzoTZygrOJkeULzMtw=
.go.crowdstrike.com/ Name: __cf_bm
Value: Q88BK4KvjYmYxPvJpFptpuF2Dgq91mJH_I2nR07QXVw-1648558613-0-AZ/NrY3y3xaCVc6gjUB09ul0je+KhpybAhUH/nnv3EKBbmkgEQKhlg12FkCXyLheS47pe13Mcv4bh9q8+2itWiM=
.281-obq-266.mktoweb.com/ Name: __cf_bm
Value: KoZp4qz59YxocX9RH37PKFgQwaJxkkj80YRpONY6KvU-1648558613-0-AdUqx38sSeF+dbqiW00TbcLNLHyL2gcW6qcNgqQL0xxE8VjcHo5yS33M8Il7gRn5Iie+Z1iusxSPfvY5Z51sMss=
.crowdstrike.com/ Name: OptanonConsent
Value: isIABGlobal=false&datestamp=Tue+Mar+29+2022+12%3A56%3A54+GMT%2B0000+(GMT)&version=6.16.0&consentId=049eef09-8db8-4d7e-9bb6-45e4fa765033&interactionCount=0&landingPath=https%3A%2F%2Fgo.crowdstrike.com%2Fweb-shell-live-attack-defend-demo-mar-30.html%3Fmkt_tok%3DMjgxLU9CUS0yNjYAAAGDc6ydY_WplsItOAAA80LxwvAtwNdPs9vREluy8AbdWTXQYjHX6Y15SKRv6U12Fq9egSCFbzhm0oYQu1eK9EWXqUTgMvusKI0wt3VskKVwrjiCceQ&groups=C0001%3A1%2CC0003%3A0%2CC0002%3A0%2CC0004%3A0&hosts=H56%3A1%2CH58%3A1%2CH81%3A1%2CH9%3A1%2CH59%3A1%2CH10%3A1%2CH12%3A1%2CH31%3A1%2CH95%3A1%2CH48%3A1%2CH49%3A1%2CH1%3A0%2CH88%3A0%2CH60%3A0%2CH61%3A0%2CH17%3A0%2CH19%3A0%2CH30%3A0%2CH33%3A0%2CH40%3A0%2CH8%3A0%2CH13%3A0%2CH23%3A0%2CH24%3A0%2CH25%3A0%2CH32%3A0%2CH55%3A0%2CH57%3A0%2CH3%3A0%2CH4%3A0%2CH5%3A0%2CH6%3A0%2CH84%3A0%2CH7%3A0%2CH11%3A0%2CH85%3A0%2CH91%3A0%2CH14%3A0%2CH92%3A0%2CH15%3A0%2CH16%3A0%2CH18%3A0%2CH63%3A0%2CH20%3A0%2CH21%3A0%2CH22%3A0%2CH26%3A0%2CH27%3A0%2CH28%3A0%2CH29%3A0%2CH94%3A0%2CH34%3A0%2CH35%3A0%2CH36%3A0%2CH37%3A0%2CH38%3A0%2CH39%3A0%2CH41%3A0%2CH42%3A0%2CH43%3A0%2CH44%3A0%2CH64%3A0%2CH45%3A0%2CH46%3A0%2CH47%3A0%2CH65%3A0%2CH66%3A0%2CH50%3A0
.crowdstrike.com/ Name: _mkto_trk
Value: id:281-OBQ-266&token:_mch-crowdstrike.com-1648558614431-26497
.crowdstrike.com/ Name: trwv.uid
Value: crowdstrike-1648558614511-2932b71e%3A1
.crowdstrike.com/ Name: trwsa.sid
Value: crowdstrike-1648558614514-d959f78e%3A1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

281-obq-266.mktoresp.com
281-obq-266.mktoweb.com
ads.yahoo.com
ajax.googleapis.com
cdn.cookielaw.org
cdnjs.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
dsum-sec.casalemedia.com
eb2.3lift.com
geolocation.onetrust.com
go.crowdstrike.com
ib.adnxs.com
image2.pubmatic.com
info.crowdstrike.com
maxcdn.bootstrapcdn.com
munchkin.marketo.net
pixel.advertising.com
pixel.rubiconproject.com
res.cloudinary.com
rtp-static.marketo.com
s.adroll.com
sjrtp-cdn.marketo.com
sjrtp1.marketo.com
stackpath.bootstrapcdn.com
sync.outbrain.com
sync.taboola.com
us-u.openx.net
use.fontawesome.com
www.crowdstrike.com
www.facebook.com
www.googleoptimize.com
www.googletagmanager.com
x.bidswitch.net
sync.outbrain.com
104.111.216.226
104.111.234.67
104.16.96.80
104.17.73.206
141.226.228.48
142.250.185.66
151.101.65.137
18.196.142.162
185.64.189.110
192.28.144.124
199.15.214.165
2.18.234.21
2600:9000:2260:6c00:6:9280:1080:93a1
2606:4700:10::6814:b844
2606:4700::6810:135e
2606:4700::6810:9440
2606:4700::6811:63a
2606:4700::6812:acf
2a00:1288:80:807::1
2a00:1450:4001:808::2008
2a00:1450:4001:809::200a
2a00:1450:4001:809::200e
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
2a04:4e42:400::393
2a06:98c1:3121::7
3.124.34.143
34.243.100.214
34.98.64.218
37.252.173.62
69.173.144.139
76.223.111.18
019cc0bde64fb303144d69cb42f847525000ea293386695fd94b37aec750a5af
05151c7368e8adeba4787a1dfb0daee5a021e3f5332e352a37d2fbde0ebb6011
06961925265a88facff6078d9ff1aa58dbae04ba9d6a732510b39bb0bcdf7615
07aabc963d310ef96705555daa1a2e3efcea456c89d1b6ce8093a7000a2611be
0fe3fe2ff12f2874356b7ade29b1f0eb26e1ef1fac52ed3dac8b3644b9cc3983
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
134568be83d33ab28a55e78e8e8ac638ac6a57ff1bfc62bb5bc4e93fee39e20f
1fa6d3f228dbd9a0c69dae168c3e2dd9da66073ec02902294c9fac0e105617cc
1fa707e9d8bb2f930ec5589b9eb2815d03971aec9d64af865cea7416475d0025
256e42104f48a5fa80b031da12dc56acde224fba3f9810f8f8192b39136d365a
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
268e87c005b86b84ec5955db73fe30abaa4adb3e8c0961da7f34231976a93c50
278cd45917f5fee0e5710b34f2c03a3652544fe5a6ccea56cbbd0bd7324bf5e7
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2fa2d37f2180647f50837fbdf279552af05238e02f00cd303286a08249438620
339b2b60e94b6dc169fd9e5b68ac16b1ca08ef6a4968e98a0f43c2add405e79a
33d0bdb78ee36a471d45a2141fdbd5a1878892ee904d4a465e94afd85c63f111
353bcd41d11cc5a2bcb6763c269e41ac785c06ace29ac10053bb7c0fa3bf1ecf
357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d
35f273e01e70db780ae423347dffecfc27cc348ba4abbd6099331559a7c5cd31
3db6b20b5ba1a07142116a9016091e3c6423cd49e80a0824fd6c7893946767c4
3e18d0e3dd548e9745884578e3cd9f0a492ddbb6f3b797db364b45bb16cadfb3
3f80e3803b6486311257b63b959fabf99632544f1029bbfa62e9717b568c3fd9
4a02b434edb84f078f67ae040f565f6258b91dfa3f16ad8e305392cfe5d18e8c
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bf3aca933aa233702f890083af601fb16149ec8a17f8c1b90d30450562bde08
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
50598b629423470348dd8e77c69edb5c0c77574717a6ce41477f467b224a13e6
50ad448a8a5720bf8a5617db15af31ae60163de06331576f60c6244c012ffc72
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54b1a318711ed45da6f1a787a0b0f601199c8676b7d565a4163674833c64b0a0
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56be880b9328c424571b88c71256b667b1067224b65894b53ff87e2b7ea5d7f7
57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa
5b9573e1023da775390e9284ec0eb1c606df9b468a28980055b4a6aa804f4350
5f965cc4d17aaab0b2a6f98210c67b8c9eb3dadced70ceccefb6f6c0a58682c3
61c6caebd23921741fb5ffe6603f16634fca9840c2bf56ac8201e9264d6daccf
63de13a9d85453064d4611aca758a131ecfe0da2814574709a2baa7de7bf9ed7
67809befb28f573eb88d1657a115a651e952a2fc761bbaa7b21716ee9c757268
6b3bef53dc4a96ec07149d02a60b5fd026332bbce0b4ece79f3c55e3ddb85f5c
6b475e3d6e54a1a29de8a823a088379ef721939cbba91252b2ba46afa84a972f
748bdf6d3bdc5e521d2d27f95cda8dd8b370ee48d950bb8594a897ff18d97799
7b5e0ff171b8ed34e77c634e96ac3a768930fa958f6250ffc78ba2f232551cb4
8305d86074fdee76ef38a7e264f3ac0bfab4051d8f13625b4bbd5396120b1fe1
837a2268259f95d9790fc719656755edb40bf0b5d03816ac175d643cab2f48c8
9275f5a7f0e7d65aabf66476ebd0f75902cb709c07c8c2077a2866b5af3d6eea
96c84bed8c7eae0007923d714a0fc726308304da44213c762ed304587b7498a0
ae3c68a56b7228ea789b10706a57610d9829b254d278a81e4f35f843ee3de9dd
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b48f9a93f560e3bb3df8ae5000432c9f1c9fcc7e2d8526b43ae65de72af13691
b5d7707ea8fc00aae40bf500ac7498d7f32f6b1bbff7b4fde976a40345eb5f9d
b64183b20a1b5ab56761fb503e7197c641ae2a61e065bf5452a4fa5c0afd9c78
b8d9b64b5a583b2de85ce067045720552abd13522d50702dfe0cea6ed4f2c484
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbd4765e8ae0368bee457acf3afe18021c87d385c9b559a10bc8fe0814fa9209
c0f6027a3a89ee8c6a145155ffb7724c12da7810796e0faaaaf2b18a23002a42
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c3e67ab21659e2e30197b0b132bde9d3b3de59178572654e3ac37b6343b8afcb
d2b4e5c25fc2ddd56f562ca4119fd99a93a1e3b44579fdae80ca1048cd2dd84f
d8165325d4b59e6db44ff20c1c7aa7308534c9bb942e09f52ca9ef51ec2691b0
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc846ef5ba4e1654ac7b14fd221269b8b17693cebe6ccc81dc6b12db4972227c
dd1606ed1fe4c221ae17eb4547270c3b68548eebef97bd9879ec4c2927e8da54
e21aa5b0d3fd28cebed9e03c5544f4924e11b0c453792ed018720cf8c679b0b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb1fa7363d6e4772f7c49d67f031d68f209e66de6c3c05aade6fdc57a02505c1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f549c460a61c682eced15c311125b3920cdc0d4384a932319f901942be857d33
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f